systex | ce177b3a2a40c4c599633b7b1dcf9fe64ae1d33a483b78c8e21f79ba592e564b

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 16:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260629-tf3cssay7j
SHA256 ce177b3a2a40c4c599633b7b1dcf9fe64ae1d33a483b78c8e21f79ba592e564b
MD5 530320711d10e83b6763ea21b614a7d9
SHA1 540b676fa17ec4571425649f5bc8f2a8a09dd415
SHA512 affd5c3782ed2d9efc4d24908ef240ecf2e8cf2a2f892d0212c9e3553e51a7edaff174754b33f157aab986411c4e8880d6cd43c4d531092f71a10bd889395d05
SSDEEP 6144:uflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:uflfAsiVGjSGecvX
TLSH
T105747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1224	bztomgeywrojhbzt.exe
4228	bztomgeywrojhbzt.sys
3348	CreateProcess.exe
5448	ebwtrojebt.exe
2984	CreateProcess.exe
1928	CreateProcess.exe
4384	i_ebwtrojebt.exe
2484	bvtolgeywq.sys
1232	CreateProcess.exe
2024	vtrojgeywq.exe
4988	CreateProcess.exe
4060	CreateProcess.exe
4992	i_vtrojgeywq.exe
5872	lgdbvtoigd.sys
6048	CreateProcess.exe
464	vtnlfdyvqo.exe
416	CreateProcess.exe
4108	CreateProcess.exe
1940	i_vtnlfdyvqo.exe
3256	CreateProcess.exe
5680	davtnligdy.exe
5288	CreateProcess.exe
2892	CreateProcess.exe
4312	i_davtnligdy.exe
2296	qkicaxvtnk.sys
1992	CreateProcess.exe
2568	pnlfdavsnl.exe
1628	CreateProcess.exe
5124	CreateProcess.exe
2716	i_pnlfdavsnl.exe
4120	axsqkausnk.sys
2016	CreateProcess.exe
5364	smkfcxvpnk.exe
3188	CreateProcess.exe
1236	CreateProcess.exe
1252	i_smkfcxvpnk.exe
980	kfcxupmkfc.sys
4448	CreateProcess.exe
548	kecxupnhfz.exe
3580	CreateProcess.exe
1260	CreateProcess.exe
1776	i_kecxupnhfz.exe
4528	uomkezwusp.sys
6136	CreateProcess.exe
2800	uomhfzxrpj.exe
3696	CreateProcess.exe
120	CreateProcess.exe
2612	i_uomhfzxrpj.exe
4376	hezwupmhez.sys
4784	CreateProcess.exe
1472	bztrmjebwu.exe
2136	CreateProcess.exe
3800	CreateProcess.exe
6076	i_bztrmjebwu.exe
3880	mjecwuomge.sys
5432	CreateProcess.exe
3920	bwtrojgeyw.exe
3016	CreateProcess.exe
2308	CreateProcess.exe
3180	i_bwtrojgeyw.exe
5888	omgebvtrom.sys
1920	CreateProcess.exe
3812	roljdbvtrl.exe
3728	CreateProcess.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1308_2001604096\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1308_1767393444\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1308_1767393444\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurmjecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbzurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qljdbytqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnlgdyvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnlgdyvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkfcxvpnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxvpnhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrmjebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxvpnhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwupmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywrojhbywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkfcxvpnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbzurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_roljdbvtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztomgeywrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwtrojebt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnligdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrmjebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqkicaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axvsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnlfdavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtrojgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	roljdbvtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axvsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljdbytqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtrojgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnligdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqkicaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwupmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurmjecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtrojgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywrojhbywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwtrojebt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnlfdavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtrojgeyw.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5840	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5320	ipconfig.exe
3544	ipconfig.exe
2432	ipconfig.exe
3232	ipconfig.exe
4968	ipconfig.exe
1124	ipconfig.exe
4416	ipconfig.exe
1716	ipconfig.exe
1080	ipconfig.exe
4992	ipconfig.exe
4120	ipconfig.exe
5016	ipconfig.exe
4660	ipconfig.exe
4328	ipconfig.exe
2760	ipconfig.exe
1832	ipconfig.exe
5620	ipconfig.exe
3036	ipconfig.exe
256	ipconfig.exe
4120	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3865087520-2734723108-1233268525-1000\{7162A9B0-9BDE-43C2-999D-C9B3CE944FD7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1224	bztomgeywrojhbzt.exe
1224	bztomgeywrojhbzt.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1224	bztomgeywrojhbzt.exe
