systex | f191202d5f9e2826b4203b831c86cd3f71e13e78aa9065d59c028d10a269aaa5

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 14:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 389KB
Sample260816-r4e63adj7x
SHA256 f191202d5f9e2826b4203b831c86cd3f71e13e78aa9065d59c028d10a269aaa5
MD5 3d39b3e5e20ba44aff92d63d0b2f0850
SHA1 6da3ad1e84d7384feaf48368c5152d04a23c5344
SHA512 aa55a6f4c96926180632ca7a5d452204f6ddf9b11f46b1d736d7390b9b3e668f25ee569738c455336be4f0947f8d3a34ec72291858caf1f11ce113464df29049
SSDEEP 3072:0uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:0uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19D847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2480	khczusmkecxupmhf.exe
5848	khczusmkecxupmhf.sys
3168	CreateProcess.exe
6056	hezwusmhcx.exe
5644	CreateProcess.exe
4408	CreateProcess.exe
1420	i_hezwusmhcx.exe
6080	rmjebwurmj.sys
5024	CreateProcess.exe
4648	rljhbzwuom.exe
680	CreateProcess.exe
4548	CreateProcess.exe
5520	i_rljhbzwuom.exe
1764	ljebztromg.sys
5824	CreateProcess.exe
1872	bwtrljgbwt.exe
2440	CreateProcess.exe
4884	CreateProcess.exe
3192	i_bwtrljgbwt.exe
2404	geywqomgey.sys
2608	CreateProcess.exe
3232	dbvtrljdbv.exe
1076	CreateProcess.exe
3976	CreateProcess.exe
5060	i_dbvtrljdbv.exe
2680	tqolgdyvtq.sys
5792	CreateProcess.exe
3224	yvtnlfdyvq.exe
4420	CreateProcess.exe
4952	CreateProcess.exe
6024	i_yvtnlfdyvq.exe
5392	qnlfdyvqni.sys
2616	CreateProcess.exe
1612	kidavsnlfd.exe
2760	CreateProcess.exe
1636	CreateProcess.exe
4304	i_kidavsnlfd.exe
1396	kfcavsnlfd.sys
4716	CreateProcess.exe
6100	xusqnifzxs.exe
3560	CreateProcess.exe
5720	CreateProcess.exe
5476	i_xusqnifzxs.exe
3196	icaxvpmkif.sys
716	CreateProcess.exe
4404	khfdxvpnhf.exe
1420	CreateProcess.exe
4204	CreateProcess.exe
4144	i_khfdxvpnhf.exe
2340	xupnhczxrp.sys
2856	CreateProcess.exe
4696	xrpkhczxrp.exe
3076	CreateProcess.exe
4136	CreateProcess.exe
5376	i_xrpkhczxrp.exe
3192	mjhbzxupmh.sys
3360	CreateProcess.exe
2224	kebzurpmge.exe
3312	CreateProcess.exe
6104	CreateProcess.exe
3236	i_kebzurpmge.exe
5080	rpjhbzwrpj.sys
4536	CreateProcess.exe
5380	mjebwromge.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4944_1778367240\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4944_1159808399\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4944_875314858\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4944_875314858\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4944_875314858\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4944_639226402\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4944_639226402\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4944_1159808399\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4944_875314858\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywrojhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtrljgbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusqnifzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusqnifzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbywuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqlidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkicaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczxrpmhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjebwromge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxvpkifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywrojhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtrljgbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczxrpmhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljhbzwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kidavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kebzurpmge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjebwromge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlgdyvtrli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkicaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxvpkifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljhbzwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpkhczxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfcxusmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfcxusmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezwusmhcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kebzurpmge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlgdyvtrli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurljebzwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezwusmhcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpkhczxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbywuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khczusmkecxupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kidavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqlidav.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1140	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1000	ipconfig.exe
5284	ipconfig.exe
1456	ipconfig.exe
3336	ipconfig.exe
2732	ipconfig.exe
4516	ipconfig.exe
4208	ipconfig.exe
1272	ipconfig.exe
3408	ipconfig.exe
1604	ipconfig.exe
4572	ipconfig.exe
5924	ipconfig.exe
5548	ipconfig.exe
5128	ipconfig.exe
5484	ipconfig.exe
4092	ipconfig.exe
4668	ipconfig.exe
808	ipconfig.exe
720	ipconfig.exe
1296	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313650858556283"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{FDDF6273-3666-4A56-89FE-3DEE6F0BEB10}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2480	khczusmkecxupmhf.exe
2480	khczusmkecxupmhf.exe
2480	khczusmkecxupmhf.exe
2480	khczusmkecxupmhf.exe
2480	khczusmkecxupmhf.exe
2480	khczusmkecxupmhf.exe
2480	khczusmkecxupmhf.exe
2480	khczusmkecxupmhf.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1420	i_hezwusmhcx.exe
Token: SeDebugPrivilege	5520	i_rljhbzwuom.exe
Token: SeDebugPrivilege	3192	i_bwtrljgbwt.exe
Token: SeDebugPrivilege	5060	i_dbvtrljdbv.exe
Token: SeDebugPrivilege	6024	i_yvtnlfdyvq.exe
Token: SeDebugPrivilege	4304	i_kidavsnlfd.exe
Token: SeDebugPrivilege	5476	i_xusqnifzxs.exe
Token: SeDebugPrivilege	4144	i_khfdxvpnhf.exe
Token: SeDebugPrivilege	5376	i_xrpkhczxrp.exe
Token: SeDebugPrivilege	3236	i_kebzurpmge.exe
Token: SeDebugPrivilege	564	i_mjebwromge.exe
Token: SeDebugPrivilege	5376	i_trljdbywuo.exe
Token: SeDebugPrivilege	5080	i_nlgdyvtrli.exe
Token: SeDebugPrivilege	5856	i_gaysqlidav.exe
Token: SeDebugPrivilege	1188	i_vsnkicaxsp.exe
Token: SeDebugPrivilege	4260	i_ifaxvpkifa.exe
Token: SeDebugPrivilege	3404	i_hfcxusmkfc.exe
Token: SeDebugPrivilege	3936	i_eczxrpmhec.exe
Token: SeDebugPrivilege	5624	i_eywrojhezw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4944	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 2480	4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 4348 wrote to memory of 2816	4348	2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 2816 wrote to memory of 4944	2816	iexplore.exe	91
PID 4944 wrote to memory of 1112	4944	msedge.exe	92
PID 4944 wrote to memory of 4532	4944	msedge.exe	94
PID 4944 wrote to memory of 1140	4944	msedge.exe	95
PID 4944 wrote to memory of 4532	4944	msedge.exe	94
PID 4944 wrote to memory of 4532	4944	msedge.exe	94
PID 4944 wrote to memory of 4128	4944	msedge.exe	96
PID 4944 wrote to memory of 4128	4944	msedge.exe	96
PID 4944 wrote to memory of 3656	4944	msedge.exe	97
PID 4944 wrote to memory of 3656	4944	msedge.exe	97
PID 4944 wrote to memory of 3656	4944	msedge.exe	97
PID 4944 wrote to memory of 1936	4944	msedge.exe	98
PID 4944 wrote to memory of 1936	4944	msedge.exe	98
PID 4944 wrote to memory of 1936	4944	msedge.exe	98
PID 4944 wrote to memory of 252	4944	msedge.exe	99
PID 4944 wrote to memory of 252	4944	msedge.exe	99
PID 4944 wrote to memory of 252	4944	msedge.exe	99
PID 4944 wrote to memory of 244	4944	msedge.exe	100
PID 4944 wrote to memory of 244	4944	msedge.exe	100
PID 4944 wrote to memory of 244	4944	msedge.exe	100
PID 4944 wrote to memory of 2540	4944	msedge.exe	102
PID 4944 wrote to memory of 2540	4944	msedge.exe	102
PID 4944 wrote to memory of 4268	4944	msedge.exe	105
PID 4944 wrote to memory of 2676	4944	msedge.exe	106
PID 4944 wrote to memory of 4268	4944	msedge.exe	105
PID 4944 wrote to memory of 2676	4944	msedge.exe	106
PID 4944 wrote to memory of 1996	4944	msedge.exe	108
PID 2480 wrote to memory of 3168	2480	khczusmkecxupmhf.exe	109
