systex | 61c39bf3af0e492a4182cb6ff8b66bb1d3b75c744f440778b9a0c93a39b87a9a

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 16:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260816-t4ayfsem2x
SHA256 61c39bf3af0e492a4182cb6ff8b66bb1d3b75c744f440778b9a0c93a39b87a9a
MD5 e27d668a4404438c209df63f74fa4a20
SHA1 7bc36ed325856c6f2c3fe041bf75e07f6d047f69
SHA512 a581ab68953bd91ff0ade7b80a969974dbe56eabca0c19fd1bd51a3f40cb0f2abb99a34642b33cba5b367c77cbb359ba3781d279c187cdea39ceb60823ec81ee
SSDEEP 3072:1FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:1FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F0847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2960	vtnlgdyvqoigdyvt.exe
5176	vtnlgdyvqoigdyvt.sys
5468	CreateProcess.exe
5716	aytnlgdyvq.exe
4796	CreateProcess.exe
624	CreateProcess.exe
6112	i_aytnlgdyvq.exe
836	fdxvqnicav.sys
4616	CreateProcess.exe
3172	aysqlfdavt.exe
2808	CreateProcess.exe
3832	CreateProcess.exe
2480	i_aysqlfdavt.exe
5348	vsnkfdavsm.sys
4380	CreateProcess.exe
5672	usqkifzxvp.exe
5124	CreateProcess.exe
5912	CreateProcess.exe
5228	i_usqkifzxvp.exe
4836	khcausmkec.sys
1676	CreateProcess.exe
2932	kecxusnhfz.exe
5076	CreateProcess.exe
728	CreateProcess.exe
5316	i_kecxusnhfz.exe
5488	hfcxupmkec.sys
2896	CreateProcess.exe
5856	czurmjhecw.exe
2620	CreateProcess.exe
3444	CreateProcess.exe
3436	i_czurmjhecw.exe
2560	jhezwurmjh.sys
708	CreateProcess.exe
3292	jhecwurmke.exe
2428	CreateProcess.exe
3564	CreateProcess.exe
4836	i_jhecwurmke.exe
5520	ojgbztrljd.sys
2436	CreateProcess.exe
5008	rljhbwtomg.exe
1948	CreateProcess.exe
5480	CreateProcess.exe
4292	i_rljhbwtomg.exe
4888	wrojytrljd.sys
1608	CreateProcess.exe
1428	bytrljdbvt.exe
2448	CreateProcess.exe
3808	CreateProcess.exe
5868	i_bytrljdbvt.exe
4588	gdyvqnljdb.sys
1716	CreateProcess.exe
3992	xvtnlidayt.exe
3264	CreateProcess.exe
2432	CreateProcess.exe
3120	i_xvtnlidayt.exe
1208	vsqlfdxvqn.sys
1188	CreateProcess.exe
712	nlfdaysqli.exe
5816	CreateProcess.exe
2732	CreateProcess.exe
684	i_nlfdaysqli.exe
2944	kifaysqkic.sys
5908	CreateProcess.exe
2676	kifaxvpnki.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2632_196250052\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2632_961806413\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2632_961806413\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2632_2019380298\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2632_2019380298\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2632_961806413\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2632_961806413\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2632_1063247546\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2632_196250052\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aytnlgdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqlfdavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecxusnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geyvtoljgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlidbysqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlgdyvqoigdyvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usqkifzxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usqkifzxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecxusnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhecwurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqoidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurmjhecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czurmjhecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhecwurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytrljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljhbwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljhbwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvtnlidayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhczxrpjhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljhbzwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljhbzwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geyvtoljgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhfzupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhczxrpjhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqoidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqlfdavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvtnlidayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlidbysqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxvsqkhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aytnlgdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytrljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifaxvpnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifaxvpnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhfzupnhf.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1220	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3012	ipconfig.exe
920	ipconfig.exe
4992	ipconfig.exe
1680	ipconfig.exe
1168	ipconfig.exe
5092	ipconfig.exe
720	ipconfig.exe
5916	ipconfig.exe
4760	ipconfig.exe
1744	ipconfig.exe
1456	ipconfig.exe
2264	ipconfig.exe
5248	ipconfig.exe
2560	ipconfig.exe
4812	ipconfig.exe
4448	ipconfig.exe
3296	ipconfig.exe
1584	ipconfig.exe
5420	ipconfig.exe
5256	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313717862081414"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{DF52DFB5-21C6-47A0-9D90-C4B904E91E3E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2960	vtnlgdyvqoigdyvt.exe
2960	vtnlgdyvqoigdyvt.exe
2960	vtnlgdyvqoigdyvt.exe
2960	vtnlgdyvqoigdyvt.exe
2960	vtnlgdyvqoigdyvt.exe
2960	vtnlgdyvqoigdyvt.exe
2960	vtnlgdyvqoigdyvt.exe
2960	vtnlgdyvqoigdyvt.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	6112	i_aytnlgdyvq.exe
Token: SeDebugPrivilege	2480	i_aysqlfdavt.exe
Token: SeDebugPrivilege	5228	i_usqkifzxvp.exe
Token: SeDebugPrivilege	5316	i_kecxusnhfz.exe
Token: SeDebugPrivilege	3436	i_czurmjhecw.exe
Token: SeDebugPrivilege	4836	i_jhecwurmke.exe
Token: SeDebugPrivilege	4292	i_rljhbwtomg.exe
Token: SeDebugPrivilege	5868	i_bytrljdbvt.exe
Token: SeDebugPrivilege	3120	i_xvtnlidayt.exe
Token: SeDebugPrivilege	684	i_nlfdaysqli.exe
Token: SeDebugPrivilege	3392	i_kifaxvpnki.exe
Token: SeDebugPrivilege	2196	i_mkhfzupnhf.exe
Token: SeDebugPrivilege	4888	i_jhczxrpjhe.exe