1224	bztomgeywrojhbzt.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1224	bztomgeywrojhbzt.exe
1224	bztomgeywrojhbzt.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1224	bztomgeywrojhbzt.exe
1224	bztomgeywrojhbzt.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1224	bztomgeywrojhbzt.exe
1224	bztomgeywrojhbzt.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1224	bztomgeywrojhbzt.exe
1224	bztomgeywrojhbzt.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1224	bztomgeywrojhbzt.exe
1224	bztomgeywrojhbzt.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4384	i_ebwtrojebt.exe
Token: SeDebugPrivilege	4992	i_vtrojgeywq.exe
Token: SeDebugPrivilege	4312	i_davtnligdy.exe
Token: SeDebugPrivilege	2716	i_pnlfdavsnl.exe
Token: SeDebugPrivilege	1252	i_smkfcxvpnk.exe
Token: SeDebugPrivilege	1776	i_kecxupnhfz.exe
Token: SeDebugPrivilege	2612	i_uomhfzxrpj.exe
Token: SeDebugPrivilege	6076	i_bztrmjebwu.exe
Token: SeDebugPrivilege	3180	i_bwtrojgeyw.exe
Token: SeDebugPrivilege	1764	i_roljdbvtrl.exe
Token: SeDebugPrivilege	5800	i_vqnlgdyvto.exe
Token: SeDebugPrivilege	452	i_vsqkicaysq.exe
Token: SeDebugPrivilege	1136	i_axvsqkicau.exe
Token: SeDebugPrivilege	3104	i_faxvpnhcau.exe
Token: SeDebugPrivilege	1296	i_mkecwupmke.exe
Token: SeDebugPrivilege	5268	i_wurmjecwup.exe
Token: SeDebugPrivilege	3116	i_rpjhbzurmj.exe
Token: SeDebugPrivilege	1528	i_ywrojhbywt.exe
Token: SeDebugPrivilege	1500	i_qljdbytqoi.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1308	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 1224	4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 4696 wrote to memory of 2948	4696	2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 2948 wrote to memory of 1308	2948	iexplore.exe	89
PID 1308 wrote to memory of 5604	1308	msedge.exe	90
PID 1308 wrote to memory of 1000	1308	msedge.exe	91
PID 1308 wrote to memory of 5840	1308	msedge.exe	92
PID 1308 wrote to memory of 1000	1308	msedge.exe	91
PID 1308 wrote to memory of 1000	1308	msedge.exe	91
PID 1308 wrote to memory of 2864	1308	msedge.exe	93
PID 1308 wrote to memory of 2864	1308	msedge.exe	93
PID 1308 wrote to memory of 5660	1308	msedge.exe	95
PID 1308 wrote to memory of 5496	1308	msedge.exe	96
PID 1308 wrote to memory of 5660	1308	msedge.exe	95
PID 1308 wrote to memory of 5660	1308	msedge.exe	95
PID 1308 wrote to memory of 5496	1308	msedge.exe	96
PID 1308 wrote to memory of 5496	1308	msedge.exe	96
PID 1308 wrote to memory of 3576	1308	msedge.exe	97
PID 1308 wrote to memory of 5576	1308	msedge.exe	98
PID 1308 wrote to memory of 3576	1308	msedge.exe	97
PID 1308 wrote to memory of 3576	1308	msedge.exe	97
PID 1308 wrote to memory of 5576	1308	msedge.exe	98
PID 1308 wrote to memory of 5576	1308	msedge.exe	98
PID 1308 wrote to memory of 3916	1308	msedge.exe	99
PID 1308 wrote to memory of 3916	1308	msedge.exe	99
PID 1308 wrote to memory of 3916	1308	msedge.exe	99
PID 1308 wrote to memory of 680	1308	msedge.exe	100
PID 1308 wrote to memory of 680	1308	msedge.exe	100
PID 1308 wrote to memory of 4956	1308	msedge.exe	102
PID 1308 wrote to memory of 4956	1308	msedge.exe	102
PID 1308 wrote to memory of 4956	1308	msedge.exe	102
PID 1224 wrote to memory of 3348	1224	bztomgeywrojhbzt.exe	105
PID 5448 wrote to memory of 2984	5448	ebwtrojebt.exe	108
PID 1308 wrote to memory of 4508	1308	msedge.exe	111
PID 1308 wrote to memory of 2208	1308	msedge.exe	112
PID 1308 wrote to memory of 4508	1308	msedge.exe	111
PID 1308 wrote to memory of 2208	1308	msedge.exe	112
PID 1308 wrote to memory of 4460	1308	msedge.exe	114
PID 1308 wrote to memory of 1616	1308	msedge.exe	115
PID 1308 wrote to memory of 1616	1308	msedge.exe	115
PID 1308 wrote to memory of 776	1308	msedge.exe	116
PID 1308 wrote to memory of 776	1308	msedge.exe	116
PID 1224 wrote to memory of 1928	1224	bztomgeywrojhbzt.exe	119
PID 1224 wrote to memory of 1232	1224	bztomgeywrojhbzt.exe	123
PID 2024 wrote to memory of 4988	2024	vtrojgeywq.exe	125
PID 1224 wrote to memory of 4060	1224	bztomgeywrojhbzt.exe	128
PID 1224 wrote to memory of 6048	1224	bztomgeywrojhbzt.exe	132
PID 464 wrote to memory of 416	464	vtnlfdyvqo.exe	134
PID 1224 wrote to memory of 4108	1224	bztomgeywrojhbzt.exe	137
PID 1224 wrote to memory of 3256	1224	bztomgeywrojhbzt.exe	139
PID 5680 wrote to memory of 5288	5680	davtnligdy.exe	141
PID 1224 wrote to memory of 2892	1224	bztomgeywrojhbzt.exe	144
PID 1308 wrote to memory of 1688	1308	msedge.exe	146
PID 1308 wrote to memory of 4624	1308	msedge.exe	147
PID 1308 wrote to memory of 244	1308	msedge.exe	148
PID 1224 wrote to memory of 1992	1224	bztomgeywrojhbzt.exe	151
PID 2568 wrote to memory of 1628	2568	pnlfdavsnl.exe	153
PID 1224 wrote to memory of 5124	1224	bztomgeywrojhbzt.exe	156
PID 1224 wrote to memory of 2016	1224	bztomgeywrojhbzt.exe	160
PID 5364 wrote to memory of 3188	5364	smkfcxvpnk.exe	162
PID 1224 wrote to memory of 1236	1224	bztomgeywrojhbzt.exe	165
PID 1224 wrote to memory of 4448	1224	bztomgeywrojhbzt.exe	169
PID 548 wrote to memory of 3580	548	kecxupnhfz.exe	171
PID 1224 wrote to memory of 1260	1224	bztomgeywrojhbzt.exe	174
PID 1224 wrote to memory of 6136	1224	bztomgeywrojhbzt.exe	178