PID 4944 wrote to memory of 5488	4944	msedge.exe	112
PID 4944 wrote to memory of 5488	4944	msedge.exe	112
PID 6056 wrote to memory of 5644	6056	hezwusmhcx.exe	113
PID 4944 wrote to memory of 6116	4944	msedge.exe	116
PID 4944 wrote to memory of 6116	4944	msedge.exe	116
PID 2480 wrote to memory of 4408	2480	khczusmkecxupmhf.exe	119
PID 2480 wrote to memory of 5024	2480	khczusmkecxupmhf.exe	123
PID 4648 wrote to memory of 680	4648	rljhbzwuom.exe	125
PID 2480 wrote to memory of 4548	2480	khczusmkecxupmhf.exe	128
PID 2480 wrote to memory of 5824	2480	khczusmkecxupmhf.exe	132
PID 1872 wrote to memory of 2440	1872	bwtrljgbwt.exe	134
PID 2480 wrote to memory of 4884	2480	khczusmkecxupmhf.exe	137
PID 2480 wrote to memory of 2608	2480	khczusmkecxupmhf.exe	142
PID 3232 wrote to memory of 1076	3232	dbvtrljdbv.exe	144
PID 2480 wrote to memory of 3976	2480	khczusmkecxupmhf.exe	147
PID 4944 wrote to memory of 3228	4944	msedge.exe	149
PID 4944 wrote to memory of 4144	4944	msedge.exe	150
PID 4944 wrote to memory of 3964	4944	msedge.exe	151
PID 2480 wrote to memory of 5792	2480	khczusmkecxupmhf.exe	154
PID 3224 wrote to memory of 4420	3224	yvtnlfdyvq.exe	156
PID 2480 wrote to memory of 4952	2480	khczusmkecxupmhf.exe	159
PID 2480 wrote to memory of 2616	2480	khczusmkecxupmhf.exe	163
PID 1612 wrote to memory of 2760	1612	kidavsnlfd.exe	165
PID 2480 wrote to memory of 1636	2480	khczusmkecxupmhf.exe	168
PID 2480 wrote to memory of 4716	2480	khczusmkecxupmhf.exe	172
PID 6100 wrote to memory of 3560	6100	xusqnifzxs.exe	174
PID 2480 wrote to memory of 5720	2480	khczusmkecxupmhf.exe	177
PID 2480 wrote to memory of 716	2480	khczusmkecxupmhf.exe	181
PID 4404 wrote to memory of 1420	4404	khfdxvpnhf.exe	183
PID 2480 wrote to memory of 4204	2480	khczusmkecxupmhf.exe	186
PID 4944 wrote to memory of 3132	4944	msedge.exe	188
PID 4944 wrote to memory of 3132	4944	msedge.exe	188
PID 2480 wrote to memory of 2856	2480	khczusmkecxupmhf.exe	194
PID 4696 wrote to memory of 3076	4696	xrpkhczxrp.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_3d39b3e5e20ba44aff92d63d0b2f0850_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Temp\khczusmkecxupmhf.exe
  C:\Temp\khczusmkecxupmhf.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hezwusmhcx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3168
  - - C:\Temp\hezwusmhcx.exe
      C:\Temp\hezwusmhcx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6056
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5644
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hezwusmhcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4408
  - - C:\Temp\i_hezwusmhcx.exe
      C:\Temp\i_hezwusmhcx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljhbzwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5024
  - - C:\Temp\rljhbzwuom.exe
      C:\Temp\rljhbzwuom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4648
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:680
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljhbzwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4548
  - - C:\Temp\i_rljhbzwuom.exe
      C:\Temp\i_rljhbzwuom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtrljgbwt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5824
  - - C:\Temp\bwtrljgbwt.exe
      C:\Temp\bwtrljgbwt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1872
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2440
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwtrljgbwt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4884
  - - C:\Temp\i_bwtrljgbwt.exe
      C:\Temp\i_bwtrljgbwt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtrljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2608
  - - C:\Temp\dbvtrljdbv.exe
      C:\Temp\dbvtrljdbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3232
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1076
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtrljdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3976
  - - C:\Temp\i_dbvtrljdbv.exe
      C:\Temp\i_dbvtrljdbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvtnlfdyvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5792
  - - C:\Temp\yvtnlfdyvq.exe
      C:\Temp\yvtnlfdyvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3224
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4420
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvtnlfdyvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4952
  - - C:\Temp\i_yvtnlfdyvq.exe
      C:\Temp\i_yvtnlfdyvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kidavsnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2616
  - - C:\Temp\kidavsnlfd.exe
      C:\Temp\kidavsnlfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1612
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2760
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kidavsnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1636
  - - C:\Temp\i_kidavsnlfd.exe
      C:\Temp\i_kidavsnlfd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xusqnifzxs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4716
  - - C:\Temp\xusqnifzxs.exe
      C:\Temp\xusqnifzxs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6100
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3560
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xusqnifzxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5720
  - - C:\Temp\i_xusqnifzxs.exe
      C:\Temp\i_xusqnifzxs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khfdxvpnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:716
  - - C:\Temp\khfdxvpnhf.exe
      C:\Temp\khfdxvpnhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1420
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khfdxvpnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4204
  - - C:\Temp\i_khfdxvpnhf.exe
      C:\Temp\i_khfdxvpnhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpkhczxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2856
  - - C:\Temp\xrpkhczxrp.exe
      C:\Temp\xrpkhczxrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4696
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3076
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpkhczxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4136
  - - C:\Temp\i_xrpkhczxrp.exe
      C:\Temp\i_xrpkhczxrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kebzurpmge.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3360
  - - C:\Temp\kebzurpmge.exe
      C:\Temp\kebzurpmge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2224
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kebzurpmge.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6104
  - - C:\Temp\i_kebzurpmge.exe
      C:\Temp\i_kebzurpmge.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjebwromge.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4536
  - - C:\Temp\mjebwromge.exe
      C:\Temp\mjebwromge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5380
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2388
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjebwromge.exe ups_ins
    3⤵
    PID:5612
  - - C:\Temp\i_mjebwromge.exe
      C:\Temp\i_mjebwromge.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljdbywuo.exe ups_run
    3⤵
    PID:3476
  - - C:\Temp\trljdbywuo.exe
      C:\Temp\trljdbywuo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1432
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1300
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljdbywuo.exe ups_ins
    3⤵
    PID:5156
  - - C:\Temp\i_trljdbywuo.exe
      C:\Temp\i_trljdbywuo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlgdyvtrli.exe ups_run
    3⤵
    PID:4216
  - - C:\Temp\nlgdyvtrli.exe
      C:\Temp\nlgdyvtrli.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3832
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlgdyvtrli.exe ups_ins
    3⤵
    PID:3228
  - - C:\Temp\i_nlgdyvtrli.exe
      C:\Temp\i_nlgdyvtrli.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaysqlidav.exe ups_run
    3⤵
    PID:1952
  - - C:\Temp\gaysqlidav.exe
      C:\Temp\gaysqlidav.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5048
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:824
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaysqlidav.exe ups_ins
    3⤵
    PID:844