Token: SeDebugPrivilege	3512	i_mhezwrpjhb.exe
Token: SeDebugPrivilege	2004	i_ljhbzwrpjh.exe
Token: SeDebugPrivilege	2164	i_geyvtoljgb.exe
Token: SeDebugPrivilege	1748	i_tqoidbvtnl.exe
Token: SeDebugPrivilege	4996	i_nlidbysqni.exe
Token: SeDebugPrivilege	2128	i_fcavsnlfdx.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2632	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5784 wrote to memory of 2960	5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 5784 wrote to memory of 784	5784	2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 784 wrote to memory of 2632	784	iexplore.exe	90
PID 2632 wrote to memory of 2724	2632	msedge.exe	91
PID 2632 wrote to memory of 2484	2632	msedge.exe	93
PID 2632 wrote to memory of 1220	2632	msedge.exe	94
PID 2632 wrote to memory of 2484	2632	msedge.exe	93
PID 2632 wrote to memory of 2484	2632	msedge.exe	93
PID 2632 wrote to memory of 1412	2632	msedge.exe	95
PID 2632 wrote to memory of 1412	2632	msedge.exe	95
PID 2632 wrote to memory of 5012	2632	msedge.exe	96
PID 2632 wrote to memory of 5012	2632	msedge.exe	96
PID 2632 wrote to memory of 5012	2632	msedge.exe	96
PID 2632 wrote to memory of 3380	2632	msedge.exe	97
PID 2632 wrote to memory of 3380	2632	msedge.exe	97
PID 2632 wrote to memory of 3380	2632	msedge.exe	97
PID 2632 wrote to memory of 1280	2632	msedge.exe	98
PID 2632 wrote to memory of 1280	2632	msedge.exe	98
PID 2632 wrote to memory of 1280	2632	msedge.exe	98
PID 2632 wrote to memory of 4388	2632	msedge.exe	99
PID 2632 wrote to memory of 4388	2632	msedge.exe	99
PID 2632 wrote to memory of 4388	2632	msedge.exe	99
PID 2632 wrote to memory of 5884	2632	msedge.exe	100
PID 2632 wrote to memory of 5884	2632	msedge.exe	100
PID 2960 wrote to memory of 5468	2960	vtnlgdyvqoigdyvt.exe	104
PID 2632 wrote to memory of 2040	2632	msedge.exe	106
PID 2632 wrote to memory of 2040	2632	msedge.exe	106
PID 2632 wrote to memory of 4088	2632	msedge.exe	107
PID 2632 wrote to memory of 4088	2632	msedge.exe	107
PID 5716 wrote to memory of 4796	5716	aytnlgdyvq.exe	109
PID 2632 wrote to memory of 1328	2632	msedge.exe	113
PID 2632 wrote to memory of 3508	2632	msedge.exe	114
PID 2632 wrote to memory of 3508	2632	msedge.exe	114
PID 2632 wrote to memory of 1208	2632	msedge.exe	117
PID 2632 wrote to memory of 1208	2632	msedge.exe	117
PID 2960 wrote to memory of 624	2960	vtnlgdyvqoigdyvt.exe	119
PID 2960 wrote to memory of 4616	2960	vtnlgdyvqoigdyvt.exe	123
PID 3172 wrote to memory of 2808	3172	aysqlfdavt.exe	125
PID 2960 wrote to memory of 3832	2960	vtnlgdyvqoigdyvt.exe	128
PID 2960 wrote to memory of 4380	2960	vtnlgdyvqoigdyvt.exe	132
PID 5672 wrote to memory of 5124	5672	usqkifzxvp.exe	134
PID 2960 wrote to memory of 5912	2960	vtnlgdyvqoigdyvt.exe	137
PID 2960 wrote to memory of 1676	2960	vtnlgdyvqoigdyvt.exe	141
PID 2932 wrote to memory of 5076	2932	kecxusnhfz.exe	143
PID 2960 wrote to memory of 728	2960	vtnlgdyvqoigdyvt.exe	147
PID 2632 wrote to memory of 3648	2632	msedge.exe	149
PID 2632 wrote to memory of 3808	2632	msedge.exe	150
PID 2632 wrote to memory of 4420	2632	msedge.exe	151
PID 2960 wrote to memory of 2896	2960	vtnlgdyvqoigdyvt.exe	154
PID 5856 wrote to memory of 2620	5856	czurmjhecw.exe	156
PID 2960 wrote to memory of 3444	2960	vtnlgdyvqoigdyvt.exe	159
PID 2960 wrote to memory of 708	2960	vtnlgdyvqoigdyvt.exe	163
PID 3292 wrote to memory of 2428	3292	jhecwurmke.exe	165
PID 2960 wrote to memory of 3564	2960	vtnlgdyvqoigdyvt.exe	168
PID 2960 wrote to memory of 2436	2960	vtnlgdyvqoigdyvt.exe	172
PID 5008 wrote to memory of 1948	5008	rljhbwtomg.exe	174
PID 2960 wrote to memory of 5480	2960	vtnlgdyvqoigdyvt.exe	177
PID 2960 wrote to memory of 1608	2960	vtnlgdyvqoigdyvt.exe	181
PID 1428 wrote to memory of 2448	1428	bytrljdbvt.exe	183
PID 2960 wrote to memory of 3808	2960	vtnlgdyvqoigdyvt.exe	186
PID 2632 wrote to memory of 5312	2632	msedge.exe	188
PID 2632 wrote to memory of 5312	2632	msedge.exe	188
PID 2960 wrote to memory of 1716	2960	vtnlgdyvqoigdyvt.exe	194
PID 3992 wrote to memory of 3264	3992	xvtnlidayt.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_e27d668a4404438c209df63f74fa4a20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5784
- C:\Temp\vtnlgdyvqoigdyvt.exe
  C:\Temp\vtnlgdyvqoigdyvt.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aytnlgdyvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5468
  - - C:\Temp\aytnlgdyvq.exe
      C:\Temp\aytnlgdyvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5716
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4796
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aytnlgdyvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:624
  - - C:\Temp\i_aytnlgdyvq.exe
      C:\Temp\i_aytnlgdyvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqlfdavt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4616
  - - C:\Temp\aysqlfdavt.exe
      C:\Temp\aysqlfdavt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3172
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2808
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqlfdavt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3832
  - - C:\Temp\i_aysqlfdavt.exe
      C:\Temp\i_aysqlfdavt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usqkifzxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4380
  - - C:\Temp\usqkifzxvp.exe
      C:\Temp\usqkifzxvp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5672
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usqkifzxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5912
  - - C:\Temp\i_usqkifzxvp.exe
      C:\Temp\i_usqkifzxvp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kecxusnhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1676
  - - C:\Temp\kecxusnhfz.exe
      C:\Temp\kecxusnhfz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2932
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5076
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kecxusnhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:728
  - - C:\Temp\i_kecxusnhfz.exe
      C:\Temp\i_kecxusnhfz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czurmjhecw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2896
  - - C:\Temp\czurmjhecw.exe
      C:\Temp\czurmjhecw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5856