C:\Users\Admin\AppData\Local\Temp\2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_530320711d10e83b6763ea21b614a7d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Temp\bztomgeywrojhbzt.exe
  C:\Temp\bztomgeywrojhbzt.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwtrojebt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3348
  - - C:\Temp\ebwtrojebt.exe
      C:\Temp\ebwtrojebt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5448
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2984
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebwtrojebt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1928
  - - C:\Temp\i_ebwtrojebt.exe
      C:\Temp\i_ebwtrojebt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtrojgeywq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1232
  - - C:\Temp\vtrojgeywq.exe
      C:\Temp\vtrojgeywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2024
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4988
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtrojgeywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4060
  - - C:\Temp\i_vtrojgeywq.exe
      C:\Temp\i_vtrojgeywq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlfdyvqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6048
  - - C:\Temp\vtnlfdyvqo.exe
      C:\Temp\vtnlfdyvqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:416
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlfdyvqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4108
  - - C:\Temp\i_vtnlfdyvqo.exe
      C:\Temp\i_vtnlfdyvqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\davtnligdy.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3256
  - - C:\Temp\davtnligdy.exe
      C:\Temp\davtnligdy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5680
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5288
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_davtnligdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2892
  - - C:\Temp\i_davtnligdy.exe
      C:\Temp\i_davtnligdy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4312
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnlfdavsnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1992
  - - C:\Temp\pnlfdavsnl.exe
      C:\Temp\pnlfdavsnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1628
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnlfdavsnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5124
  - - C:\Temp\i_pnlfdavsnl.exe
      C:\Temp\i_pnlfdavsnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkfcxvpnk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2016
  - - C:\Temp\smkfcxvpnk.exe
      C:\Temp\smkfcxvpnk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5364
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3188
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkfcxvpnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1236
  - - C:\Temp\i_smkfcxvpnk.exe
      C:\Temp\i_smkfcxvpnk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kecxupnhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4448
  - - C:\Temp\kecxupnhfz.exe
      C:\Temp\kecxupnhfz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:548
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3580
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kecxupnhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1260
  - - C:\Temp\i_kecxupnhfz.exe
      C:\Temp\i_kecxupnhfz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomhfzxrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6136
  - - C:\Temp\uomhfzxrpj.exe
      C:\Temp\uomhfzxrpj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2800
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3696
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomhfzxrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:120
  - - C:\Temp\i_uomhfzxrpj.exe
      C:\Temp\i_uomhfzxrpj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrmjebwu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4784
  - - C:\Temp\bztrmjebwu.exe
      C:\Temp\bztrmjebwu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1472
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2136
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrmjebwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3800
  - - C:\Temp\i_bztrmjebwu.exe
      C:\Temp\i_bztrmjebwu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtrojgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5432
  - - C:\Temp\bwtrojgeyw.exe
      C:\Temp\bwtrojgeyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3920
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3016
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwtrojgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2308
  - - C:\Temp\i_bwtrojgeyw.exe
      C:\Temp\i_bwtrojgeyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\roljdbvtrl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1920
  - - C:\Temp\roljdbvtrl.exe
      C:\Temp\roljdbvtrl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3812
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3728
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_roljdbvtrl.exe ups_ins
    3⤵
    PID:5932
  - - C:\Temp\i_roljdbvtrl.exe
      C:\Temp\i_roljdbvtrl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vqnlgdyvto.exe ups_run
    3⤵
    PID:5020
  - - C:\Temp\vqnlgdyvto.exe
      C:\Temp\vqnlgdyvto.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2536
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4968
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vqnlgdyvto.exe ups_ins
    3⤵
    PID:3184
  - - C:\Temp\i_vqnlgdyvto.exe
      C:\Temp\i_vqnlgdyvto.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsqkicaysq.exe ups_run
    3⤵
    PID:4548
  - - C:\Temp\vsqkicaysq.exe
      C:\Temp\vsqkicaysq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:460
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1996
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsqkicaysq.exe ups_ins
    3⤵
    PID:1188
  - - C:\Temp\i_vsqkicaysq.exe
      C:\Temp\i_vsqkicaysq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axvsqkicau.exe ups_run
    3⤵
    PID:1128
  - - C:\Temp\axvsqkicau.exe
      C:\Temp\axvsqkicau.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:204
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4748
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axvsqkicau.exe ups_ins
    3⤵
    PID:1796
  - - C:\Temp\i_axvsqkicau.exe
      C:\Temp\i_axvsqkicau.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faxvpnhcau.exe ups_run
    3⤵
    PID:2312
  - - C:\Temp\faxvpnhcau.exe
      C:\Temp\faxvpnhcau.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4584
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1384
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faxvpnhcau.exe ups_ins
    3⤵
    PID:4156
  - - C:\Temp\i_faxvpnhcau.exe
      C:\Temp\i_faxvpnhcau.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkecwupmke.exe ups_run
    3⤵
    PID:4208
  - - C:\Temp\mkecwupmke.exe
      C:\Temp\mkecwupmke.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:980
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5620
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkecwupmke.exe ups_ins
    3⤵
    PID:2140
  - - C:\Temp\i_mkecwupmke.exe
      C:\Temp\i_mkecwupmke.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wurmjecwup.exe ups_run
    3⤵
    PID:1800
  - - C:\Temp\wurmjecwup.exe
