systex | b7609b89b18587dbaf7b32c7c10321894b33c772155a463f9453a2f37200484b

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 04:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 365KB
Sample260721-em3jtaev2p
SHA256 b7609b89b18587dbaf7b32c7c10321894b33c772155a463f9453a2f37200484b
MD5 7bd41bad8b9c67d0ff9c3c7455ad02ab
SHA1 1377cca67006cf5483737a88362e0c96c7f9a5cf
SHA512 601a64e6f3fadc260636e20b868a26b99fc26f081746931f75d0691ab5c20ab52f13107ee8e599226a6d2eb4a0fde5f74657da3904043af4c0324473a98113c0
SSDEEP 3072:auxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:auxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D9847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4928	wrojhbzurljebzwr.exe
4648	wrojhbzurljebzwr.sys
5840	CreateProcess.exe
468	wuomjezwro.exe
964	CreateProcess.exe
4464	CreateProcess.exe
4148	i_wuomjezwro.exe
3352	qojgeywuol.sys
4964	CreateProcess.exe
3184	tomgebwtol.exe
4508	CreateProcess.exe
5216	CreateProcess.exe
5032	i_tomgebwtol.exe
4944	ljgeywtolg.sys
1124	CreateProcess.exe
728	jdaywqliga.exe
2796	CreateProcess.exe
6012	CreateProcess.exe
4736	i_jdaywqliga.exe
6128	ligaytqoid.sys
2004	CreateProcess.exe
4124	igayvqoiga.exe
6120	CreateProcess.exe
1740	CreateProcess.exe
4748	i_igayvqoiga.exe
5556	avsqnigayv.sys
4968	CreateProcess.exe
3524	avsqnifdxv.exe
4156	CreateProcess.exe
5848	CreateProcess.exe
4872	i_avsqnifdxv.exe
1216	faxvpnkfdx.sys
1932	CreateProcess.exe
5948	fcavpkicax.exe
1672	CreateProcess.exe
3420	CreateProcess.exe
1936	i_fcavpkicax.exe
4592	qkhcausmkf.sys
3544	CreateProcess.exe
2904	ecxupmkhcz.exe
3180	CreateProcess.exe
5980	CreateProcess.exe
3512	i_ecxupmkhcz.exe
4648	smkecxusmk.sys
1252	CreateProcess.exe
5180	rpjhfcxusm.exe
960	CreateProcess.exe
2372	CreateProcess.exe
5936	i_rpjhfcxusm.exe
5868	zxrpjhbztr.sys
2328	CreateProcess.exe
5756	uomkebzurm.exe
6064	CreateProcess.exe
1968	CreateProcess.exe
5516	i_uomkebzurm.exe
5532	wugebztrlj.sys
252	CreateProcess.exe
1628	jgeywromjd.exe
5112	CreateProcess.exe
4628	CreateProcess.exe
5816	i_jgeywromjd.exe
836	tomjebwtom.sys
1744	CreateProcess.exe
5508	roiytqljdb.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_971581890\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1272951377\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1272951377\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1933612230\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_971581890\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1708314904\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1708314904\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1708314904\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1708314904\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomjezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsqnifdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhfcxusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	roiytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdavtnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igayvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomkebzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfaxsqkifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxvsqkics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxspkecau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xuomhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomgebwtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_roiytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaytqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaytqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfaxsqkifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbzurljebzwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tomgebwtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcavpkicax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxspkecau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcavpkicax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomjezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdaywqliga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecxupmkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwqomjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwqomjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsqnifdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhfcxusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgeywromjd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdavtnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdaywqliga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igayvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecxupmkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxvsqkics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xuomhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomkebzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeywromjd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojhbztrl.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
256	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1272	ipconfig.exe
4388	ipconfig.exe
1616	ipconfig.exe
5304	ipconfig.exe
4708	ipconfig.exe
3804	ipconfig.exe
1520	ipconfig.exe
6084	ipconfig.exe
5860	ipconfig.exe
2512	ipconfig.exe
5640	ipconfig.exe
2540	ipconfig.exe
2648	ipconfig.exe
4324	ipconfig.exe
3436	ipconfig.exe
1968	ipconfig.exe
5636	ipconfig.exe
3360	ipconfig.exe
4300	ipconfig.exe
3748	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290802704211832"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{9DF7BC01-AC1C-431F-B148-5CA4FC474F6F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4928	wrojhbzurljebzwr.exe
4928	wrojhbzurljebzwr.exe
4928	wrojhbzurljebzwr.exe
4928	wrojhbzurljebzwr.exe
4928	wrojhbzurljebzwr.exe
4928	wrojhbzurljebzwr.exe
4928	wrojhbzurljebzwr.exe
4928	wrojhbzurljebzwr.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4148	i_wuomjezwro.exe
Token: SeDebugPrivilege	5032	i_tomgebwtol.exe
Token: SeDebugPrivilege	4736	i_jdaywqliga.exe
Token: SeDebugPrivilege	4748	i_igayvqoiga.exe
Token: SeDebugPrivilege	4872	i_avsqnifdxv.exe
Token: SeDebugPrivilege	1936	i_fcavpkicax.exe
Token: SeDebugPrivilege	3512	i_ecxupmkhcz.exe
Token: SeDebugPrivilege	5936	i_rpjhfcxusm.exe
Token: SeDebugPrivilege	5516	i_uomkebzurm.exe
Token: SeDebugPrivilege	5816	i_jgeywromjd.exe
Token: SeDebugPrivilege	2492	i_roiytqljdb.exe
Token: SeDebugPrivilege	4524	i_oigaytqlid.exe
Token: SeDebugPrivilege	1044	i_fdavtnlfdy.exe
Token: SeDebugPrivilege	5272	i_hfaxsqkifa.exe
Token: SeDebugPrivilege	3376	i_fzxvsqkics.exe
Token: SeDebugPrivilege	2516	i_fzxspkecau.exe
Token: SeDebugPrivilege	2812	i_xuomhezxrp.exe
Token: SeDebugPrivilege	4944	i_wrojhbztrl.exe
Token: SeDebugPrivilege	1992	i_zwqomjhbzt.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 4928	3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 3868 wrote to memory of 840	3868	2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 840 wrote to memory of 4552	840	iexplore.exe	91
PID 4552 wrote to memory of 6068	4552	msedge.exe	92
PID 4552 wrote to memory of 256	4552	msedge.exe	94
PID 4552 wrote to memory of 3764	4552	msedge.exe	95
PID 4552 wrote to memory of 3764	4552	msedge.exe	95
PID 4552 wrote to memory of 3764	4552	msedge.exe	95
PID 4552 wrote to memory of 1760	4552	msedge.exe	96
PID 4552 wrote to memory of 1760	4552	msedge.exe	96
PID 4552 wrote to memory of 2740	4552	msedge.exe	97
PID 4552 wrote to memory of 4524	4552	msedge.exe	98
PID 4552 wrote to memory of 2740	4552	msedge.exe	97
PID 4552 wrote to memory of 2740	4552	msedge.exe	97
PID 4552 wrote to memory of 4524	4552	msedge.exe	98
PID 4552 wrote to memory of 4524	4552	msedge.exe	98
PID 4552 wrote to memory of 3004	4552	msedge.exe	100
PID 4552 wrote to memory of 1304	4552	msedge.exe	99
PID 4552 wrote to memory of 3004	4552	msedge.exe	100
PID 4552 wrote to memory of 3004	4552	msedge.exe	100
PID 4552 wrote to memory of 1304	4552	msedge.exe	99
PID 4552 wrote to memory of 1304	4552	msedge.exe	99
PID 4552 wrote to memory of 4748	4552	msedge.exe	102
PID 4552 wrote to memory of 4748	4552	msedge.exe	102
PID 4552 wrote to memory of 1300	4552	msedge.exe	105
PID 4552 wrote to memory of 2212	4552	msedge.exe	106
PID 4552 wrote to memory of 1300	4552	msedge.exe	105
PID 4552 wrote to memory of 2212	4552	msedge.exe	106
PID 4552 wrote to memory of 1432	4552	msedge.exe	108