  - - C:\Temp\i_gaysqlidav.exe
      C:\Temp\i_gaysqlidav.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsnkicaxsp.exe ups_run
    3⤵
    PID:3408
  - - C:\Temp\vsnkicaxsp.exe
      C:\Temp\vsnkicaxsp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5628
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2500
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsnkicaxsp.exe ups_ins
    3⤵
    PID:5376
  - - C:\Temp\i_vsnkicaxsp.exe
      C:\Temp\i_vsnkicaxsp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1188
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifaxvpkifa.exe ups_run
    3⤵
    PID:5620
  - - C:\Temp\ifaxvpkifa.exe
      C:\Temp\ifaxvpkifa.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1748
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5436
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifaxvpkifa.exe ups_ins
    3⤵
    PID:1172
  - - C:\Temp\i_ifaxvpkifa.exe
      C:\Temp\i_ifaxvpkifa.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfcxusmkfc.exe ups_run
    3⤵
    PID:1088
  - - C:\Temp\hfcxusmkfc.exe
      C:\Temp\hfcxusmkfc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4284
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1348
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfcxusmkfc.exe ups_ins
    3⤵
    PID:2560
  - - C:\Temp\i_hfcxusmkfc.exe
      C:\Temp\i_hfcxusmkfc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eczxrpmhec.exe ups_run
    3⤵
    PID:2720
  - - C:\Temp\eczxrpmhec.exe
      C:\Temp\eczxrpmhec.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5528
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3172
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eczxrpmhec.exe ups_ins
    3⤵
    PID:1548
  - - C:\Temp\i_eczxrpmhec.exe
      C:\Temp\i_eczxrpmhec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywrojhezw.exe ups_run
    3⤵
    PID:2368
  - - C:\Temp\eywrojhezw.exe
      C:\Temp\eywrojhezw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1668
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1396
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywrojhezw.exe ups_ins
    3⤵
    PID:3556
  - - C:\Temp\i_eywrojhezw.exe
      C:\Temp\i_eywrojhezw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wurljebzwu.exe ups_run
    3⤵
    PID:3912
  - - C:\Temp\wurljebzwu.exe
      C:\Temp\wurljebzwu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6116
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4344
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4516
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffebfc2c188,0x7ffebfc2c194,0x7ffebfc2c1a0
      4⤵
      PID:1112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2016,i,6269690173897729757,7427201379256489266,262144 --field-trial-handle=2520,i,14977773138052777038,6028141964323186476,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:2
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2124,i,7086173177362590831,1322557727836177612,524288 --field-trial-handle=2520,i,14977773138052777038,6028141964323186476,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:11
      4⤵
      System Time Discovery
      PID:1140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,7150142251681070587,2582479087709250765,524288 --field-trial-handle=2520,i,14977773138052777038,6028141964323186476,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:13
      4⤵
      PID:4128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,10746299444914551969,6637403877014169064,2097152 --field-trial-handle=2520,i,14977773138052777038,6028141964323186476,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:3656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,8626215103345755114,3684393174320496521,2097152 --field-trial-handle=2520,i,14977773138052777038,6028141964323186476,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:1936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,4930001411423162094,5613563497790421325,2097152 --field-trial-handle=2520,i,14977773138052777038,6028141964323186476,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:9
      4⤵
      PID:252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,8181366678107910297,1681302249087539660,2097152 --field-trial-handle=2520,i,14977773138052777038,6028141964323186476,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:1
      4⤵
      PID:244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,3685790684051132562,12620849023544246043,524288 --field-trial-handle=2520,i,14977773138052777038,6028141964323186476,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14
      4⤵
      PID:2540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,13766972220473249320,1894693666054650701,524288 --field-trial-handle=2520,i,14977773138052777038,6028141964323186476,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:4268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,13364433380223606779,9814305708949860841,524288 --field-trial-handle=2520,i,14977773138052777038,6028141964323186476,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
      4⤵
      PID:2676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,15319897590653886743,467851985252816329,524288 --field-trial-handle=2520,i,14977773138052777038,6028141964323186476,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
      4⤵
      PID:5792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,15319897590653886743,467851985252816329,524288 --field-trial-handle=2520,i,14977773138052777038,6028141964323186476,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
      4⤵
      PID:1996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,13618149809313626619,17218165423641847626,524288 --field-trial-handle=2520,i,14977773138052777038,6028141964323186476,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:5488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,5702688560142926915,12492633408679978071,524288 --field-trial-handle=2520,i,14977773138052777038,6028141964323186476,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
      4⤵
      PID:6116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,5076695403196077840,3211498381120020837,524288 --field-trial-handle=2520,i,14977773138052777038,6028141964323186476,262144 --variations-seed-version --mojo-platform-channel-handle=1304 /prefetch:14
      4⤵
      PID:3228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,10297277049282003846,1434021096506081149,524288 --field-trial-handle=2520,i,14977773138052777038,6028141964323186476,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
      4⤵
      PID:4144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,16415658089414733658,5653180898742986600,524288 --field-trial-handle=2520,i,14977773138052777038,6028141964323186476,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
      4⤵
      PID:3964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1384,i,17365385513840238672,5610376276613583519,524288 --field-trial-handle=2520,i,14977773138052777038,6028141964323186476,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
      4⤵
      PID:3132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,2576400166931060143,9864263878128670873,524288 --field-trial-handle=2520,i,14977773138052777038,6028141964323186476,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
      4⤵
      PID:3196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,5811921584018695768,14487260758493548710,524288 --field-trial-handle=2520,i,14977773138052777038,6028141964323186476,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
      4⤵
      PID:4092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,16900815067291796672,9402964017165760460,524288 --field-trial-handle=2520,i,14977773138052777038,6028141964323186476,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6384,i,5745395053438176523,6828392400334181915,262144 --field-trial-handle=2520,i,14977773138052777038,6028141964323186476,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:10
      4⤵
      PID:4212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,7543657384916320394,2218717519439970474,524288 --field-trial-handle=2520,i,14977773138052777038,6028141964323186476,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:14
      4⤵
      PID:4092