      C:\Temp\wurmjecwup.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2460
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1584
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wurmjecwup.exe ups_ins
    3⤵
    PID:704
  - - C:\Temp\i_wurmjecwup.exe
      C:\Temp\i_wurmjecwup.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhbzurmj.exe ups_run
    3⤵
    PID:3028
  - - C:\Temp\rpjhbzurmj.exe
      C:\Temp\rpjhbzurmj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5424
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2192
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhbzurmj.exe ups_ins
    3⤵
    PID:4252
  - - C:\Temp\i_rpjhbzurmj.exe
      C:\Temp\i_rpjhbzurmj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywrojhbywt.exe ups_run
    3⤵
    PID:3760
  - - C:\Temp\ywrojhbywt.exe
      C:\Temp\ywrojhbywt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4660
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4180
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywrojhbywt.exe ups_ins
    3⤵
    PID:5992
  - - C:\Temp\i_ywrojhbywt.exe
      C:\Temp\i_ywrojhbywt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qljdbytqoi.exe ups_run
    3⤵
    PID:2020
  - - C:\Temp\qljdbytqoi.exe
      C:\Temp\qljdbytqoi.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1192
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1588
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qljdbytqoi.exe ups_ins
    3⤵
    PID:4296
  - - C:\Temp\i_qljdbytqoi.exe
      C:\Temp\i_qljdbytqoi.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1500
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffde3c3c188,0x7ffde3c3c194,0x7ffde3c3c1a0
      4⤵
      PID:5604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,1322613319261987725,5203720160793347664,262144 --field-trial-handle=2560,i,10722393763023207716,3374300736451219972,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:2
      4⤵
      PID:1000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,10896278774214217447,13875002387020819865,524288 --field-trial-handle=2560,i,10722393763023207716,3374300736451219972,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:11
      4⤵
      System Time Discovery
      PID:5840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,3397173277927984590,12700663153113360633,524288 --field-trial-handle=2560,i,10722393763023207716,3374300736451219972,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:13
      4⤵
      PID:2864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3660,i,8787466643573844414,11500059042927803744,2097152 --field-trial-handle=2560,i,10722393763023207716,3374300736451219972,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
      4⤵
      PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3648,i,15616547016100673246,1324282746546421687,2097152 --field-trial-handle=2560,i,10722393763023207716,3374300736451219972,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
      4⤵
      PID:5496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,11129189148484853082,5578827702958433350,2097152 --field-trial-handle=2560,i,10722393763023207716,3374300736451219972,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
      4⤵
      PID:3576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,12122981193941126814,9549927753835476703,2097152 --field-trial-handle=2560,i,10722393763023207716,3374300736451219972,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:9
      4⤵
      PID:5576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5404,i,12047181212968900389,4629729960414353748,2097152 --field-trial-handle=2560,i,10722393763023207716,3374300736451219972,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:1
      4⤵
      PID:3916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,7865414253390622864,9705124845638834345,524288 --field-trial-handle=2560,i,10722393763023207716,3374300736451219972,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
      4⤵
      PID:680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3732,i,7232484196972411273,6062476259436298299,2097152 --field-trial-handle=2560,i,10722393763023207716,3374300736451219972,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
      4⤵
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,16956314624746558102,1102081592685046464,524288 --field-trial-handle=2560,i,10722393763023207716,3374300736451219972,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
      4⤵
      PID:4508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,6441760313456425111,6715341773846605620,524288 --field-trial-handle=2560,i,10722393763023207716,3374300736451219972,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
      4⤵
      PID:2208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,11475691364439306792,17795294132069975254,524288 --field-trial-handle=2560,i,10722393763023207716,3374300736451219972,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:1748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,11475691364439306792,17795294132069975254,524288 --field-trial-handle=2560,i,10722393763023207716,3374300736451219972,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,8563451043388291164,16249588663355401233,524288 --field-trial-handle=2560,i,10722393763023207716,3374300736451219972,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
      4⤵
      PID:1616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,2214792870420032719,8251599171339312997,524288 --field-trial-handle=2560,i,10722393763023207716,3374300736451219972,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
      4⤵
      PID:776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,10542002994007853835,7455056886408323690,524288 --field-trial-handle=2560,i,10722393763023207716,3374300736451219972,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
      4⤵
      PID:1688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,716869979122425749,1650505967068349028,524288 --field-trial-handle=2560,i,10722393763023207716,3374300736451219972,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
      4⤵
      PID:4624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3928,i,17825882279478580654,1218097841074280062,524288 --field-trial-handle=2560,i,10722393763023207716,3374300736451219972,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
      4⤵
      PID:244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,17182950690728305825,2051446802940227738,524288 --field-trial-handle=2560,i,10722393763023207716,3374300736451219972,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
      4⤵
      PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,12979723736116982611,16254434564298366943,524288 --field-trial-handle=2560,i,10722393763023207716,3374300736451219972,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:14
      4⤵
      PID:4920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6308,i,1624520432160800508,7165491563302278524,262144 --field-trial-handle=2560,i,10722393763023207716,3374300736451219972,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:10
      4⤵
      PID:5188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,9659683715123247623,12377856829885249766,524288 --field-trial-handle=2560,i,10722393763023207716,3374300736451219972,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:14
      4⤵
      PID:552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3100