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2620
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czurmjhecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3444
  - - C:\Temp\i_czurmjhecw.exe
      C:\Temp\i_czurmjhecw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhecwurmke.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:708
  - - C:\Temp\jhecwurmke.exe
      C:\Temp\jhecwurmke.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3292
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2428
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhecwurmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3564
  - - C:\Temp\i_jhecwurmke.exe
      C:\Temp\i_jhecwurmke.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljhbwtomg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2436
  - - C:\Temp\rljhbwtomg.exe
      C:\Temp\rljhbwtomg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5008
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1948
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljhbwtomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5480
  - - C:\Temp\i_rljhbwtomg.exe
      C:\Temp\i_rljhbwtomg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bytrljdbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1608
  - - C:\Temp\bytrljdbvt.exe
      C:\Temp\bytrljdbvt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1428
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bytrljdbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3808
  - - C:\Temp\i_bytrljdbvt.exe
      C:\Temp\i_bytrljdbvt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvtnlidayt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1716
  - - C:\Temp\xvtnlidayt.exe
      C:\Temp\xvtnlidayt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3992
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3264
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvtnlidayt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2432
  - - C:\Temp\i_xvtnlidayt.exe
      C:\Temp\i_xvtnlidayt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfdaysqli.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1188
  - - C:\Temp\nlfdaysqli.exe
      C:\Temp\nlfdaysqli.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:712
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5816
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfdaysqli.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2732
  - - C:\Temp\i_nlfdaysqli.exe
      C:\Temp\i_nlfdaysqli.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kifaxvpnki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5908
  - - C:\Temp\kifaxvpnki.exe
      C:\Temp\kifaxvpnki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2676
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1108
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3012
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kifaxvpnki.exe ups_ins
    3⤵
    PID:1196
  - - C:\Temp\i_kifaxvpnki.exe
      C:\Temp\i_kifaxvpnki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkhfzupnhf.exe ups_run
    3⤵
    PID:5012
  - - C:\Temp\mkhfzupnhf.exe
      C:\Temp\mkhfzupnhf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5668
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4488
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkhfzupnhf.exe ups_ins
    3⤵
    PID:2240
  - - C:\Temp\i_mkhfzupnhf.exe
      C:\Temp\i_mkhfzupnhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhczxrpjhe.exe ups_run
    3⤵
    PID:1764
  - - C:\Temp\jhczxrpjhe.exe
      C:\Temp\jhczxrpjhe.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:976
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2980
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhczxrpjhe.exe ups_ins
    3⤵
    PID:4808
  - - C:\Temp\i_jhczxrpjhe.exe
      C:\Temp\i_jhczxrpjhe.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhezwrpjhb.exe ups_run
    3⤵
    PID:3596
  - - C:\Temp\mhezwrpjhb.exe
      C:\Temp\mhezwrpjhb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3128
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2944
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhezwrpjhb.exe ups_ins
    3⤵
    PID:4744
  - - C:\Temp\i_mhezwrpjhb.exe
      C:\Temp\i_mhezwrpjhb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljhbzwrpjh.exe ups_run
    3⤵
    PID:4088
  - - C:\Temp\ljhbzwrpjh.exe
      C:\Temp\ljhbzwrpjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2804
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3784
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljhbzwrpjh.exe ups_ins
    3⤵
    PID:4976
  - - C:\Temp\i_ljhbzwrpjh.exe
      C:\Temp\i_ljhbzwrpjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geyvtoljgb.exe ups_run
    3⤵
    PID:1340
  - - C:\Temp\geyvtoljgb.exe
      C:\Temp\geyvtoljgb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5212
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4696
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geyvtoljgb.exe ups_ins
    3⤵
    PID:1208
  - - C:\Temp\i_geyvtoljgb.exe
      C:\Temp\i_geyvtoljgb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqoidbvtnl.exe ups_run
    3⤵
    PID:5364
  - - C:\Temp\tqoidbvtnl.exe
      C:\Temp\tqoidbvtnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2016
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqoidbvtnl.exe ups_ins
    3⤵
    PID:5788
  - - C:\Temp\i_tqoidbvtnl.exe
      C:\Temp\i_tqoidbvtnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlidbysqni.exe ups_run
    3⤵
    PID:1960
  - - C:\Temp\nlidbysqni.exe
      C:\Temp\nlidbysqni.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4516
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2560
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlidbysqni.exe ups_ins
    3⤵
    PID:5052
  - - C:\Temp\i_nlidbysqni.exe
      C:\Temp\i_nlidbysqni.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcavsnlfdx.exe ups_run
    3⤵
    PID:3224
  - - C:\Temp\fcavsnlfdx.exe
      C:\Temp\fcavsnlfdx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1884
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3120
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcavsnlfdx.exe ups_ins
    3⤵