PID 4928 wrote to memory of 5840	4928	wrojhbzurljebzwr.exe	110
PID 468 wrote to memory of 964	468	wuomjezwro.exe	114
PID 4552 wrote to memory of 716	4552	msedge.exe	117
PID 4552 wrote to memory of 716	4552	msedge.exe	117
PID 4552 wrote to memory of 1088	4552	msedge.exe	118
PID 4552 wrote to memory of 1088	4552	msedge.exe	118
PID 4928 wrote to memory of 4464	4928	wrojhbzurljebzwr.exe	119
PID 4928 wrote to memory of 4964	4928	wrojhbzurljebzwr.exe	123
PID 3184 wrote to memory of 4508	3184	tomgebwtol.exe	125
PID 4928 wrote to memory of 5216	4928	wrojhbzurljebzwr.exe	128
PID 4928 wrote to memory of 1124	4928	wrojhbzurljebzwr.exe	132
PID 728 wrote to memory of 2796	728	jdaywqliga.exe	134
PID 4928 wrote to memory of 6012	4928	wrojhbzurljebzwr.exe	137
PID 4928 wrote to memory of 2004	4928	wrojhbzurljebzwr.exe	142
PID 4124 wrote to memory of 6120	4124	igayvqoiga.exe	144
PID 4928 wrote to memory of 1740	4928	wrojhbzurljebzwr.exe	147
PID 4552 wrote to memory of 4600	4552	msedge.exe	149
PID 4552 wrote to memory of 1044	4552	msedge.exe	150
PID 4552 wrote to memory of 5788	4552	msedge.exe	151
PID 4928 wrote to memory of 4968	4928	wrojhbzurljebzwr.exe	154
PID 3524 wrote to memory of 4156	3524	avsqnifdxv.exe	156
PID 4928 wrote to memory of 5848	4928	wrojhbzurljebzwr.exe	159
PID 4928 wrote to memory of 1932	4928	wrojhbzurljebzwr.exe	163
PID 5948 wrote to memory of 1672	5948	fcavpkicax.exe	165
PID 4928 wrote to memory of 3420	4928	wrojhbzurljebzwr.exe	168
PID 4928 wrote to memory of 3544	4928	wrojhbzurljebzwr.exe	172
PID 2904 wrote to memory of 3180	2904	ecxupmkhcz.exe	174
PID 4928 wrote to memory of 5980	4928	wrojhbzurljebzwr.exe	177
PID 4928 wrote to memory of 1252	4928	wrojhbzurljebzwr.exe	181
PID 5180 wrote to memory of 960	5180	rpjhfcxusm.exe	183
PID 4928 wrote to memory of 2372	4928	wrojhbzurljebzwr.exe	186
PID 4552 wrote to memory of 5256	4552	msedge.exe	188
PID 4552 wrote to memory of 5256	4552	msedge.exe	188
PID 4928 wrote to memory of 2328	4928	wrojhbzurljebzwr.exe	194
PID 5756 wrote to memory of 6064	5756	uomkebzurm.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_7bd41bad8b9c67d0ff9c3c7455ad02ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Temp\wrojhbzurljebzwr.exe
  C:\Temp\wrojhbzurljebzwr.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomjezwro.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5840
  - - C:\Temp\wuomjezwro.exe
      C:\Temp\wuomjezwro.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:468
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:964
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomjezwro.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4464
  - - C:\Temp\i_wuomjezwro.exe
      C:\Temp\i_wuomjezwro.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tomgebwtol.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4964
  - - C:\Temp\tomgebwtol.exe
      C:\Temp\tomgebwtol.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3184
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4508
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tomgebwtol.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5216
  - - C:\Temp\i_tomgebwtol.exe
      C:\Temp\i_tomgebwtol.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdaywqliga.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1124
  - - C:\Temp\jdaywqliga.exe
      C:\Temp\jdaywqliga.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:728
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2796
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdaywqliga.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6012
  - - C:\Temp\i_jdaywqliga.exe
      C:\Temp\i_jdaywqliga.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igayvqoiga.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2004
  - - C:\Temp\igayvqoiga.exe
      C:\Temp\igayvqoiga.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4124
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6120
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igayvqoiga.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1740
  - - C:\Temp\i_igayvqoiga.exe
      C:\Temp\i_igayvqoiga.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\avsqnifdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4968
  - - C:\Temp\avsqnifdxv.exe
      C:\Temp\avsqnifdxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3524
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4156
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_avsqnifdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5848
  - - C:\Temp\i_avsqnifdxv.exe
      C:\Temp\i_avsqnifdxv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcavpkicax.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1932
  - - C:\Temp\fcavpkicax.exe
      C:\Temp\fcavpkicax.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5948
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1672
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcavpkicax.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3420
  - - C:\Temp\i_fcavpkicax.exe
      C:\Temp\i_fcavpkicax.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecxupmkhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3544
  - - C:\Temp\ecxupmkhcz.exe
      C:\Temp\ecxupmkhcz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2904
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3180
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecxupmkhcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5980
  - - C:\Temp\i_ecxupmkhcz.exe
      C:\Temp\i_ecxupmkhcz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhfcxusm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1252
  - - C:\Temp\rpjhfcxusm.exe
      C:\Temp\rpjhfcxusm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5180
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:960
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5636
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhfcxusm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2372
  - - C:\Temp\i_rpjhfcxusm.exe
      C:\Temp\i_rpjhfcxusm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomkebzurm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2328
  - - C:\Temp\uomkebzurm.exe
      C:\Temp\uomkebzurm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5756
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6064
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomkebzurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1968
  - - C:\Temp\i_uomkebzurm.exe
      C:\Temp\i_uomkebzurm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgeywromjd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:252
  - - C:\Temp\jgeywromjd.exe
      C:\Temp\jgeywromjd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1628
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5112
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgeywromjd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4628
  - - C:\Temp\i_jgeywromjd.exe
      C:\Temp\i_jgeywromjd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\roiytqljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1744
  - - C:\Temp\roiytqljdb.exe
      C:\Temp\roiytqljdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5508
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4452
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_roiytqljdb.exe ups_ins
    3⤵
    PID:4896
  - - C:\Temp\i_roiytqljdb.exe
      C:\Temp\i_roiytqljdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigaytqlid.exe ups_run
    3⤵
    PID:4708
  - - C:\Temp\oigaytqlid.exe
      C:\Temp\oigaytqlid.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4696
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1720
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigaytqlid.exe ups_ins
    3⤵
    PID:2600
  - - C:\Temp\i_oigaytqlid.exe
      C:\Temp\i_oigaytqlid.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdavtnlfdy.exe ups_run
    3⤵
    PID:4680
  - - C:\Temp\fdavtnlfdy.exe
      C:\Temp\fdavtnlfdy.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2672
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1920
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdavtnlfdy.exe ups_ins
    3⤵
    PID:2888
  - - C:\Temp\i_fdavtnlfdy.exe
      C:\Temp\i_fdavtnlfdy.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfaxsqkifa.exe ups_run