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:956

C:\Temp\khczusmkecxupmhf.sys
C:\Temp\khczusmkecxupmhf.sys
1⤵
- Executes dropped EXE
PID:5848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5060

C:\Temp\rmjebwurmj.sys
C:\Temp\rmjebwurmj.sys
1⤵
- Executes dropped EXE
PID:6080

C:\Temp\ljebztromg.sys
C:\Temp\ljebztromg.sys
1⤵
- Executes dropped EXE
PID:1764

C:\Temp\geywqomgey.sys
C:\Temp\geywqomgey.sys
1⤵
- Executes dropped EXE
PID:2404

C:\Temp\tqolgdyvtq.sys
C:\Temp\tqolgdyvtq.sys
1⤵
- Executes dropped EXE
PID:2680

C:\Temp\qnlfdyvqni.sys
C:\Temp\qnlfdyvqni.sys
1⤵
- Executes dropped EXE
PID:5392

C:\Temp\kfcavsnlfd.sys
C:\Temp\kfcavsnlfd.sys
1⤵
- Executes dropped EXE
PID:1396

C:\Temp\icaxvpmkif.sys
C:\Temp\icaxvpmkif.sys
1⤵
- Executes dropped EXE
PID:3196

C:\Temp\xupnhczxrp.sys
C:\Temp\xupnhczxrp.sys
1⤵
- Executes dropped EXE
PID:2340

C:\Temp\mjhbzxupmh.sys
C:\Temp\mjhbzxupmh.sys
1⤵
- Executes dropped EXE
PID:3192

C:\Temp\rpjhbzwrpj.sys
C:\Temp\rpjhbzwrpj.sys
1⤵
- Executes dropped EXE
PID:5080

C:\Temp\oljdbywuom.sys
C:\Temp\oljdbywuom.sys
1⤵
PID:1764

C:\Temp\ljdbytrljd.sys
C:\Temp\ljdbytrljd.sys
1⤵
PID:1692

C:\Temp\ayvtnlidbv.sys
C:\Temp\ayvtnlidbv.sys
1⤵
PID:4996

C:\Temp\fdavtnlfda.sys
C:\Temp\fdavtnlfda.sys
1⤵
PID:4852

C:\Temp\axvsqkhfda.sys
C:\Temp\axvsqkhfda.sys
1⤵
PID:2800

C:\Temp\hcaxspkica.sys
C:\Temp\hcaxspkica.sys
1⤵
PID:2304

C:\Temp\hezxrpjhez.sys
C:\Temp\hezxrpjhez.sys
1⤵
PID:4876

C:\Temp\mkezwuomhe.sys
C:\Temp\mkezwuomhe.sys
1⤵
PID:5816

C:\Temp\ztrmjhbywu.sys
C:\Temp\ztrmjhbywu.sys
1⤵
PID:3012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bwtrljgbwt.exe