    PID:5472
  - - C:\Temp\i_fcavsnlfdx.exe
      C:\Temp\i_fcavsnlfdx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxvsqkhfc.exe ups_run
    3⤵
    PID:204
  - - C:\Temp\fzxvsqkhfc.exe
      C:\Temp\fzxvsqkhfc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2696
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4152
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4448
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffbd592c188,0x7ffbd592c194,0x7ffbd592c1a0
      4⤵
      PID:2724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,10781782250157309453,4734499039516237096,262144 --field-trial-handle=2608,i,9266604270734439342,15156467513588028516,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:2
      4⤵
      PID:2484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,15806945414398406258,12597133716834636783,524288 --field-trial-handle=2608,i,9266604270734439342,15156467513588028516,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:11
      4⤵
      System Time Discovery
      PID:1220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,12481225425977145286,9174917978431748814,524288 --field-trial-handle=2608,i,9266604270734439342,15156467513588028516,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:13
      4⤵
      PID:1412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,912023462274400365,5810469447538617197,2097152 --field-trial-handle=2608,i,9266604270734439342,15156467513588028516,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,15405052321431094930,9699283601359830673,2097152 --field-trial-handle=2608,i,9266604270734439342,15156467513588028516,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
      4⤵
      PID:3380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,11007810849789981579,9441994306571471288,2097152 --field-trial-handle=2608,i,9266604270734439342,15156467513588028516,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:9
      4⤵
      PID:1280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,8135452502014016216,8354920906490312251,2097152 --field-trial-handle=2608,i,9266604270734439342,15156467513588028516,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:1
      4⤵
      PID:4388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,3756154483753285207,9578293694770962383,524288 --field-trial-handle=2608,i,9266604270734439342,15156467513588028516,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:14
      4⤵
      PID:5884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,15199657116142049448,434641818703040604,524288 --field-trial-handle=2608,i,9266604270734439342,15156467513588028516,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
      4⤵
      PID:2040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,14694586557614852131,3640653328267301053,524288 --field-trial-handle=2608,i,9266604270734439342,15156467513588028516,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
      4⤵
      PID:4088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,8195029075489363999,5066376601821531253,524288 --field-trial-handle=2608,i,9266604270734439342,15156467513588028516,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:3128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,8195029075489363999,5066376601821531253,524288 --field-trial-handle=2608,i,9266604270734439342,15156467513588028516,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:1328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,6067754041378240382,12085685499256364785,524288 --field-trial-handle=2608,i,9266604270734439342,15156467513588028516,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
      4⤵
      PID:3508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,4717795652517271272,15695885688329719292,524288 --field-trial-handle=2608,i,9266604270734439342,15156467513588028516,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
      4⤵
      PID:1208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,2864827996318439307,3953969882450106773,524288 --field-trial-handle=2608,i,9266604270734439342,15156467513588028516,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:14
      4⤵
      PID:3648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,4341805814843061096,11802971272031014128,524288 --field-trial-handle=2608,i,9266604270734439342,15156467513588028516,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
      4⤵
      PID:3808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,17494123454537824447,843299984691873041,524288 --field-trial-handle=2608,i,9266604270734439342,15156467513588028516,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
      4⤵
      PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,111674402316592866,18124283562570966542,524288 --field-trial-handle=2608,i,9266604270734439342,15156467513588028516,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
      4⤵
      PID:5312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,3451982826435479474,16479957513947389571,524288 --field-trial-handle=2608,i,9266604270734439342,15156467513588028516,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
      4⤵
      PID:3884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,5650060673399255790,9354579191082067235,524288 --field-trial-handle=2608,i,9266604270734439342,15156467513588028516,262144 --variations-seed-version --mojo-platform-channel-handle=912 /prefetch:14
      4⤵
      PID:4548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,5815966969344321253,4102456322282113758,524288 --field-trial-handle=2608,i,9266604270734439342,15156467513588028516,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
      4⤵
      PID:5848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6732,i,17288864598853573210,15643198453338565964,262144 --field-trial-handle=2608,i,9266604270734439342,15156467513588028516,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:10
      4⤵
      PID:836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,1513235105400818629,8597701111003607804,524288 --field-trial-handle=2608,i,9266604270734439342,15156467513588028516,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
      4⤵
      PID:5152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:708