C:\Temp\bztomgeywrojhbzt.sys
C:\Temp\bztomgeywrojhbzt.sys
1⤵
- Executes dropped EXE
PID:4228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:120

C:\Temp\bvtolgeywq.sys
C:\Temp\bvtolgeywq.sys
1⤵
- Executes dropped EXE
PID:2484

C:\Temp\lgdbvtoigd.sys
C:\Temp\lgdbvtoigd.sys
1⤵
- Executes dropped EXE
PID:5872

C:\Temp\qkicaxvtnk.sys
C:\Temp\qkicaxvtnk.sys
1⤵
- Executes dropped EXE
PID:2296

C:\Temp\axsqkausnk.sys
C:\Temp\axsqkausnk.sys
1⤵
- Executes dropped EXE
PID:4120

C:\Temp\kfcxupmkfc.sys
C:\Temp\kfcxupmkfc.sys
1⤵
- Executes dropped EXE
PID:980

C:\Temp\uomkezwusp.sys
C:\Temp\uomkezwusp.sys
1⤵
- Executes dropped EXE
PID:4528

C:\Temp\hezwupmhez.sys
C:\Temp\hezwupmhez.sys
1⤵
- Executes dropped EXE
PID:4376

C:\Temp\mjecwuomge.sys
C:\Temp\mjecwuomge.sys
1⤵
- Executes dropped EXE
PID:3880

C:\Temp\omgebvtrom.sys
C:\Temp\omgebvtrom.sys
1⤵
- Executes dropped EXE
PID:5888

C:\Temp\bysqoigavt.sys
C:\Temp\bysqoigavt.sys
1⤵
PID:4228

C:\Temp\aysqkidays.sys
C:\Temp\aysqkidays.sys
1⤵
PID:5328

C:\Temp\nlfdxvpnif.sys
C:\Temp\nlfdxvpnif.sys
1⤵
PID:6100

C:\Temp\fdxsqkhfau.sys
C:\Temp\fdxsqkhfau.sys
1⤵
PID:6088

C:\Temp\pnhfcxupnh.sys
C:\Temp\pnhfcxupnh.sys
1⤵
PID:5336

C:\Temp\czxupmkecw.sys
C:\Temp\czxupmkecw.sys
1⤵
PID:5480

C:\Temp\rpmjecwrpm.sys
C:\Temp\rpmjecwrpm.sys
1⤵
PID:1500

C:\Temp\bztrljebwu.sys
C:\Temp\bztrljebwu.sys
1⤵
PID:2744

C:\Temp\vtnlgdywqo.sys
C:\Temp\vtnlgdywqo.sys
1⤵
PID:2828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

axsqkausnk.sys

Path C:\Temp\axsqkausnk.sys
Size 293KB
SHA256 53adfe7947c109e5c6a8f65b18acfb315e2a662f76b9614ad97d06f79a2e481c
MD5 0cf34a919c2c10db017bede20c13d8e4
SHA1 a8a0aacb8dcaa3b24c0117d44bc5f2e6b29b3aec
SHA512 91482200916c785526568688ab3decc7d210a4ebe703662c9905a85b34a8bb5e5bbfdfc8540eef9785395572899bd506808dcf6140585fb422d62f82eb89cdde
SSDEEP 3072:8tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:8IJjiJcbI03GBc3ucY5DCSj
TLSH
T173545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtolgeywq.sys

Path C:\Temp\bvtolgeywq.sys
Size 293KB
SHA256 c523c0de547d3a275c22b12c89c22987c0915f80eba862225b79bef1049131e7
MD5 b6adfb780e5e672e2993612fbe0938bb
SHA1 685e3a344a2354eac01242222f8bfc27920adf74
SHA512 484c0eb8b19c761c274292c66cc5697ff5dd398296fc81748212a595e20d3c9530f26be5b366939481ebbd329d3ed269a4684f2f0e23b004ba333e544e6a0870
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T13A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztomgeywrojhbzt.exe

Path C:\Temp\bztomgeywrojhbzt.exe
Size 361KB
SHA256 4c25ff4094556926513b0e774878aea51c813834b3e1ae7c41bc8ae284303e37
MD5 53c23961653dc11d5c18bc7e70ba12f9
SHA1 bc6e1a5b6e0f4f7093bd47646b741bc58ffab414
SHA512 d6dd21894ef762d3d81e48859b0e1961fc3bf9f4566c2c15c61e208fc0b49579f0c85502badbf37d295546db3333eaac9d37764b0c86c4d95c46aed3b46dcd8d
SSDEEP 6144:2flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:2flfAsiVGjSGecvX
TLSH
T1A6747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztomgeywrojhbzt.sys

Path C:\Temp\bztomgeywrojhbzt.sys
Size 293KB
SHA256 8f02a6b5f779e0fa9256c9e75b6ada011ebb4b171a133caa21c6d13c21a0ea29
MD5 e1c04d3d6181e84ceb293ba26311367b
SHA1 8947566c87ffbbddd3c94a9059adcdb19ef60077
SHA512 ed9c34b3bc75ed1090268f638fad6e3a432fe150b115b5d51d2f53f39adbd3cef74c8d23f414d8ca9b5b9841112207cc5ff7b7aee0c35c7e5efbc305f1f6f70a
SSDEEP 3072:ltKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:lIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

davtnligdy.exe

Path C:\Temp\davtnligdy.exe
Size 361KB
SHA256 4a82746a4548d72fdc3011327c6dc109ae140a300fe497a09543f8f1f145ed98
MD5 877f5a4b942486b9cfba2db65f04185a
SHA1 cba51496ebec12dc1daf7c9fcce5dde56fe5d292
SHA512 fda7ab6438ca86aa467270e3d570c5d23d8f5a64201c9b50afbcee2230838855ac4082569c0ab6d9823ba86d5d334c6ef71d1bc85b8ef2b9b40b0270759756e1
SSDEEP 6144:oflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:oflfAsiVGjSGecvX
TLSH
T1CD747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwtrojebt.exe

Path C:\Temp\ebwtrojebt.exe
Size 361KB
SHA256 6bcf2777a830e3cbfcbd50b0b39aa4ce0ace15d362955e50c0b6b45d726f3bb0
MD5 56251012e996a855d826738dbd6171dc
SHA1 fdd5419c8a1ca9aa05da0e7d9c7032cf6caae9e8
SHA512 3b3d28738777bf768b1a580b393da306ffc1185fa42e5b9e4d8cf44fb47cb4acf9cf8d697512e338ea359ce6a6954e83a8a302778d6e604c078b136ee27ffbb2
SSDEEP 6144:+flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:+flfAsiVGjSGecvX
TLSH
T17B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_davtnligdy.exe

Path C:\Temp\i_davtnligdy.exe
Size 361KB
SHA256 25c4868b68603d08179127ca1f7fa59085bc8676e49464d9b230a320b4bcc001
MD5 a6f374f439383bbf30b04f31f269e66d
SHA1 76759e14c856755fce02093b5e63abb90b7ee683
SHA512 bca187afbecf3a0c71eaceb11b952487b812bd41fa4dcc2ea05edf14a125553730fb5bf39835750c011f7b6aa3ba4a05bcffcf6864b519d7ef2c30d1762379cf
SSDEEP 6144:XflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:XflfAsiVGjSGecvX
TLSH
T1DC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ebwtrojebt.exe