Path C:\Temp\bwtrljgbwt.exe
Size 389KB
SHA256 369a1363c919343a5dd660fe5f5d7905821bbd9c40d8664588f39c8e26549f2c
MD5 d8d39b8682e8745aa261e8cfe45873e9
SHA1 0acbb9432447264c82303927340e51e0510af658
SHA512 f361cab98e338ee8fa581b4c4917b5ece1ee495939f66286e120633edd07cdf9f19acc0c59936649c69b6f8c92feae71dee6a4e6809a84bdc553c4f28f732875
SSDEEP 3072:/uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:/uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E9847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtrljdbv.exe

Path C:\Temp\dbvtrljdbv.exe
Size 389KB
SHA256 a97c6571248a5b56b1a4f25ca7efb47b30c2f3b731c5ba40dc7502f0a2f651b8
MD5 f0d306000b5da125c3bf389f6c1ffa21
SHA1 46f8025f74cd5110761002c7ec1b4c14e0722023
SHA512 1dc81bc927c802ab34c293324bdcaa446935c36687f85d4fa3799cf0847d50155a9d77db59217fa64f5612dd6e4cfaa4219176cd9a087689a49433b497b19181
SSDEEP 3072:Kuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:KuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E4847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqomgey.sys

Path C:\Temp\geywqomgey.sys
Size 293KB
SHA256 fa913af8b99de093fe2730593675f55fde53f8e1e01901682f6e9d5e8574cfce
MD5 025fb26322da260e99f1bc02a446d611
SHA1 118b1d1f0fcfd45f3ebab1d57287ac031915938f
SHA512 a3f1f61876ea7efdcfd9a9e24760dcebe50390a057cafd23d79c870c1a2bcb203ad2c022ac87599edf1a24d022e4e300aeceb50c2f2faf5decdef706e8dd02a0
SSDEEP 3072:2tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:2IJjiJcbI03GBc3ucY5DCSj
TLSH
T165545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hezwusmhcx.exe

Path C:\Temp\hezwusmhcx.exe
Size 389KB
SHA256 9cbe8128cf5f50cd4d4e3fa5045c36f3aece9f27791b5c7e21e917dd792b8b3a
MD5 3f444d7741c30aa99f51b570c20c5810
SHA1 af542171d56a78ac73d64a0e6fe6fc1f25a91138
SHA512 e27c438cedf4035e50091fd46cd332951d70f29c2b32a394d464595ef75706261e1caf8959111c90df94a9cf16682df531deeb034b62f309e5ba33d7ced86432
SSDEEP 3072:Huxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:HuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19F847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bwtrljgbwt.exe

Path C:\Temp\i_bwtrljgbwt.exe
Size 389KB
SHA256 ef59fa4698b9e00dac967915c6724bcb2de6f799f4174db7a5caa2c595e9a81a
MD5 be335b6b4c9dd4091c53e4aef280bf86
SHA1 f592c32106243bfa44719dbc8a87c69a3948ce54
SHA512 440b1db80816c0524d8ec95b221f6d89d257f5f93ec48a608eab60589c30121818d8872abbafc4956026049613cc51b0a55caab3b06238470eaefd63b0c3f840
SSDEEP 3072:buxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:buxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T113847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbvtrljdbv.exe

Path C:\Temp\i_dbvtrljdbv.exe
Size 389KB
SHA256 90d1fa224365c258119b778d62fda7629f076f1ccb159d4f84fecabc6d8fed35
MD5 abe9aac56cc488f0c4d59f6b4c9b5312
SHA1 69c2e094c17179ffad542186f978fbc353a5f50c
SHA512 f7e4fb39d9d5ab4f739239e2b145f3c0be7dd01fd59a1fbc6b3453fa5330763a0ce3ae65e7ceba61dd461055c69ed5f7f292cc8135a326469fcfb4611f0873dc
SSDEEP 3072:auxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:auxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18F847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hezwusmhcx.exe

Path C:\Temp\i_hezwusmhcx.exe
Size 389KB
SHA256 50ba1871a1b785dc5ee0dc5455f8c392c8b82b22aefbd807518581dd8dc54eb0
MD5 8de8f4c869db846665a4123f25734ea8
SHA1 046060dab8c4d98b4c58db96c039a1c79d58acde
SHA512 e35a832440dca6e9d8853aac9a30434e8d2ca38c5c836be90ce0498888c54778a9d028de147856983157a974b40ed00b385d4805c15c544c533305081ea868f8
SSDEEP 3072:suxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:suxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13D847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kidavsnlfd.exe

Path C:\Temp\i_kidavsnlfd.exe
Size 389KB
SHA256 d58a26a0663cf3db7ef831bd3fdd5b9d6d3e5d2f973be0c9bb20a4d03985aaf5
MD5 752d08a13704f9fafb6f889122dae9b2
SHA1 dd6163f353b80401c6b816dcd7dfe8faf14aa318
SHA512 f13e31383595c592f89bad779c8e11df0b4ef085cf4e276f6dee0f3551c1cfbcf9e9fe61a6353f4a9b1c2fb6ee6aee2c6374f1325117bfc02aca7daf8b819bc3
SSDEEP 3072:euxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:euxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17E847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rljhbzwuom.exe

Path C:\Temp\i_rljhbzwuom.exe
Size 389KB
SHA256 8bfc310af8d0f67436d5e47a3345d0a877dc53b21f676674305fd236d7d2db74
MD5 f3da767e4ecbb46e5d23de4151bb9a85
SHA1 1659da1e65a56a0030c0386bf787463ecd040cdc
SHA512 d0a0b8d95ac21483a9c31115c58cfef2f1b530aff5ae36c199c8e0880d0b759c698a2b42057a018417cd00150dfaaf4e6286903245cac7f98a85c61e85cb3de8
SSDEEP 3072:Muxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:MuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13C847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvtnlfdyvq.exe