C:\Temp\vtnlgdyvqoigdyvt.sys
C:\Temp\vtnlgdyvqoigdyvt.sys
1⤵
- Executes dropped EXE
PID:5176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1164

C:\Temp\fdxvqnicav.sys
C:\Temp\fdxvqnicav.sys
1⤵
- Executes dropped EXE
PID:836

C:\Temp\vsnkfdavsm.sys
C:\Temp\vsnkfdavsm.sys
1⤵
- Executes dropped EXE
PID:5348

C:\Temp\khcausmkec.sys
C:\Temp\khcausmkec.sys
1⤵
- Executes dropped EXE
PID:4836

C:\Temp\hfcxupmkec.sys
C:\Temp\hfcxupmkec.sys
1⤵
- Executes dropped EXE
PID:5488

C:\Temp\jhezwurmjh.sys
C:\Temp\jhezwurmjh.sys
1⤵
- Executes dropped EXE
PID:2560

C:\Temp\ojgbztrljd.sys
C:\Temp\ojgbztrljd.sys
1⤵
- Executes dropped EXE
PID:5520

C:\Temp\wrojytrljd.sys
C:\Temp\wrojytrljd.sys
1⤵
- Executes dropped EXE
PID:4888

C:\Temp\gdyvqnljdb.sys
C:\Temp\gdyvqnljdb.sys
1⤵
- Executes dropped EXE
PID:4588

C:\Temp\vsqlfdxvqn.sys
C:\Temp\vsqlfdxvqn.sys
1⤵
- Executes dropped EXE
PID:1208

C:\Temp\kifaysqkic.sys
C:\Temp\kifaysqkic.sys
1⤵
- Executes dropped EXE
PID:2944

C:\Temp\nhfzxrpnhf.sys
C:\Temp\nhfzxrpnhf.sys
1⤵
PID:4684

C:\Temp\xupnhfzxsp.sys
C:\Temp\xupnhfzxsp.sys
1⤵
PID:3708

C:\Temp\jhczxrpmke.sys
C:\Temp\jhczxrpmke.sys
1⤵
PID:3792

C:\Temp\ljhbztrmje.sys
C:\Temp\ljhbztrmje.sys
1⤵
PID:5868

C:\Temp\gbywqolgdb.sys
C:\Temp\gbywqolgdb.sys
1⤵
PID:5964

C:\Temp\jdbvtolgdy.sys
C:\Temp\jdbvtolgdy.sys
1⤵
PID:5792

C:\Temp\qoifdbytql.sys
C:\Temp\qoifdbytql.sys
1⤵
PID:3392

C:\Temp\nlfdxvpnif.sys
C:\Temp\nlfdxvpnif.sys
1⤵
PID:1900

C:\Temp\hfaxsqkica.sys
C:\Temp\hfaxsqkica.sys
1⤵
PID:5544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aysqlfdavt.exe

Path C:\Temp\aysqlfdavt.exe
Size 376KB
SHA256 a714f9c58421e097600c6fac22c67d6ca26a154374aee366419cfae62d7bfa47
MD5 2dbd4a0133af5a31bfe713d88ff36b2c
SHA1 6ae4c9da1e93fe8633676ab543776217c8558679
SHA512 cb3f82c1ebbb807c78e682718aabdf5288a1b588ab6243c740d7d9c0e9a370ce4b8eda3329637468cc8e9ec661fe2cef4fa284eb36406f23622686ee2fa11469
SSDEEP 3072:QFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:QFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T152847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aytnlgdyvq.exe

Path C:\Temp\aytnlgdyvq.exe
Size 376KB
SHA256 3eeb5d62402fcf9b34562da44906c2b837c51d1307cb124116b1cd94ba36c32d
MD5 a1d7912b2edca5b2477b8afefddb31fd
SHA1 76dfb0c665c7091c4eddb7261077bda69ecd709f
SHA512 97f3d5419ba103984cd5ea707005ba66ab5c576bdac4bcf53afe3d2300d784aad111186d0cf7cdefecdad2d87bed803e19e9ef302cf64013a9d568ded970083a
SSDEEP 3072:ZFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ZFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11F847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czurmjhecw.exe

Path C:\Temp\czurmjhecw.exe
Size 376KB
SHA256 b2a34bdcaccd71d4f5c80a17845165813a766e6d54178a579c0d0abab369a112
MD5 4aa8f9b6cf4b206748913f11aa2bd053
SHA1 2245b3078a07c0b93d3573db91122a5032bc3fdc
SHA512 06252919f5b58a279391ec01e93bcc1df1ce91ad31c9402f0a901345663b12aa578fb592d4d983b7c69182974bcf018affa37d07b9a10f0c4bd612f34d4dc4e4
SSDEEP 3072:PFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:PFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16B847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvqnicav.sys

Path C:\Temp\fdxvqnicav.sys
Size 293KB
SHA256 2cbf5a55ac19a03ea164c39f8c0bf5bf5906292c330598a379b80b88d4dc080e
MD5 604380cb1d6ec7011614b65ed7f14cbe
SHA1 7baeb0ecb082bcfd79ae40b918250d55922c1a60
SHA512 4317b7059fd61e86e70e6c56c507d0da68be431765e4967b6b9e0344af5b2ebae09c5c772ec6ef7b19156bafa3076a8d89d2c6f16c36059797a2ee14935691a8
SSDEEP 3072:ItKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:IIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfcxupmkec.sys

Path C:\Temp\hfcxupmkec.sys
Size 293KB
SHA256 ca6bdfc074a416cf75cf4a3a8c1e7653c572b122bd7170ea35b2adcf9644dc29
MD5 730ba0d09af320e097da91afebe94861
SHA1 0e96a615e522f4c65030dc0102964ad8ac1cb37f
SHA512 9bab83ad66517548e8e77fb5c0bc03949f60e23c152d54de5748da6e344c647ca50a94625fbf5154ec1122e71874c4efbe00d1f6bf5f9b0dc98237ffea349728
SSDEEP 3072:qtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:qIJjiJcbI03GBc3ucY5DCSj
TLSH
T16F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aysqlfdavt.exe

Path C:\Temp\i_aysqlfdavt.exe
Size 376KB
SHA256 100ba99eefe95db994beb2d26dc1ee2cea99b0de8350f6ac258eb07e830142b7
MD5 4b2335ad297fa9e755dfdba6cde046ae
SHA1 04b67efdd64e2d076392019f4a77d21b20943564
SHA512 929ac366516611d8a88458163bd90865723b5c4b7dbe526309a79203949450788fa7c6c71cc5930c5e595f15cb4b3079561bcb04836522b922dca303ac087b51
SSDEEP 3072:QFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:QFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D3847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aytnlgdyvq.exe

Path C:\Temp\i_aytnlgdyvq.exe
Size 376KB
SHA256 e965aa420256d7cdf94a30ca5d6907569126c4d0944657e1f3015cf37ec942e2
MD5 6afc83bae4d580282b34ba9cb22634db
SHA1 40343c29b120f83eea20c8231559b0c0863b57be
SHA512 01c5dc9ca869e20487aa15ccd9154f35b0363b54903721a5ca7c14227e9a63cb277a132f5f33bfe3703d82e90badf1fde3ef15ea549cb5facac0a02062b3751f
SSDEEP 3072:WFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:WFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T184847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_czurmjhecw.exe