    3⤵
    PID:4296
  - - C:\Temp\hfaxsqkifa.exe
      C:\Temp\hfaxsqkifa.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1784
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4332
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfaxsqkifa.exe ups_ins
    3⤵
    PID:2660
  - - C:\Temp\i_hfaxsqkifa.exe
      C:\Temp\i_hfaxsqkifa.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxvsqkics.exe ups_run
    3⤵
    PID:5516
  - - C:\Temp\fzxvsqkics.exe
      C:\Temp\fzxvsqkics.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3748
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxvsqkics.exe ups_ins
    3⤵
    PID:5796
  - - C:\Temp\i_fzxvsqkics.exe
      C:\Temp\i_fzxvsqkics.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxspkecau.exe ups_run
    3⤵
    PID:2736
  - - C:\Temp\fzxspkecau.exe
      C:\Temp\fzxspkecau.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1752
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3244
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxspkecau.exe ups_ins
    3⤵
    PID:2964
  - - C:\Temp\i_fzxspkecau.exe
      C:\Temp\i_fzxspkecau.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xuomhezxrp.exe ups_run
    3⤵
    PID:1716
  - - C:\Temp\xuomhezxrp.exe
      C:\Temp\xuomhezxrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5636
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xuomhezxrp.exe ups_ins
    3⤵
    PID:3340
  - - C:\Temp\i_xuomhezxrp.exe
      C:\Temp\i_xuomhezxrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrojhbztrl.exe ups_run
    3⤵
    PID:704
  - - C:\Temp\wrojhbztrl.exe
      C:\Temp\wrojhbztrl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4284
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3060
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrojhbztrl.exe ups_ins
    3⤵
    PID:5812
  - - C:\Temp\i_wrojhbztrl.exe
      C:\Temp\i_wrojhbztrl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwqomjhbzt.exe ups_run
    3⤵
    PID:5060
  - - C:\Temp\zwqomjhbzt.exe
      C:\Temp\zwqomjhbzt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:968
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5352
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwqomjhbzt.exe ups_ins
    3⤵
    PID:3160
  - - C:\Temp\i_zwqomjhbzt.exe
      C:\Temp\i_zwqomjhbzt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigaytqlj.exe ups_run
    3⤵
    PID:2900
  - - C:\Temp\qoigaytqlj.exe
      C:\Temp\qoigaytqlj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1484
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4388
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x388,0x7ffd8cc1c188,0x7ffd8cc1c194,0x7ffd8cc1c1a0
      4⤵
      PID:6068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,1991165173096093687,669407027794523878,524288 --field-trial-handle=2772,i,17957982888004204855,14335529150217997750,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:11
      4⤵
      System Time Discovery
      PID:256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,2681619705615808706,5406726475822201365,262144 --field-trial-handle=2772,i,17957982888004204855,14335529150217997750,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:2
      4⤵
      PID:3764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,10504837813165059787,6860197800794242693,524288 --field-trial-handle=2772,i,17957982888004204855,14335529150217997750,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:13
      4⤵
      PID:1760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,15388998310025466528,15460802334836834105,2097152 --field-trial-handle=2772,i,17957982888004204855,14335529150217997750,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:2740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,5857454424053554655,1498434910110122746,2097152 --field-trial-handle=2772,i,17957982888004204855,14335529150217997750,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:4524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,12933647782957229204,13504025054583112017,2097152 --field-trial-handle=2772,i,17957982888004204855,14335529150217997750,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
      4⤵
      PID:1304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,9739259065733913308,9174901948210266420,2097152 --field-trial-handle=2772,i,17957982888004204855,14335529150217997750,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:9
      4⤵
      PID:3004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,8321331068974338330,10939029382300043108,524288 --field-trial-handle=2772,i,17957982888004204855,14335529150217997750,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
      4⤵
      PID:4748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,9601720346444560548,13852779582892580346,524288 --field-trial-handle=2772,i,17957982888004204855,14335529150217997750,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
      4⤵
      PID:1300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,1247623603158046221,14821290280382043182,524288 --field-trial-handle=2772,i,17957982888004204855,14335529150217997750,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
      4⤵
      PID:2212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,3377423910635157985,2486273737788607347,524288 --field-trial-handle=2772,i,17957982888004204855,14335529150217997750,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,3377423910635157985,2486273737788607347,524288 --field-trial-handle=2772,i,17957982888004204855,14335529150217997750,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:1432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,103838237052413752,13317283924538948232,524288 --field-trial-handle=2772,i,17957982888004204855,14335529150217997750,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
      4⤵
      PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,15583992151200637127,14391771377648016079,524288 --field-trial-handle=2772,i,17957982888004204855,14335529150217997750,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
      4⤵
      PID:1088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,7112994134866870912,11212369319051562866,524288 --field-trial-handle=2772,i,17957982888004204855,14335529150217997750,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,10732338692848879037,8366584352242999039,524288 --field-trial-handle=2772,i,17957982888004204855,14335529150217997750,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
      4⤵
      PID:1044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,7450104484598424407,5094202086148958198,524288 --field-trial-handle=2772,i,17957982888004204855,14335529150217997750,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
      4⤵
      PID:5788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2024,i,6433570411040007160,2003698162203472508,524288 --field-trial-handle=2772,i,17957982888004204855,14335529150217997750,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
      4⤵
      PID:5256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3140,i,15790428589514740531,2341709553996325223,524288 --field-trial-handle=2772,i,17957982888004204855,14335529150217997750,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
      4⤵
      PID:2196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,18027447942036018713,5813982118401439216,524288 --field-trial-handle=2772,i,17957982888004204855,14335529150217997750,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:14
      4⤵
      PID:2060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,10532412180395498423,12441584788222284316,524288 --field-trial-handle=2772,i,17957982888004204855,14335529150217997750,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:14
      4⤵
      PID:2692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3464,i,12606408509791433531,15373442265311699531,262144 --field-trial-handle=2772,i,17957982888004204855,14335529150217997750,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:10
      4⤵
      PID:1692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,8335909878881096747,5673836023393209903,524288 --field-trial-handle=2772,i,17957982888004204855,14335529150217997750,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
      4⤵
      PID:3312