Path C:\Temp\i_yvtnlfdyvq.exe
Size 389KB
SHA256 ea2f0fb7e27a0af81597abad61333b2d79f5ae72e8876750edc62468a1b5e681
MD5 61c0514f4be1ba07567a03a124b7072a
SHA1 88513fc03a0115ce5d368d152492e20fc4657f5c
SHA512 4a7b53a470c020ff5bec22d3f3dce52345c0bfac24ce8adcfc8fc6c0a6136e03c951962a0eec856b72e0c180983ca1f85db71ecf1508eff0e4d857103ae11b95
SSDEEP 3072:euxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:euxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B4847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khczusmkecxupmhf.exe

Path C:\Temp\khczusmkecxupmhf.exe
Size 389KB
SHA256 11e6a14226cb8c1e1a25a665f1e6f5ca86003c881488d087103114987f524b4e
MD5 4456fff396c4a993dc0ffc296cc49dd5
SHA1 ac735bff7170b19a3aa736a7de7d22c2578a7d8b
SHA512 c10f1b8e58a595b168c25193948fb5b101a76d0bafd4df0a7a5f9c3f0c43c824c2f480ed5a354754290efafb60ab2bdee065e30e839aa0fce9bba780324e38e1
SSDEEP 3072:buxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:buxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11D847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khczusmkecxupmhf.sys

Path C:\Temp\khczusmkecxupmhf.sys
Size 293KB
SHA256 3fe412f114a028a56450027de55eea09392866374d164e3960f98f964af9b53c
MD5 17c91bceae5add15ead45853c1bfd5a0
SHA1 d06a0a618f491d8e8ab0f7dd0b5cb0500f246a11
SHA512 359d1898a766da8cebbe4f87669acd6e97825c79b971abef0d4b9ae3b10cca727e14aa6463d6ecaa591008dee7755c94905cd879dbed1400b314eeb415986c48
SSDEEP 3072:ztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:zIJjiJcbI03GBc3ucY5DCSj
TLSH
T17E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kidavsnlfd.exe

Path C:\Temp\kidavsnlfd.exe
Size 389KB
SHA256 ef1ccb1c3d330ef541a5ae6db30910a04a2afb7916c09cdb01ec762c868d4cca
MD5 ecce6c7c3b9775052a4fc7580aa84633
SHA1 c6d2c4ad56968c31ec5d70e23b13aecf19aceb2b
SHA512 c22da5f08087a452f2b36f798803f1f14c63bb4fd40ddf801c7146d3bf72244ab7273fde2e0c321fce5cb4420b7440f4355deb5d1633b14e80a3e4f35d31e37a
SSDEEP 3072:juxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:juxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D9847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljebztromg.sys

Path C:\Temp\ljebztromg.sys
Size 293KB
SHA256 dae98178f113aa81f13336ed47519d361a91bf4a2a17a4db4c22e9ddef83aa44
MD5 cb330068abdfb1811ae61be34eebd730
SHA1 07fef80ff4ed13aa4e6299552cc898d1185c0be8
SHA512 16051a16f6b127a60b9828a32c00978d02acae95edcf26bf058ac1be92ec6269debde5bd4291081b7687171b2c81234df78f3ae7285f94f7990a439c45d9a9f5
SSDEEP 3072:StKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:SIJjiJcbI03GBc3ucY5DCSj
TLSH
T184545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnlfdyvqni.sys

Path C:\Temp\qnlfdyvqni.sys
Size 293KB
SHA256 a6e47e17e712ff6c995941e1de41579beecd61bec4a7d7430e5153478f770caf
MD5 60195aa1083704bf64c09703f4fc0079
SHA1 4a67ed3d3504d46e5cc288ba7bfdadcdc9422440
SHA512 2e9c010ac737be1d0401435b8cc2a10dd4a59299f2ada468e775499b24d9bd1dab36cde63ec6fda84dd1b82cda112185b6e645af6290b7e6ccdecf760b6869ac
SSDEEP 3072:DtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:DIJjiJcbI03GBc3ucY5DCSj
TLSH
T180545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljhbzwuom.exe

Path C:\Temp\rljhbzwuom.exe
Size 389KB
SHA256 9fea3aa7518b84fc5c9bdd12a2dfc7b2139f5ca242a300072eaf427288b1ec65
MD5 6ed2d6ba3b09fc2dfe90a6086a21398f
SHA1 cca58881cdeebca7f4d15f4bd21ea4361a01d176
SHA512 49303aa5d4657780da53ff098cb782a8712963015eda31b7128890cccc3b886d2294bc03ba06bffa97e0f840bd5eeae9d58af0314b6b27f21f00e96e00c42ec5
SSDEEP 3072:Muxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:MuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T186847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmjebwurmj.sys

Path C:\Temp\rmjebwurmj.sys
Size 293KB
SHA256 aa4b0f222911aabf61a3faf4b586b8fac04204e85d706a25d537e8b31276cff9
MD5 d527e32b0d0aadba02b023d265f9451b
SHA1 42cf80c3c2a5d58318b5b56c5ee939015b091845
SHA512 f00409204514f929aa8cf9776c7f539284bb29bb62b8902f90a2c1d0fbf4004f598e64495fa2f27e120373da79467df264e5029aea9c9a7c0d185e42e1d06215
SSDEEP 3072:CtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9Ed3:CIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqolgdyvtq.sys

Path C:\Temp\tqolgdyvtq.sys
Size 293KB
SHA256 3df79af622cd7bd86fd3b17ca4538586b74afa58004d56855171cfcdb6e9d341
MD5 709707e8a1e7423bbf5a5b51b2571642
SHA1 2a3cd77a05501dfe61ef7bf4eef05fa905af8803
SHA512 066b9841c75afd64b3e5c0bb815e0c2e5486364c6503feae5fc995ce4d78520d6c9cc3ff02c03c244457e7ce29df44a1f92db4a7a8b89ccb9329d4795ff5743d
SSDEEP 3072:dtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:dIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvtnlfdyvq.exe