Path C:\Temp\i_czurmjhecw.exe
Size 376KB
SHA256 5448bf3c80133cda66ab11d7f1130a1e71f7d183865ce253907ced4256363779
MD5 b27191a908fb3fdd89b72ac5ca74a14a
SHA1 b8b4dca0cd3c0bfd53e205b8334a3267fe310c49
SHA512 e6925aac830863c88bbd796a4cd507e714f17a38d27fc3f57034f1de341d03bf740280076da221874ca7d4ec8a59e3b65d7d785ab4f84728aab0c02366901cc7
SSDEEP 3072:8FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:8FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C8847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kecxusnhfz.exe

Path C:\Temp\i_kecxusnhfz.exe
Size 376KB
SHA256 fb6ebef77462940dbbcc2ec31b02e03f6b8d14a31aaa98ba5b5a2e2aeec22900
MD5 a16aea7bf06e4455d0ee9737ecc00b8e
SHA1 5312c8565490d797da08615d2890de55ac2deb64
SHA512 ae169c5de712adc28ca88b7dd7d15ad14b29e2ef007e504ed174da56d54006f00219f6c20aa89a7a6f91761a8e746cc2b2d0548d9737bbdfee3dc4186a4956ef
SSDEEP 3072:yFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:yFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BD847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usqkifzxvp.exe

Path C:\Temp\i_usqkifzxvp.exe
Size 376KB
SHA256 d0580e54de0c69cdce501488a5adbf741cfb3c985b2d117640c5804910fc08d3
MD5 6a4b2aaebffc0c51185c02d82c140581
SHA1 b6a05ef7826ae9840d6445ce3437ff5037ff9d43
SHA512 3ef34c4d99e0398217e6c3f319dfc793ae87189cebd8c15e0c076f7839e55826997a163c9f124b9738ff71c601e443a4de45cf6fe4646eb6ce5cde0ce5abfca5
SSDEEP 3072:FFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:FFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D2847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhecwurmke.exe

Path C:\Temp\jhecwurmke.exe
Size 376KB
SHA256 c99adc1f4491311f05bf0f1f2a0ad3c550eac5eb591e6f3f381ab44b4d00c8d9
MD5 490d88666f4209178660bac7c852aecc
SHA1 cf23372dd37609975d96fb185020d675357bfc7f
SHA512 0979f18d72a979664a7228164f1057dd60e2e66ae021177369cc92a60f2c044830c09d2b77c7cd53469a1217569a200efceed19d9bceed220b546b9135cb68b2
SSDEEP 3072:NFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:NFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A9847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhezwurmjh.sys

Path C:\Temp\jhezwurmjh.sys
Size 293KB
SHA256 9e34efb50ba436b36a15acef720a27e3f2b5e08f36cdaf2c472229833df768da
MD5 ddea8e6cf2414f252f100dd416e9617a
SHA1 3ab61471fe6383f44739d357d3eb399999b0cf3e
SHA512 d626ad98599bb1d0658a784a653243999e4e477323640d02bfe411c736e9574ec1723ba0296242d628c0f3d94c4e1d3e73860b016e09dbbf5f008a998a8bd101
SSDEEP 3072:3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:3IJjiJcbI03GBc3ucY5DCSj
TLSH
T10D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecxusnhfz.exe

Path C:\Temp\kecxusnhfz.exe
Size 376KB
SHA256 aa9521bb43ef54f3d6d7253a20bffb837845d3a4ae5434c727019694013da8b6
MD5 b1b584d3154c9f21fa6590fa38ee1280
SHA1 a9ce5294484f8841844211230d01abba1c2dd804
SHA512 05053667042ccf7e1332ca415d5d591441b3879013fe6ea690ae92f24e5700f7bf99c8138c89740d4d3ffc2ff170573bc834e13628b1b3d30f0b63c10c16aa5d
SSDEEP 3072:0FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:0FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T150847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khcausmkec.sys

Path C:\Temp\khcausmkec.sys
Size 293KB
SHA256 4688edc0e907a1a20807ea4d3debdbfcf41c8054bbdff78ff93a578449dce4bc
MD5 b6a45c27a6fab384269f41b108ba07cd
SHA1 e9b29edc9478c6a79412146bf7253a0d9de94a09
SHA512 5c7ff971883dfb9c48fbc6b0d8ed6568d446a78f3bd6411b19f644297c71cccfe8b9177c6ef191b23014ea46e2ff752a95e2193afce3ceb71d7b0334612f32b7
SSDEEP 3072:LtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:LIJjiJcbI03GBc3ucY5DCSj
TLSH
T16C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usqkifzxvp.exe

Path C:\Temp\usqkifzxvp.exe
Size 376KB
SHA256 eadf3ea6951a1aff1f075058e7a99eac78c8b34e2bcb5ede08be529f958eb36c
MD5 f0c54f9d5c688b5a28863a3279e2533f
SHA1 5a3c108ceb9a6aa28d18bc3bded5382ea30f31a7
SHA512 d82ae480d3498c64e242a87e2b977c09c7a9acde3916ab69950cdfc3bbd8dc4306c44701aa16c573a78341d4bbd2e538cbb03d1dce157ed3c9350a32359702b6
SSDEEP 3072:qFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:qFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T161847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnkfdavsm.sys

Path C:\Temp\vsnkfdavsm.sys
Size 293KB
SHA256 cbde42a80229e761a636ad74df686aeb246e810e65fe3889d36bb6030f23585a
MD5 15c5cf576e63e5d873238e007801deb1
SHA1 1c0d661cbcdf7dd2749c34568905e89f0c5f7b82
SHA512 5bf26286120b155e206b8cd7c4c830867e8dc8a28cbae41e5a00643eda5dc9c7f8187ad327864c9250aa034dfaee5aa316be40e07c1291745134d14bc1597f97
SSDEEP 3072:itKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:iIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlgdyvqoigdyvt.exe