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:268

C:\Temp\wrojhbzurljebzwr.sys
C:\Temp\wrojhbzurljebzwr.sys
1⤵
- Executes dropped EXE
PID:4648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4944

C:\Temp\qojgeywuol.sys
C:\Temp\qojgeywuol.sys
1⤵
- Executes dropped EXE
PID:3352

C:\Temp\ljgeywtolg.sys
C:\Temp\ljgeywtolg.sys
1⤵
- Executes dropped EXE
PID:4944

C:\Temp\ligaytqoid.sys
C:\Temp\ligaytqoid.sys
1⤵
- Executes dropped EXE
PID:6128

C:\Temp\avsqnigayv.sys
C:\Temp\avsqnigayv.sys
1⤵
- Executes dropped EXE
PID:5556

C:\Temp\faxvpnkfdx.sys
C:\Temp\faxvpnkfdx.sys
1⤵
- Executes dropped EXE
PID:1216

C:\Temp\qkhcausmkf.sys
C:\Temp\qkhcausmkf.sys
1⤵
- Executes dropped EXE
PID:4592

C:\Temp\smkecxusmk.sys
C:\Temp\smkecxusmk.sys
1⤵
- Executes dropped EXE
PID:4648

C:\Temp\zxrpjhbztr.sys
C:\Temp\zxrpjhbztr.sys
1⤵
- Executes dropped EXE
PID:5868

C:\Temp\wugebztrlj.sys
C:\Temp\wugebztrlj.sys
1⤵
- Executes dropped EXE
PID:5532

C:\Temp\tomjebwtom.sys
C:\Temp\tomjebwtom.sys
1⤵
- Executes dropped EXE
PID:836

C:\Temp\tnljdbvtol.sys
C:\Temp\tnljdbvtol.sys
1⤵
PID:4688

C:\Temp\igdyvtqlig.sys
C:\Temp\igdyvtqlig.sys
1⤵
PID:1632

C:\Temp\pnifayvqnd.sys
C:\Temp\pnifayvqnd.sys
1⤵
PID:5700

C:\Temp\faxspnkica.sys
C:\Temp\faxspnkica.sys
1⤵
PID:5924

C:\Temp\ecxusmkfcx.sys
C:\Temp\ecxusmkfcx.sys
1⤵
PID:3472

C:\Temp\wupmheczur.sys
C:\Temp\wupmheczur.sys
1⤵
PID:5544

C:\Temp\hezxrpjhcz.sys
C:\Temp\hezxrpjhcz.sys
1⤵
PID:2212

C:\Temp\ywrojgebwt.sys
C:\Temp\ywrojgebwt.sys
1⤵
PID:1844

C:\Temp\trljgbywqo.sys
C:\Temp\trljgbywqo.sys
1⤵
PID:5904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avsqnifdxv.exe