Path C:\Temp\yvtnlfdyvq.exe
Size 389KB
SHA256 1d7f5bf6b30062b1c51943a516cf4e38f8aebc9fefd759f7ba0bc74331293f91
MD5 7c6572124e11637b155b817dc373eecf
SHA1 ec5b897ca58118879e1c829a6e17ae2934c61352
SHA512 f9b6dd98fb4f3f184450e77c56fbb088be89dd26c7405e8f35eeea95334275b46cbaf125a22f9ab18ac1e091aae7407c254d8860799f63082b59d355e70e390f
SSDEEP 3072:Uuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:UuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11D847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16adbd7d-afc2-4f48-a4f4-9d70f81ca027.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\16adbd7d-afc2-4f48-a4f4-9d70f81ca027.tmp
Size 38KB
SHA256 aff4200d2776f615af511187c966500c4da74cf193ae9684611dceff530b8fc0
MD5 e495bc0e2cff15e80c0baf69e106a733
SHA1 c16d85cb400ef504ac2663c723a3aaffa08e42d7
SHA512 8934a60a588d782c583e9f323b4a4d1fb09ceb239a98db2d3e7232d27a73f95c61a07949228b7fa17758369fd66c7b9ebfc168d29a9be6655acdf6adb95743b8
SSDEEP 768:Irv+4UNbdD3jcVNp8+p3bd66j+4BRv86aLIiX2bwCl1:Ibsbp3QL8+p3Z6n4yd0ww
TLSH
T11003BF73E9A899339CF6C644B2867B437FF851A396C10AC4D4DD2B4E419A19E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 30beda35693c51121851ce1929b0bebb17bc13ca2259e3e60235f9155a41e6cf
MD5 c4b24b01ffc4e298f823e5b74cdda708
SHA1 897f1eb8d712a0a21b132343be01bdd328f860cd
SHA512 c01e05c83d4ae34f119ac96a311653ad4b4fd582b7c0ff6702866559e7ae58f5def69e16ef8dad7df5e8ead3ef1cb24ebbf6334a32e36af039ea494cdb61f45c
TLSH
T1545150BC13E928CAD762EDF324F64A98B6F0A65A210F3F41D9A81D78CDC5F1410D0057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596855.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596855.TMP
Size 2KB
SHA256 4c4f8c62b5f2660391e5ccc16c9c568a82600bae80eb8df484aec177f56e3d9c
MD5 7c2ef399f20a1d7d098150399a8e85d2
SHA1 1671152520b761362397aea9d3c297ec606b9781
SHA512 feaf6344be8fd02c5274cfa94a1c2d05dd661acbf558fa827cadf23c2240426a09e262a99b04be22d32977aaa3aa9c6e92c99973adba00b82f9f7fbf1b5a2e73
TLSH
T196514FBC13E928CAD762EDF324F24A98B2F0A65A210F3F81D9A81D78CDC5F1414D0057
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 928cb42df7e935dfdf6f31ab90ec733d313b5f27bec455ccb20cae2e1f148ebd
MD5 7eabe4344903c11cef6b04613127405d
SHA1 dee115f982c55e7bf48b1aa03fe30dd944770929
SHA512 56c3c389fef916216916af56540de47e131237d77ddbe25cd4a0c07264a67a131131f307bfac6aa61ef8258e6b3f17902de8b7c3fb32e2faff9aed124ced8046
TLSH
T12741CEF383F4857E9A0196F0AA146E2FDE2D0515432C7C5AC9E0AE2B93F3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7066412334162f44368f01e580e5a7742b33e9857bf9ac63eb259d80d3da9a75
MD5 8d9447a54e62fe48bf9348a4f599e987
SHA1 0ecf443c34f65f63855fd5240b11c9df6656c9dc
SHA512 66c4324385942676fba8971dbee03439f63f091cf47a29a1699207a2e8a8f31b9b249e17cf820623a33576252ce2cc1e0cd5da18482abce8027b467ff6c398b0
SSDEEP 192:sxRpRzCu/fFslrrHJZpBRXzoD8p9+/g6+WNCjv/YCwBuORGOIgVlJ:sxRpYu/fFslrrHHl3Y/54/yV5
TLSH
T18842B9166D68A93B9CC7E21DBB55BF53D3F96032A1D01E49ABFC861C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7bc800f5c0e400896a0fb5bcad65567ba46e30716422882de899ced0d7b37c52
MD5 39d4dbb43e7fd004edba398630e45f39
SHA1 2056e0853709b9cd8664fc51c4679b70b2a2ec9f
SHA512 755b6f0fb712e78204cc7f09de938f9445c00423cf7993f12f1089a46a92f71b32ef96961fca68b5960ccc2cc2b8ce50a2bb84033fb2ccd19b7225dd62b0885c
SSDEEP 192:sxRSRzCu/fFsJrrHJZpBRXzoD8p9+/g6+WNCjv/YCwBuORGOIgDqBlJ:sxRSYu/fFsJrrHHl3Y/54/yVe1
TLSH
T11D42C9166D68A93B9CC7E21DBB55BF53D3F96032A1D01E49ABFC861C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 00efbcb8ffc98672e5f56bb6dd403b9a254aadb32fed0e873c560946ba055cdc
MD5 6f40f661ab3916d42688b417616036e5
SHA1 c387562aac660b7b0ea19651c6516b0f4673b39d
SHA512 516501d0ed29a5e51e4387795b0dc2d65bce31a80c25ba65f84ebeb61ca87a472e24522e031c70b76dd0b3622fd4eb1d3a7fad82e35a5aadeff364de9883a0e6
SSDEEP 192:sxRSRzCu/fFsJrrgJZpBRXzoD8p9+/g6+WNCjv/YCNLuORGOIgDqrlJ:sxRSYu/fFsJrrgHl3Y/54/RVeD
TLSH
T17242C916A968A97B9CC7E20DBB55FF53D3F9603291D01E49ABFC861C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 66317a53406a82f0e20ff6c17e60c7561ead9ba5b7eca2274197707088cc1209
MD5 bb5498ef4f9d95aece3823d01379a8db
SHA1 3f34b19910582a2df9559d7d33b5c22223e49398
SHA512 01ec22481c154660d91d5dfffa00131323d1830b4a3de86424c38900748e1f4c94f8baa3210880a0571a9c90b133367cf65d181eb9afb0950c269e77f0dce271
SSDEEP 768:jC+vgN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQc0QqcwroZ5:jC+vg7E7JQWgQ+f4+u1jaDc0Vcbz
TLSH
T1AAD2EA7B640DCB7F4F804ADDED197E9A6DA802CB9698CD4047FA841C02C6BEB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 875cf59e974ae849035a899dc36b4a4d315934de901ce7556a21ad18d1b48969
MD5 c69d1deb35c2c883d0cf75c0036ce0c7