Path C:\Temp\vtnlgdyvqoigdyvt.exe
Size 376KB
SHA256 9aebefe8115b7d02bda559cec534b16154a04646736dc71f24f34e6afed58ddf
MD5 dda956875a88f70d42f8a283a725703f
SHA1 c90827ac48f97152dc07a3f6c8378cd85fd9d929
SHA512 0d846c0533a2c0b4449cf13b7c78b6c5f106b88322de8a8d227f363f1b1b5c08630cdc3e7a745ffd71d3dba512dfba902e91e7e36e321bf9e741148a7ad9ca60
SSDEEP 3072:bFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:bFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CA847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlgdyvqoigdyvt.sys

Path C:\Temp\vtnlgdyvqoigdyvt.sys
Size 293KB
SHA256 f3b3a7797bac4b340c0caa84dcf297de02981fab46026bfb7f22e51389003df1
MD5 95841960a40ac316217eff0e7c865418
SHA1 6ded3d9cceb614317939d55f6336ccc0e839b1b8
SHA512 84de25ac6f7bcc7679ded5580f2643e26bb454320080b7c8201aab6d519285f559a171d7dbac0be03377e153d92a3214f251b105cfa8a1656543ada6ad45e783
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2244a3b3757d1d2ea81aed0fd7aea553375916e7c5b713ba314f73b5407b32a6
MD5 ceb2e91e2dacccf37d0819c0e08076e1
SHA1 ad222eb92fa3b6fc6c1d24653b5fd685c7b06e33
SHA512 84e8a0890d8419be4a6f788845674b240d650201e8d7a832a120210e82ee1407a05355cdbc2f880a9211734801a60bb460d05efdd158d60b2b60aa6616fcf336
TLSH
T1EA61930C0B595DC2D7AF85B39FD8D44839FEC8D815072DA083F56E3844C6F2090D8197
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f0ee.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f0ee.TMP
Size 3KB
SHA256 0023550266b56428ea1b296d271ec02f7cc20229443b470371a2f5f9d5aa31b8
MD5 57ce3fa671f082fe1e4ee9c644051024
SHA1 d5a43c57003478de1d3daae6801545a71e604fad
SHA512 fd80473dca7291d7d3b6d231d46eecdefc18e2593874b190ad3d8f78f6baab53ed230b6c7c6346c483e0b6956d3c58b35a6783699c8790ca7111085c0af797b7
TLSH
T1A061724D0B9A5DC2D7AF89B39FD8E4583AFEC8D815072EA083F56E7844C6F2090D8197
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5eeb5b02d26b002f29e7b23dbbb7b3b4a6de482eee3af37239d3587677aeae36
MD5 456015ff8a5eab21413c39bc0ade5d4f
SHA1 de21d6f68077fcaf461efc4cfc53dd024f3e80bb
SHA512 140d0dd199ef457b9a4137ed4c0413df13c0cfaaad0e47d8310ec4cea6a66062bd4959cf330ff1b180c1aee653e7cde57fa2475a368df86274012db6a87930da
TLSH
T1B441C0F787F4966E890196F4AA146E1FCE1D0911432C7C5BC9E0AE2793E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a6098ecccd158b327e7433fdcde3de884a17f46374ef7815deead34da7bd030c
MD5 ddbda397e0bc5cc3e9fa0496afeed015
SHA1 3f157eaff56b0e839139aed284ec334631f036c1
SHA512 4049f0cbe6800267e53bc763d08d64914b71a3b00df7c626a948e2b51365ae73c56fb9f9c3019af7fea718890cc66048c56ec5b824b235c7a064c0f9bfd95e6d
SSDEEP 192:sxRXbR1Cc/fHss4TtnSZKvkdvZoxMzoA8p9w/g6+WNCJu/YEXm30GzHIgV2LnJ:sxRXb6c/fHssOtn0q9O/5//yLKJ
TLSH
T18C42B8166D28A93B9CC7E20DFB55BF53D7F9603261945E48AAFC8A1C04E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1a4455acca9ec7cb324ac2cc8b030a46aceae6d2c078e43e3f83114260cef750
MD5 8d1a8026c0a0c2eac6db98a1a8a9b29e
SHA1 444cd7c9b6cd7e67163e094ea650e7bc106809cc
SHA512 c581152af5b58543d06066b3807e4929c448f5878c0b87dfe60cb156fa054b4020c378c784343aea15fdf840f1426adea08d05cabff207f1000b93ce2942d780
SSDEEP 192:sxRQbR1Cc/fHsX4TtuTSZKvkdvZoxMzoA8p9w/g6+WNCJu/YE+A30GzHIgDC2LnJ:sxRQb6c/fHsXOtM0q9O/5//1LRJ
TLSH
T1A742B9166D24A93B9CC7E20DFB557F53D3F9603261941E48ABFC8A1C04E7ADD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b50641a3e0edbfbc2f18386f217b0ce3c28c59189136d410ad053f2e699dcc0b
MD5 4d4263ed2978bf9746d99a20e2a2832e
SHA1 f3f1d09a345cda49c2ddd0b1cbeafb9a4f845a3a
SHA512 31606989314dfdd379187d44e6244af34209f4b03b82d5083e33000eec7247e7307d6123d62a7db9862ea53a3c5c008dde7c01053b17bfaeab8f440d41bf4cdb
SSDEEP 192:sxRQbR1Cc/fHsX4TtnSZKvkdvZoxMzoA8p9w/g6+WNCJu/YEXm30GzHIgDw2LnJ:sxRQb6c/fHsXOtn0q9O/5//yLDJ
TLSH
T19C42C8166D28A93B9CC7E21DFB55BF53D3F9603261945E48AAFC8A1C04E7ADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 521b0507056717b664983c38f4989588d410bcd2f013cf443b4502bf803d86d7
MD5 20c5f48f4b9f518114aa74a928a2d68e
SHA1 f636305863759e16efd8a632394a0955dab47676
SHA512 d1154d75987147159fc56c018ee7263274b7b7adc244cbb748192c23b2f7fb1c9f0587e3df8b47519d0cfc9b461eae72a434abe309695dcb9b57e225b9d72f31
SSDEEP 768:40Dk6DJQD8AF7pLuL7N0DbWgQ6DjfIQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcW:40Dk6DJQD8ATE7N0DbWgQ6DjfIQDFu1n
TLSH
T1E3D2EB7B640CCB7F4F804ADDAD197A9E6DA802CB96D8C98047FE891C02C77EE51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e33c162f-60d8-46dd-ab02-f089149c664d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e33c162f-60d8-46dd-ab02-f089149c664d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1dcba20498673893a1db6a4f6ac746835c2febc9a4fbb1fbc6e498311d677cb3