Path C:\Temp\i_ebwtrojebt.exe
Size 361KB
SHA256 091d0b4147a6b4ea88e3e33bb4ce9e08c2bcf57d9580c2bdc013ae5edf70417b
MD5 d820ea15776b4b21dc2773ef8fe69d2a
SHA1 a1a55ecac11c9c74797891b0c83bb1a36c267882
SHA512 bbde31a0d3169fea0416abbd2c89b26f4a7094785f3103edbade96e31bfc2dc948e6344cbef705642542215923e0920afeedc4bffcd7b1613e21dfeb78bf5572
SSDEEP 6144:KflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:KflfAsiVGjSGecvX
TLSH
T1BC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnlfdavsnl.exe

Path C:\Temp\i_pnlfdavsnl.exe
Size 361KB
SHA256 6cb14f40a60ac4a6761650a45f48b0922eaa825038b61cf3a01ab4d7626ea69f
MD5 b31a48cd338da139a8fc44cf8fcccbf8
SHA1 5721fdc9d4b0ec4870eceb25a908a5acfa9bc85e
SHA512 172c449b3b6601a9ee0195fd98582ca3e0c1f0d914aba2e99aa50da023cec21129b1c5c89d0aa134fece93b746b8f0b0ff7394b4850162d29fa75ac85bd45d3a
SSDEEP 6144:pflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:pflfAsiVGjSGecvX
TLSH
T1B7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtnlfdyvqo.exe

Path C:\Temp\i_vtnlfdyvqo.exe
Size 361KB
SHA256 367a47b42f9d15bd80f976c2c631a4813ae71e707adacf7e47d8b571bf114b78
MD5 63137e2b3f0a36bcf8340b3248c83367
SHA1 46833932d1574c879a0eeeae591a02bbf621b961
SHA512 f1457d8a42c808a82ac1584841e2ecf13a68b913decd7905f626dbcb48857026bae9a67177fb63ecd7aea902b40031510ae4416bf39e470dec51b6ffe90d42c1
SSDEEP 6144:BflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:BflfAsiVGjSGecvX
TLSH
T118747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtrojgeywq.exe

Path C:\Temp\i_vtrojgeywq.exe
Size 361KB
SHA256 47d38c963401ca76207df9f8f96c9fb8cb53a94cb427d58a14f7e72ef48df928
MD5 1d4887ebeb286de688d7c7ceb1a1847f
SHA1 be5a80f0fe0bddbcddb7ef7ad48a1eeb6398bc21
SHA512 11ee143c7adf69e2d2ef534adfc1cd508737a232d4e24179e85cd585a17aeb480efcab2b1ae6f2dc523d35c38b574864ae8fdcc6607576d44490f4a1d1edd9b6
SSDEEP 6144:yflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:yflfAsiVGjSGecvX
TLSH
T1C6747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdbvtoigd.sys

Path C:\Temp\lgdbvtoigd.sys
Size 293KB
SHA256 33c9f1b39e9f9eb29a4afb4287909231bfa906b925edd932b323c3ea3107a0b3
MD5 19ca88b1f6335effdbe11a769bc9a58b
SHA1 b214fc7896c2511b22848a22b4afaa0fb8da642d
SHA512 2cc49b9a60b03049984801342f6e01be1cf210534109ef232374352e9fbc9e1430255c7f6acb97e6dea132743f395012b309f99d162f48886500575a8c1f46ab
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnlfdavsnl.exe

Path C:\Temp\pnlfdavsnl.exe
Size 361KB
SHA256 460fabf011d91b44c60e08bb4ab61a8ac79f9cdaba9204c136377d0c3c072f3e
MD5 cff8646b283cf4e0fcf972bb9b3b8c0d
SHA1 1c03ef9a979b2257d2043994ac7916dc6f756fd3
SHA512 d400a1ee4205e8074a95f34f42a48d1847d0c1a8b961408469d2820304037a842e97200ddebb4ca1cd2eaad611dbb99c10eed50e48738eb3b3ed72e62ace2da0
SSDEEP 6144:8flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:8flfAsiVGjSGecvX
TLSH
T1AD747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkicaxvtnk.sys

Path C:\Temp\qkicaxvtnk.sys
Size 293KB
SHA256 eef458c901a03c40d470a81f93521e2b9592802c3ebb8f0b11c9c87b3e170796
MD5 9e39930bd25a4751c2f525b0fe145d2e
SHA1 4c2dd57d3cea65a60d697d4d672656c5c376fe0c
SHA512 5a612a381905897b3726a95092b78f4e038729956517c45a60e4279f2095e7dd2a930468676daa51867fbe5a4c92d5c8e57b63a0653e4c5527f57bd331abfa41
SSDEEP 3072:rtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:rIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkfcxvpnk.exe

Path C:\Temp\smkfcxvpnk.exe
Size 361KB
SHA256 578c6ce61f598ddeeff662130df80e633313f07c50bedcb1dd070b3c9ab6f4f5
MD5 f19f175692aef784cc2b1955a6c1f405
SHA1 36e24fdf2237c30823a79cadb25709a1bb7f11c8
SHA512 be86cb8e06d67f532fda56ea577e621a5129053fe6f3b24f984f7ee0ae1dea4bd923fca0c84054b221376e01349c44c250f6e734e0cf18376ca560d2438f454f
SSDEEP 6144:0flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:0flfAsiVGjSGecvX
TLSH
T1EE747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdyvqo.exe

Path C:\Temp\vtnlfdyvqo.exe
Size 361KB
SHA256 a047514bbb16b3b9cdf434d64bca661c5cec44c0833438d954e8e23c58a7c985
MD5 d52a6d8154690d258d676c115c61730d
SHA1 456235760bc6bef16d6332a54812802afe29a476
SHA512 3aae80cbb2fc48403ca728bac7491b38419155c3338e48fd2af8632dca9c74086d3041383fef7e4277fafb0b2b02fc489eda69866b6303c130ffeeb1e33e29b0
SSDEEP 6144:FflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:FflfAsiVGjSGecvX
TLSH
T180747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtrojgeywq.exe