SHA1 1e40a2818693a64ac3ffdabed095fa31ca64b63a
SHA512 a8038855d5778d4fe9c365a44324feff22514e756bce2fc0caa4feb998268a63f0e3d51443a8381013514b8ebdf2b8cdf8e878b89297bdf4177a905f9f178a97
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHPY95PNtBWkuAKz6uqOoKLqV:CbEBVj5JAdSp9/EgTK7j6dJOHPY95PNR
TLSH
T15F916201357B92003DBE690C807D9D2E468271B3741BE62B7BA940661FABF516EFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a036c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a036c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 91a3daedd1349b40e70e884604d4cd486efc428418f88bae37ffc48ca7dfcb1e
MD5 9aa037cd89e406d8220359511d7cec00
SHA1 0934ad10eb6afe21707def62a50ea3a6ea26e8aa
SHA512 7936dc2d0de3747430569e0a2673978ca51fb56f8114810f266babd24c1f6685aabe783379d9414ad3d51408bb7be5b059be090a7183d4c6eb078b39e0f940de
SSDEEP 768:1FQH39wgnxXGG2p8+p3bd66j+4BRv86aLIWrPi9PY:UH3bxu8+p3Z6n4yNPv
TLSH
T12D1307F294D78936E8AD8783677D6E429EFCD153B5844994BBC85D0CCC821BFC70A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3fbe6e4d8529c607fce18b9b1118a786c2443d395466b382633a58449adaadda
MD5 3e3d486820da8218680dd31cbb84f582
SHA1 4b0efbf44e9845b6639b51188239fe1c17fc07d2
SHA512 75ac7883fc7bd139592fac332a2634b0aaa0f50717244f86185cacd4dd23541e292b53ea8fb7fc7d2cf6833206e0e9b4e2dd882605c213b57a4364dc373772a8
SSDEEP 768:RE3ym4Z5hep8+p3bd66j+4BRv86aLIWrPi9PY:RE3ymsY8+p3Z6n4yNPv
TLSH
T140F2AFB1E8A99D639CF5DB45B6866743AFF86163E5C00E98D8DC9B0D048326E170BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2dd0d3a62d58998c4e29e3ff5c08a4d5aa0ac82cc704067ad48155c413a61540
MD5 8dc8c4f593dce4fe25ae5150febaa57e
SHA1 721148a3b262aa48771999960e472bbf83209109
SHA512 9458b48ea5ad27b09cb25857da2f9b7a4fc3d959f8ce990888ac8cd9792c6630e49428def1163f026056c7c644d6ccb0b63e5b672eaad676bce23768a2fd1dd1
SSDEEP 768:EE31x4Z5hep8+p3bd66j+4BRv86aLIWrPi9PY:EE31xsY8+p3Z6n4yNPv
TLSH
T1F7F2AFB1E8A99D639CF5DB45B6866743AFF86163E5C00E98D8D89B0D048326E170BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 d0ac8ab1ebef0dd40a791deb9dbbfdf2833a0626eec4254732a99a37cfe0354b
MD5 a0a015e8d05c6925b046f63dae0d6f14
SHA1 788cd321dd1dd058d7ebbecea4a896fce271b797
SHA512 6f29a17d012de0dbc2f611994959624f428da2012199f9dd0c62ac8eb61880b143f32c0394ace2dd40b4186e900eaa27f4ab3984152a78eb61148f96ab861d84
SSDEEP 768:jrv+4UNbdD3Esz5hNp8+p3bd66j+4BRv86aLITr2bwCl1:jbsbp3ECL8+p3Z6n4ya0ww
TLSH
T1AB03BE72E4A8D9339DF6C644B1867B837FF861A399C10E84E8C95B4E405629E370FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

b4538def-46c7-4ca2-9e59-8ce3a88323c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b4538def-46c7-4ca2-9e59-8ce3a88323c0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4944_1827072326\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 690fef41db361f3f1b59a2821470cea5ba9f8448dd97ec4a5bced4cbc1f96183
MD5 e3a475ad49729128329c63805d59c13f
SHA1 f956872d0f232b569c5898ff78a0f7d7edb70be2
SHA512 151dc7f0c30b285576e5fa75b3906014f624e60be8fb55ec9c4198d16ea912ff5fb15f5b77b1a3ae421703aa170605187e2a96ab8474a39b7caeda17363e2aa2
TLSH
T16C71238357B9DAF2C1DA5BF002835648F1FB2278072330204B555556AB34A7E58B9F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1396-317-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1692-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1764-236-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1764-410-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1764-389-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2304-450-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2340-336-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2404-265-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2680-277-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2680-307-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2800-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3012-492-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3192-340-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3196-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4852-434-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4876-471-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4996-414-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5080-369-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5392-290-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5816-475-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5848-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6080-242-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6080-189-0x0000000000010000-0x00000000000AB000-memory.dmp

Download