MD5 1f54dfa53ce132d25e4864c524b8f98f
SHA1 ec8accd860b7b90297136cf43d8f8d5d2dcf5678
SHA512 d2d6748b3a898b7e5a0e6caa536393bd6809b6cce0bf1a1cbf72b26728c1fa84522403e00b3a6c7504d51aa2684778bd7eadbe8a3cce5a3f9fd4176c6ee482d2
SSDEEP 768:HL3YuwDTd+Z2yCwBeX6+qTko0u229a4vsTfPi9Pe:HL3JdfQvVTVKa4uPJ
TLSH
T18AF2BF31E8759C778DBAE78572562287AEB42173E5C41E48E9DDEA0D008756C2B0F83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 4d2c148e72a5e716de486bcd61717eba61cf13a2b592b1008ab52bb816105eb1
MD5 a673f5715fe034bf6885f03dc9d8786d
SHA1 f51969ec4a927032e219daca717583b57dbffa5e
SHA512 176d6dd067b19789e80d455e8daa5cfaaede526aefb7889fcac72f3c5e1048b009bb9155cb63bb3538c353725326319691e586ab38b0b9771eabb733731dcaa6
SSDEEP 768:prv+4UNbdG3WZCDTd+Z2yFeX6+qTko0u229a4vsDPeVH1SdW:pbsbU3KdkvVTVKa4GEH1h
TLSH
T10503CF32E86589778DE7D788724B75472FB92173C7880B80D8ED6B4D028B5AC230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 eec76ce3939092d14009ee053c9ffce098f8e3b981fa0662051a2d1e9d8a33c5
MD5 857bfc7fa9b6052fe52af8638a64746c
SHA1 f98a36282ccb22e3a815010d3d27c0ae08f14a2d
SHA512 e70889fa7efcfd04c98c6011287d399f04727b2b31bb0d67bdd912c3e9361ec734b0ab5435c1b1541f6c6fe906554b5d836eeefc18717350a7642853e5f71b3c
SSDEEP 768:OL3pJwDTd+Z2yCwteX6+qTko0u229a4vsTfPi9Pe:OL3Ndf8vVTVKa4uPJ
TLSH
T12AF2CF31F8759D7789BAE78472562287AEB42173E5C41E48E9DDEA0D008756C1B0FC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 056aa1d46c54b99468e07666420c897b3d6810f266b2816efe490cc511dc6ce4
MD5 5c619f5d6dc8f7e530f8ee93df4221b0
SHA1 12458ab9bd117b462c7740aa52f0db12d4ddb977
SHA512 5f156ad509ca6fc177a2b2f39975030fa2f0f31c0eb19cc37f2cb79071c8f801d4381504c07cfaf128bcc971b40ef2bfb9e37e991ef9807d2db30ea9f3998df1
SSDEEP 768:wrv+4UNbdG3temDTd+Z2yCw8eX6+qTko0u229a4vsSfeVH1SdW:wbsbU3edfLvVTVKa4hEH1h
TLSH
T1BE03BF32E4698D7789F7D684B14B72876F7821B38A840F84D8DDAB4D064B19C270F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 387ab36166820db7c926197ab7829df6537f84110e7cd4759777ce04142067c7
MD5 8b819790c489b9a144247dd958a3fc65
SHA1 4ce7ded2b74c9d2ec14762eab6486fd0c61f94e7
SHA512 157602fddd50f36ddda6770ba69792beb703c4fd540fc35d33b8575bf0a5050c7519ae0aca1c03f1a33448459c1e74a51d1da3dcaebfa8b140f09e4c61eaed16
SSDEEP 768:/FQa3nwgBWbnZ2yCwxeX6+qTko0u229a4vsTfPi9Pe:Ca3AdfAvVTVKa4uPJ
TLSH
T1B82339F198E38977D8AE9783633D2D469EBCD163B5885984B7C85D0CCC8617FC70A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

89edf008-f020-4173-89c1-be52e43e9544.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\89edf008-f020-4173-89c1-be52e43e9544.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2632_337484673\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 60974d76590fac7580ba0b7736a074ccf52ed3dc5039b071370ede52bddd0ad6
MD5 cc3a1d45f91642bfcf3f8cac3e06f6ff
SHA1 e0f85391a56efa6b73a488569df34184fc524e6e
SHA512 c7d5922990ef7a1cd19232a7f600db747841d4ae31c032176495ff198761535da274b542ac39aac0e58b86b5916e3e76fed982fcc8affd5510570d88d6ddb08a
TLSH
T10571238357ADD6B2C1DE5FF102835644F6FB22384B63703407A555CBAB70A3A58B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/836-185-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1208-335-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1900-471-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2560-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2560-285-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2944-364-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3392-467-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3708-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3792-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4588-330-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4684-384-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4684-406-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4836-260-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4888-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5176-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5348-232-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5488-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5520-310-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5544-488-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5792-446-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5868-442-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5868-429-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5964-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download