Path C:\Temp\vtrojgeywq.exe
Size 361KB
SHA256 09b5642107912f77e9d763b3d7fe78a9a8585e0f01ac81da16379d4c8cb5e9f9
MD5 f24d21983a4e15bf97458b4dd17ed1a3
SHA1 1bdd5e272549bdb55b3d55bb499f4deec530a7ac
SHA512 4baca27e44ca53491d02348c2e81353ff1cdb507444c66356b1f4429a9c5e444eee9963b974c52e6724ef4c2b6cdab652275bd9ead0d547a7ce030030c9a3dfb
SSDEEP 6144:sflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:sflfAsiVGjSGecvX
TLSH
T1D3747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b4b91e2c6408056d62e9ab108c4a1bc3372697cc673aea50cc1ab639cb36d31
MD5 31627e295d41c3cf43475c41d5522c43
SHA1 03580db0a47167f6acdfbb28d1db3e5fd631377d
SHA512 b71b6edd012c155ef24382afc691d07b436ca311747e424ecd928e1ae50b54eb9c2cef7113ea3e73a4f92dfa3cafacd84c0410c0f05a6860d79a46a87ba532f3
TLSH
T192D0C0293D44FC02C1891070760133D0755001F03056C3C59002E02DDC3814083DB09B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 37abd39218624bea608ed1c31cedc29697ad7dcee756e85d36f477bc96d5d79e
MD5 02d5d30f7a50d6501cf8e28620d036a8
SHA1 7b35285f7d86d5c3e0211627a1949eba907bccc2
SHA512 75c5013e8f146add9f0df252bb7669ce045b68d4f02b1aa7609d01a9ab18fda0f9b2e387ce15f36d76b8019dce58f4ed010f4a4528819164adeaf356a9fdc485
TLSH
T1FFD0C02D3D44FC02C1891070760033D0756001F03056C3C59002E01DDC3814083DB0AF
MD5 SHA1 SHA512 TLSH