Path C:\Temp\avsqnifdxv.exe
Size 365KB
SHA256 74994e2e468b3dd7f4cf5362a3ddc6b7b28d70c7eb7042d56bbe3a603d090e48
MD5 7858219b0396d8962f32d2d8165fb4fb
SHA1 e82061ffbf80bac3af630c7952bdc93f08973b5f
SHA512 8dbee19b29a3d1c50223dfea5d78396edf98789d5e4d7d5d6287af2ba3131873507233f19df22341ce3f1380a0d10e8a30d8471e082e6a203b12b228fe3e9c01
SSDEEP 3072:3uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:3uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B7847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avsqnigayv.sys

Path C:\Temp\avsqnigayv.sys
Size 293KB
SHA256 53c56775227278173d2630338b8e0b037e16f7364e3d81bc8610ab92d57eaa8d
MD5 3205daa5769fa605820ce6a4c54953cc
SHA1 781b61f622e3dfd16218d5a36c4db885c54ed5c6
SHA512 ad65a8a2fe043bacde64e50f0446411717dd6029fce12fa666992f03dddb5e504d6e05ffaa6dee33e371b21eaab2745c22970d6f3861d13d12a4e6b56e80daa0
SSDEEP 3072:otKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:oIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxvpnkfdx.sys

Path C:\Temp\faxvpnkfdx.sys
Size 293KB
SHA256 09698e83099c4fdc1ac19420dc8ac8d0160b255cbe5ae36bf11317bee8b2dcf4
MD5 3f7dd4d4ea87de1bd43a24d502ced8e3
SHA1 bf56c158801424716b9eecb46be0dd1218e2d429
SHA512 39fe90de29b664292c5e68c11b9e46270d9bd1a13e36fae68120e13357f5bf2e216c5e2e9149858946ab166b473347bba3af83fca4a2942dd01583b519bf105e
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T195545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcavpkicax.exe

Path C:\Temp\fcavpkicax.exe
Size 365KB
SHA256 c331f31744b51460037582455b5437cdf6be15f7294978bf4d949f4629bf2532
MD5 2157df5fb95cc7dd70b6e5db7a5904a5
SHA1 d94649226540b1862e5807cf2b315c05303352f1
SHA512 5d67ef54af99732250a7383afd00ce477c1d3cfb205c0f4e9206afceeee5ba94aeab08f040d5eb545d99de8ef2346a872b74e9a8856c622cb7590fa2b8f090fa
SSDEEP 3072:0uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:0uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17B847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_avsqnifdxv.exe

Path C:\Temp\i_avsqnifdxv.exe
Size 365KB
SHA256 e166a8899e604b2b6077f2064ae567c0226a0b17ea174e7a1470a81689c8dedb
MD5 645102509c77381b90b8484a0e0f35dd
SHA1 594da37f9f98bbe3898fef3fbce285f8719671ba
SHA512 a23cb03466a612927a2dea6d41a7ed68e17aad3547a477a53d5b4f4688d34324cc7b3309594e8937ef8f495b6b32a38fce1132d8c7ad053f2939098271986bc8
SSDEEP 3072:tuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:tuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13C847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igayvqoiga.exe

Path C:\Temp\i_igayvqoiga.exe
Size 365KB
SHA256 95e169d370d0f8da659a4f22766aab64f550392dbaee1c28f49b126c51ecf3f7
MD5 db49e5cea333cda48f80654f0a2f9b73
SHA1 1aac2ea9d94fa42c6c9ed86ec5730ab13990eed3
SHA512 97547b292c9750c678cc51d81bfdd4e6eaf743c6625102ee213d04d68a95daa1c62261fc542bd34a21b08daed00d6d19d3fad703493f2dc7b0a72dff9d27d141
SSDEEP 3072:7uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:7uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AB847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jdaywqliga.exe

Path C:\Temp\i_jdaywqliga.exe
Size 365KB
SHA256 bd9d5aaca257bb46e1a70963b19f360cc2059cb2a60cd367767c55627ec3a4bd
MD5 5fc10f433c2f8618e482433ee8c8c4f0
SHA1 2aae6d0a0a3a336d124300911f3245b279b4fc5e
SHA512 1e2c3839b2ec21d9ae8471ee2887d38940887bf0519241f569744a1ec60c3eba8d5810b0b867f32670a59a89f881c04e9e9244ed9f85273ca759293c358fef66
SSDEEP 3072:YuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:YuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A6847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tomgebwtol.exe

Path C:\Temp\i_tomgebwtol.exe
Size 365KB
SHA256 5114e4d61e4c08f9568d0f3a3bf0c18f48414152c336a303309548d52e5f4b90
MD5 268d0c630ead4849ec6b97b3a797c21a
SHA1 5342ae35849db6bb76f448da70ca5640df79f792
SHA512 a2909ddbc79e065bdb9304e145bfc8cfefa3b7b8c67b5b287735f53767a0edfb717847c68168a73a0012562138df19db45eb45ca5c85b6d058b1e43f0d41fff1
SSDEEP 3072:duxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:duxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FF847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wuomjezwro.exe

Path C:\Temp\i_wuomjezwro.exe
Size 365KB
SHA256 330f165812280694a4f7da8e886603c257fb8778eda15c57bfcec94a1a66b570
MD5 b909ce8c5e47571334b795f38dbbe0a8
SHA1 c6272b5d126d46f72501e77388b58f6415f1e7e3
SHA512 7af753d6d22360f40b2ee221a06d3047c84f919b3d117e03af871c9c08f98dda99c9dedf8ee5220e19c07e5b8775b83b3d7e78b5e0720e9bf73735bc1aaf82fc
SSDEEP 3072:4uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:4uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T183847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igayvqoiga.exe

Path C:\Temp\igayvqoiga.exe
Size 365KB
SHA256 77e9821858696dc94fdf6ceb02e27f700b670f1b2e2fcffe2f6fe4ef9bbe7127
MD5 8ee22bc810d5790535fcab17c366f047
SHA1 b95de039159d65e5df74e2fd19c5ea5741360eb9
SHA512 696b6b1b0e569a0eb84d5d3b066e98aebc601ed833de66f40881d2d02d0402d78f2ee01e4e740f822c53e768594df66708a2c2f66f43e7e01c61a4f2ceb06b5a
SSDEEP 3072:AuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:AuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T197847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdaywqliga.exe

Path C:\Temp\jdaywqliga.exe
Size 365KB
SHA256 3d39074dfc98df6b12f6b40ab382054cb72c7c40aa43791ec5264abfed95e000
MD5 5701f467cd463c1adfa8df8db5b5c033
SHA1 af04f3603b02a605d6e11b8993abd6820d4fd167
SHA512 f516d6f0016ed6c240a4745e0f68f9e525d6740c339e09d65b5d8e55a4c44f2efc7cfe9d995bd1bcb8bcd3abae342d08fe444f0b97721a799eb326d5ced30bae
SSDEEP 3072:huxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:huxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FA847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ligaytqoid.sys

Path C:\Temp\ligaytqoid.sys
Size 293KB
SHA256 79b1d1b2d44bee3e4dcc4ee0827a7bea89e3fa2029a3eb357505d130f6a3ded6
MD5 1121ee7ea28e0f5154d807f385f80011
SHA1 c2f3a89430d2a03ab33328fdb02e9b078c061299
SHA512 a79a0fd854beba2228bc91dae80a218d35cbb78825860ff5b2d005c423c59811bf4ffe58df67b933daff37d59b93818f9e18c6a2756ef6cc3c90d954bfb08c59
SSDEEP 3072:1tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:1IJjiJcbI03GBc3ucY5DCSj
TLSH
T143545B44AAA4B0F6D9D5043C00EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljgeywtolg.sys

Path C:\Temp\ljgeywtolg.sys
Size 293KB
SHA256 e27c439ee347f29495a07479d7b326a3aedac1705279c05523f527c678a1924f
MD5 a979c9954d0f52df390059ba75adcfbc
SHA1 1286e33140e4b484a235c6d5c288f94b8beef8ee
SHA512 e6c007ce4aa4b56710c9c38fc1a3c14282b7e2c62a112063dc07e1719ac9fb4a8b09768fb48e3c9c3893aedbe4d4c76e6ed9e417b3957d7be55320c5d60def1b
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T18F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qojgeywuol.sys

Path C:\Temp\qojgeywuol.sys
Size 293KB
SHA256 849fa6daeb1218fee58019e584e2cf7ba855ad2e2d8eaf438761cfb8e8f1ad88
MD5 11b76b53dd0649e281e38e66cc2cabd2
SHA1 91da5a7336c0bd8403111e8d260d02262830dd32
SHA512 c9dc1ff83204658a2792b0eaeb29389c158c20f101c7dcf331a8e753962a02ebbab24b583e11f6e4a80915f6e2099a44b5460f6784d030083ab6d490ebd47689
SSDEEP 3072:ttKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:tIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomgebwtol.exe

Path C:\Temp\tomgebwtol.exe
Size 365KB
SHA256 b5baf3652ab685df5f36487dcc6406171dfa1b3a6356ac3d7ca941968e75df48
MD5 cdc861e4c46f5b6175d8d2f1f61f96ae
SHA1 7d9b4153cb0fc7103d1a0f61f2293e5cd8dce913
SHA512 7d30fdab4bf4c6d0875eb247892c32f9206b3571cdb54bca8986d2527ba2e2ca490c1f01c5b0eecde64aa27205fbf3b63389bec9f8bfbfc02332b526cf41cece
SSDEEP 3072:auxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:auxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D4847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrojhbzurljebzwr.exe

Path C:\Temp\wrojhbzurljebzwr.exe
Size 365KB
SHA256 858e40849d08f722bdeaccf5531cb4557b851752b5accbaf17a741b6f32fd7ae
MD5 2e289fcbe5f048197e16156b74aa6643
SHA1 c428c9edefb1757a8c2795c9f7da88a4f5b63fd6
SHA512 d1187d1fa1249511adca1dc81a4368c3e4dc52715494a601a91fef8907adbc9360306c2979e92dc946fbfe655c83557337bb00d206cac2fabc795644b2f1a93c
SSDEEP 3072:OuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:OuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E1847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrojhbzurljebzwr.sys

Path C:\Temp\wrojhbzurljebzwr.sys
Size 293KB
SHA256 ff0eeeffc9f2f43a88116abb1e75c48b4653b95ef9c90d973d8f3011b8d1ee65
MD5 2e5dfd26b46e5e44f67c7e775eca9468
SHA1 d614d4162a78136fb4a7e58b8d8b7f5efed7f6fa
SHA512 ad2d6b72b1f5b49be413b3f371c4ef40f85c6f94e857fd6c76d5aaae0d9f63c10dac7bb68ffc885c86e8688f6c90d4e244cee2e682368f67f3a23859f6b79ed2
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9Edg:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomjezwro.exe