Submit Download

068d9bfc-4ec5-4e62-8dd6-17f2d71be217.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\068d9bfc-4ec5-4e62-8dd6-17f2d71be217.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 03e9e9c4734ad370fe331cc964ac90f6545263421b933633ce5c4dd432b001b3
MD5 215c42188541a3b9cc9b62925d0cf8bc
SHA1 6f797cea32cb6e4613c9b78500dae376f87b08a4
SHA512 d4e67ef54cfcc1265b9d97a83076bcd0839b79bc135eced900a6aa61edd22729aa779b88ab40a42c452b2ecf8a9317c858dcc4dbd9eb8f40e0bdfd49a524d73c
TLSH
T1D161801C212E0911D7BA0CB501F217B9FF7889554B0BBEE180D8AC79781E7EC3C51A71
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a36f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a36f.TMP
Size 3KB
SHA256 3f8b67e79873d4b0125a89e7654a30dcf1d42f7dc0d0e5481edb3392880bf132
MD5 e303b6273073ce459ea7d3b2c6bb30a0
SHA1 d3bb96dbb53543a3c4b416cbb32f70ee30809197
SHA512 5fc64b8e704bac0ace370613a89edfd353d5935d9499d8e19a9b2d388b04f11f0bd87dad618427f129a535985020e53616e4c9750e9ed1ab6465f573f2b65584
TLSH
T1E361801C112E4921D7BA0CB401F217B9FF7889554B0BBEE180D8AC39781E7EC3C51A71
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e5fe5b6767d04e815e448071ed3d6b8396287a6a8711f1ef908f3aa6f983cac5
MD5 0f3f3c685881560f4d8a8bf7b88ec0d2
SHA1 2bc80ce74777f0571dbbe12fa2f6c1cc75d468d4
SHA512 96d0b47944a3c7d881b6bef6ef5449ae2793c35066b94b55528d5deb882fbdd9145e59399a12db7a6ab28288a194b9c7aa670c39958fbcf9725c5dc42b4215f3
TLSH
T1A1519DF7C3E8866E890156F0BA146E2BCE2D0915832C3D5AC8E4AF5B93E3471E24195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2c6f7b705bd5d7d9a418cc8098abb30d8b291b72c636b53962e43ca2d9dd4f1b
MD5 8a1604b8fa2f856c6359171168cfa42b
SHA1 3fd9340aa0e5a3c6cc2d15051795540485dfae29
SHA512 85f6a48c1da8cb7728da4311fd1aa40a78d2c9f0c22f73b97558c5995fe63f99b15149b4d0c0eeb95161ccceb4324269ff080232efc033e9dc1413c9f567f534
SSDEEP 192:sxRyVRWyM/jK1Ml8wcB/fJsP9lZdzoA8p9H/g6+WNCo5/YHwRrGsIgtJ:sxRyVgCB/fJsP9LQF/5D/NB3
TLSH
T16A62C8166A3459378CCBD209FA557F63D6F81573A2901E44AEFC8A0C05E7AED221783F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f93509a0cbc494525cbde2d2aa5520de9e7e6cf1429e6ab5f6ec270d60d80ea4
MD5 9d11bb963a3b2981f0d068100732dfd1
SHA1 b246b4edbe78d175730741b86c5ec0061b1a4174
SHA512 cd7c9b1cb271338e092d7c00d8eb638e60e002523f18ce3c520d6506a4748aba7a835cee1d872d71bef577b77029582697e47137567afbf143f41046d266d58a
SSDEEP 192:sxRymRWyM/jK1Ml8UQRcB/fJsl9lZdzoA8prH/g6+WNCo5/YHCRrGsIgDoJ:sxRymgqGB/fJsl9LQD/5D/pBQ
TLSH
T17162EA166A3459378CCBD20DFA517F63D6F81572A2941E44AEFC8A0C05E7AED221783F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6a7f537d83ab71cf61584efc8ab71fb27ad95fe2e72843ead47a22dc1af4e320
MD5 d0e8e10cb94cf37b4f61f3ee2d35c5f2
SHA1 082dd5c7a3359eddfc78b6295cf250b3f930556f
SHA512 442940d98065717be8e163158faf5fc98e3640207f68cb92b19304d4a1e96bb8e98e6e011d2b7f46b809af0694a4036fc06abdfde73e0755a00af56e85275de4
SSDEEP 192:sxRymRWyM/jK1Ml8wcB/fJsl9lZdzoA8p9H/g6+WNCo5/YHwRrGsIgDoJ:sxRymgCB/fJsl9LQF/5D/NBQ
TLSH
T10C62D9166A3459378CCBD209FA557F53D6F81572E2901E44AEFC8A0C05E7AED221783F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 72113a6798ea037fdbc35087f748641293b2301bfef8cba1f433f999b2d5e22d
MD5 f0d5bf7eea49288c9f35e396ced37a1b
SHA1 1b6e7dd41193962a51340fe9aa4cf97a1e610cd1
SHA512 b5ca9fda80b05f0110bc9b59785cf464cdbc22ac6ffe0a9ca1dde1800eab7987ff1418d37d95261d965a98a92e40d5109ac62f4eb821e0443c31a9faf1c67326
SSDEEP 768:6laYfO7pLuL7mjWgRNf2b8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4LDAzwnro3J7h:6laYfOE7mjWgRNf2bu1jarLDUw057h
TLSH
T14CE2EC3B680CCB7E4F40499CED297E9AADDC02CF56D88D9447EA480C03C67EB551A5EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3d9a0c8c3489ef9edb65a86d4b36d5e724188b6b458181b545efc026f05a8b3e
MD5 e571e1319b84aa8387cc7802c192ef40
SHA1 59171c5ba9394497c6520da86c19ea77c635d068
SHA512 80741f086b524b1cc11063193a549c750960383ad76cf7c3b964da50952eceba999ab28f2d6a7c6fe22583c7f2ecf0f72886da8ee9a292a2612016fd18cd0a13
SSDEEP 96:KOf2DvFB1Qx5kD3HQKfF3NQDXHUtf94OZAcWsw7xADK307KfC3q7DOmrYQI4GLGt:9f2DvFB1I5kjHbF3NQXHUtf94OZAcWse
TLSH
T14491362074BA2B00387D750A93B9852E264530D531DEA86F3B6971F31F66E054EFDBC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593ea5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593ea5.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8c7ec62adee762acf5e8bb72d4021db373b0dfb4af38746f5b467663c2fd8db3
MD5 0577fb6910b1a24643b87d19e16a1c3b
SHA1 56b72d1f945dd444dfa1d9fa098748ba0fdab97e
SHA512 847ed45e5fc35a613cfa6f3f11f5edbbbda8b8b2b59febcb7c0a94aa82baf60c1023d9e1ef801e367fb047a48ffcca239c368b28968d5af107821aa56861d100
SSDEEP 768:arv+4UNbdB3jZC9x+Tf/O1lfNqWyvPIINRzWnhIoAX+8r7W:absbT3pTfOlfNogyROIoCDra
TLSH
T16803C032E9685A73ACFBC6C87A4B77577EF4426396C60B90C4CD1B4C458B6AE130B852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 6570499e1894230669c7ba6dcb9c4bb6ed7e825afb0e272818c81a052c05f164
MD5 6ac73bc3b510c0abd5bec049b0b1e872
SHA1 bc6e30838d13f6a9077d4495fb2b966551803a2f
SHA512 5de3f77a538ccbce9b7ab4596014cd9a25ad418c4e7f767144e063344493c2d39d7c60c0102d73c80a43cc6801ccf81c0a8af746cb8a919ab5a72fd74699efd0
SSDEEP 768:eF1j+9p3qwg0iIMf/O1lfN2f3WyvPIINRzWnhIoQMzn12bfJU:b9p3IfOlfN2fHgyROIodByJU
TLSH
T1981329F594D78A72E9AE8787673D2E469DBCC163B1895990B7C80D4CCC872BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0ffca3f8db75f50b1c6dc6e1a7ca770bf2ced78433413447bf15aa1e4138aabe
MD5 c7a233bd372abf9285693496b549d384
SHA1 99f3a12f572eced3cfe2a64584c21547e48698ce
SHA512 6f65da0adb6b6726c0a1a5831d1e883c4cbc6ff2b2e84ce3559070191daa88ab6d73f1d826c7ff0d42ed42936ec9faf3a23e977538f6408639ec598ed96e38a6
SSDEEP 768:9j+9p30nbC9x+Tf/O1lfN2fVWyvPIINRzWnhIoQMzn12bfJU:49p3KTfOlfN2fJgyROIodByJU
TLSH
T17EF2BE75E8654E635DEBC288BB4B3797AEE402B381CA1FA4D9CC4F4C048B3AD130B815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1308_2072328020\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 d35461c6e71b44b2cf9b83944b690ec392b712719046cb12d9845d49e4df4f39
MD5 bf06fa4de8db20c3d86281fbf487cc6a
SHA1 db831064c989b01bd4be2b7a76a15a6cdeb2dfbc
SHA512 fbf83e925e0b8a86ac92bf58c37aac5216e0e44eb431848632764a995f89827ca1bbb1625408f64d60ad8b2d4b0f9edf149525efcbbdcd1ff85446f79b86f299
TLSH
T1BA71238357B8C6B3C5DE5FF102835608F5FB22380B2330340B515546AB30A3A24B8F48
MD5 SHA1 SHA512 TLSH

Submit Download

memory/980-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1500-435-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2296-281-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2484-198-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2744-454-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2828-474-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3880-343-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4120-295-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4228-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4228-379-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4228-385-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4376-328-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4528-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5328-384-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5336-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5480-430-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5872-245-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5888-381-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6088-406-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6100-402-0x0000000000010000-0x00000000000AB000-memory.dmp

Download