Path C:\Temp\wuomjezwro.exe
Size 365KB
SHA256 293984f5bc9e0eeee71348b548de3bc017e50c409fcdae6c825e8fbfe2cb38a1
MD5 eeff7ee716ce1d48a717fe191d604e8a
SHA1 74eac4a840bc181c1239c42d539e4401b88c7c29
SHA512 85ef1864f303098531511c374cc9aa6101eff8fa8cada008e3824646dd1c34599beff7dea433aba28933a426ff5dee8d75a32c1b7cf615ef806f28418e32579f
SSDEEP 3072:FuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:FuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14A847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 42b533fa923b3832d2361d3653626989289280944b6dc5e3aa75967ce4d870e4
MD5 1d3fe078a46e672e8c77542c7a699dbe
SHA1 21bd6a1a3dfe74f12dbc26b258a67729acf5578f
SHA512 2c274a1c77c3d488a20d00b46be6cef6d3bf742e63bacff4de005b7179358b9c43ef05f3a9f5144c5825689573faa1bed5bf4f2ccb65adba69a12026452daffb
TLSH
T1B151A3537BAF8AE2E73D49F192F240CABE7D94160E8F2A2D11442173DBC735BA200230
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598e3c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598e3c.TMP
Size 2KB
SHA256 2a37785eb2aae46202c932a4dea0e00f7b1f24b8e971d31c7dafb7d9e17c7d6a
MD5 45d95a708c1b5cc79422804df402ffa0
SHA1 e03b0557a9bf3fbacc91340d75bb274e107ad997
SHA512 d2fd77b9da16bf15f5bc3768b917f599925fab73946f1342dfa1ca5e266d4bc0f5abd728a7f532f5dcaa92ebad1a13f033b5d62af573718f5f23c19bdd59b9e7
TLSH
T19B5192536BAF8AE2E73D49F192F240CABE7D94160E8F2A1D11482173DBC735BA100230
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 66ca1e2666dfc9ab33d7bd145450e28f3601924339e5c31861103d1c6e0143d2
MD5 a7a05dafe303cc6117a193804dbac83e
SHA1 37f7517dc7e4791890efb4c63b3984c4c71d60be
SHA512 25419ff28476adfa030defb6314951e8b4bb77651e3c591c7d931f92c7437cd2dc4b020fa8b62b3c742bbbb259063a629efd5642eb66ebd11ab4413d9d9477ca
TLSH
T1C751ADF3C7E8866EC90196F0AA187E1BCE1D0955832C3D5AC8E4AF5BA3E2471E14255F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b6dcf1ea65a66f595f8de137469fee72c7cb6b4e149ccfa6d1b9c69e500853c7
MD5 34207d625d589d3bb4b32520e083a86f
SHA1 acfea7985c2170894611c289417b329ca25c5fe9
SHA512 bd4ee7a7e017ff5992b66f59f27a61cb358f2f4d5728b6133399c532c3ec17aa06b8166d68c05ccccb7004e88fb30accbc06f8d2b0dce4e7f4299891d2ac2ae3
SSDEEP 192:sxRbkR0C5/fFsDvVkFuWZIzoA8p9X/g6+WNCFr/YD9z6S/GnCIgV1J:sxRbk55/fFspkFugRR/5A/nSzJ
TLSH
T1EF42C9166A289D3B8CC7D21DFB65BF53D2F95132A1D51E58A6FC8A0C04E6ADD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0b96f442d3219a61ce1d6e4211f3e3aebbdfb81fa19efb863b18e131bcb996b7
MD5 a19b7d122ac17a0c6387185529c3585c
SHA1 759695c677150084a3451abe7af733b5d1a630ec
SHA512 7bf42b999f811436a4f70ecab2c04c21d0005340b141fbdbbd029ae04161b9267573f4739d64a66bd2484012469a36042938706eaa42284afbc59793fdcc6a20
SSDEEP 192:sxRYkR0C5/fFsavVkFuWZIzoA8p9X/g6+WNCFr/YD9z6S/GnCIgD9V1J:sxRYk55/fFsukFugRR/5A/nSzT
TLSH
T17642C81A6A289D3B8CC7D219FB55BF53D2F95132A1D11E58A6FC8A0C04EABDD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e2d93fe90b885ed5d1f506993405af8b2bce62d1dd898a815399a365b16e894a
MD5 ed85e8840f0b4132727021aeaec02253
SHA1 46ca44075edc6fffa3a2267f6710084389b4f1cf
SHA512 630f2f34a40be8732eccd8e855742b0456ab7307953cf2779b2578c8c4abe913809bc9a05d5888ed48f6de0eed64b208433e816fc27191fe3075041627bbc54f
SSDEEP 192:sxRYkR0C5/fFsavVkF7WZIzoA8p9X/g6+WNCFr/YD9A6S/GnCIgD9v1J:sxRYk55/fFsukF7gRR/5A/OSzd
TLSH
T16142B71A6A289D3B9CC7E219BB55BF53D2F95132A1D11E58A6FC8B0C10E6ADD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 26c68e0a7d33818c62aaecf3aae42746639822e95a5066dcb05d67eeea7e1e1b
MD5 9dd809c00cd427846cb65dccadffea99
SHA1 4181bb865011435105e08e0740999efe4a0ba606
SHA512 5e41f684b46b01474c7aaa80fbf665994f43595d9423b2afdc532347e13be2d5bdfe426bbfc27b5433f8cf9ca2e8a5598be72b43c7ba4d9f64203ffd5674767c
SSDEEP 768:azfWtL7pLuL7J0Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6VYc16eropL9iH:azfWtdE7J0Wg/XfHfu1ja5VYy61pLO
TLSH
T116D2DA7B240CCE7F4F800A9DAD197E9B6DA802CB9698CD5047FE951C02C6BEB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 18KB
SHA256 d675bad1a758b07f1ed431a7812bf9fd82a0134557a9f1479faf96798a2a9d7c
MD5 f18b79a3435844f3cd10f1b52c52502d
SHA1 686226dff62991217fcaf2118b30364ed5b08220
SHA512 203b436d074f1f469ce6afb478f21e5847cb9adeecc4318aacd5ca131357810be9a8992d7737bd36a754ccc8f35273e30b64a8a51eacd17024779ac32e0ed767
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uP:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbA4
TLSH
T15482751CC52C7E3247C92F7D6A2F9D727ACA30CA7081459D798CC69DC31B06DA58A2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 0bc30bb11fa814abe932c77d1380725965804bbb31f79bdf07f192cd0f78e12f
MD5 27c6bf6aac7978f40772e0a57f2ea7af
SHA1 f9b56834ad8241a35879853a7d6ababebeec2f39
SHA512 07262700515e5f327447a6ce9f3a2fed54181fc7fd36ba72d5f128c8e5bde9dae077259fdb2562b7b6667b3e46433c4780dc237ed1a7a4a055cb07411c42f548
SSDEEP 768:2F1j+9136wgHvsaZrEnjN3Gac1FOHMVcLCO7w/6G:D913bYQnjMaLHCt/6G
TLSH
T1EC1317F594D38977C89E9783A33E6E429ABDC163B5880994B7C95E0CCC875BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7c6089b2bcdb9f31f9a3df903dc361713dbc2a9d42161e539783fc3c51d4a217
MD5 984ebe0654d01476cd31f80708ad3454
SHA1 1838880e83eaa1d8eaa2ec443310f87028922979
SHA512 74e7d7304b4d66953350b4c1a396db31e164f7133f55b2a2d290fa975558d1475d5c1866f087f8828833d9958aba6b780c90e2771829557ce1e74dcf7f06ce81
SSDEEP 768:rrv+4UNbdS3Jmi0aNrEnjN3Gac1ZceVH1SCz:rbsbg3u0QnjMabEH1V
TLSH
T12C03CF3669A88E738CEBE38571877A037FF4125386840BE4C6DD6B0D029B5EC130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 06727a676f66af4558cb33a6d59e078a9060aa21e119d9e1d6589ed5bda57ab4
MD5 81db24b4948b5060a2ee82b08587b666
SHA1 9f84dfd67b9169d6b86e3c4f21c4afde8973149f
SHA512 92f63e0dfbc7373678beef0783a7610012e7522209c8d9245f7b0a9ddee541b3c4e9a7d1283f44dd2b91a8f1e2b5d781f597b8ae453a498a7e420506287b5e25
SSDEEP 768:Rrv+4UNbd13iAi0aGrEnjN3Gac1FOHY0Z:RbsbH37JQnjMaL/Z
TLSH
T1F203BF357968DD738CEBE285B0477A437FF4129384C50BA4DACA6B0D06879E8270F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ea5103f2e7411653c8eb24bb8a9de5ab128c35bc6e3754d09b89385c20a81ecc
MD5 6f4caa0d881954ba67f27c6181888b85
SHA1 ab53bdb125abfe896d6200bf57b369e27ad19f7a
SHA512 735e619e199d1365efa842359d00e4353fc50e69cedbb5de16d829f1c5db5929449bc62f2b5a4ed0bf89908640c2f9973d5427e0cce39d0c0fd01bcd6a28ed42
SSDEEP 768:Hj+9j3NAi0aErEnjN3Gac1FOHMVcLCO7w/6G:q9j3sxQnjMaLHCt/6G
TLSH
T1F4F2BF3479A59D738CDAE385B1437A83BFE156A384C50E64D6CE6B0D05C7BAC170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2e1ab2f8e3b6236a086e92e09f17109e1d5bb374c37082a606ec3392e4ef9a3b
MD5 45329ea7e4ba24189729c1f927fe33c7
SHA1 03ddd420c55d4e552a2c86f1529416a946905d22
SHA512 3ccbe82d9c6fe84c07aefc13d5c2fd86ecde71b2f2e0ec811e113a048b7e1436291e0ba524e1b7f96baf6ab44e50d7adc84366289acca084fe9544ff32b56899
SSDEEP 768:Wj+9j3KAi0aErEnjN3Gac1FOHMVcLCO7w/6G:F9j3zxQnjMaLHCt/6G
TLSH
T119F2BF3479A5DD738CDAE385B1437A83BFE156A384C50E64D6CE6B0D05C7AAC170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

689e882e-ba27-4376-bef0-f648ff5e8cf5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\689e882e-ba27-4376-bef0-f648ff5e8cf5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4552_957181927\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 47370039cb8e8e5d620e59b062442692cbe0234746ca0d4c69530c34498494fa
MD5 93270ab6b974fa2e04c4b54e7a3802b6
SHA1 90817518b9f4384c2b48b199a7454d95808ecc2c
SHA512 da04844d5a7cc54bf6bcc12ef1d44ca32b2a4cc7a0ec67382fc249c8c80eb2caf5079953b7330e374c307f8c20761cf289265a0d4a9dcb0dc4bec5304f18b057
TLSH
T14071238357B8C6B3C5DE5FF102835648F6FB22384B2330704BA15546AB30B3A24B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/836-364-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1216-287-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1216-312-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1632-405-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1632-427-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1844-471-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2212-467-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3352-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3472-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4592-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4648-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4648-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4688-377-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4944-234-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5532-366-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5532-335-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5544-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5556-274-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5700-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5868-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5904-488-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5924-430-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6128-262-0x0000000000010000-0x00000000000AB000-memory.dmp

Download