systex | 4ea780bf00ff25dfbd92558cbe4e8a385f3d2200d27f9edfb3b3e171f5518022

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260708-wphqvsd19n
SHA256 4ea780bf00ff25dfbd92558cbe4e8a385f3d2200d27f9edfb3b3e171f5518022
MD5 478bf40f098f098dddb973f988451e0a
SHA1 5aa2fa174f246203b5a062d2c5990dc449b2dbe4
SHA512 d412bd7fb9993c04e92832f7c1e01ee37c8234444afc5ce174553d9f0f5c7126716b9ca1e49ab23441faf3fc94c343b80271e45600a9506dc92f9221efd2719c
SSDEEP 6144:IflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:IflfAsiVGjSGecvX
TLSH
T1FF747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5820	bztrljebwuomgeyw.exe
1464	bztrljebwuomgeyw.sys
3540	CreateProcess.exe
4784	etrlgdbwto.exe
1676	CreateProcess.exe
4276	CreateProcess.exe
1592	i_etrlgdbwto.exe
4752	ljdbvtolge.sys
5364	CreateProcess.exe
4756	bvtolgeywq.exe
1960	CreateProcess.exe
2128	CreateProcess.exe
2248	i_bvtolgeywq.exe
2420	oigaytqlid.sys
1276	CreateProcess.exe
5636	dyvqoigavt.exe
4972	CreateProcess.exe
2468	CreateProcess.exe
5348	i_dyvqoigavt.exe
1552	davsqkidav.sys
2912	CreateProcess.exe
4256	nlfdxvqnli.exe
2240	CreateProcess.exe
4460	CreateProcess.exe
4484	i_nlfdxvqnli.exe
3180	spnhfaxvpn.sys
764	CreateProcess.exe
3872	kicausmkic.exe
1688	CreateProcess.exe
1472	CreateProcess.exe
3304	i_kicausmkic.exe
5528	xspnhfaxsp.sys
4516	CreateProcess.exe
2672	hcausmkhca.exe
356	CreateProcess.exe
3784	CreateProcess.exe
4232	i_hcausmkhca.exe
2580	hczurpkhfz.sys
5384	CreateProcess.exe
3692	eczusmkecz.exe
4912	CreateProcess.exe
680	CreateProcess.exe
4580	i_eczusmkecz.exe
4572	ebzurmjecu.sys
2880	CreateProcess.exe
1464	omhezxrpjh.exe
1448	CreateProcess.exe
1788	CreateProcess.exe
3392	i_omhezxrpjh.exe
3984	ezwrojhbzt.sys
1872	CreateProcess.exe
5312	trjebztolj.exe
5052	CreateProcess.exe
1668	CreateProcess.exe
3384	i_trjebztolj.exe
4580	ojhbztrlje.sys
1136	CreateProcess.exe
4868	wqolgeywqo.exe
4084	CreateProcess.exe
6084	CreateProcess.exe
3976	i_wqolgeywqo.exe
1488	bytqligdbv.sys
4092	CreateProcess.exe
6056	gaywqoigay.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1768_774461588\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1768_768332421\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1768_768332421\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojhbztroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczusmkecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecxupmhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcausmkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtolgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqoigavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trjebztolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqljdbvtnd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	etrlgdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtolgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcausmkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfaxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqoigavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvqnli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfaxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnhfcaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojhbztroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_etrlgdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausmkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausmkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzurmjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqljdbvtnd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczusmkecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trjebztolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljebwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljebwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvqnli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnhfcaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecxupmhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzurmjhb.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1832	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3020	ipconfig.exe
1664	ipconfig.exe
6036	ipconfig.exe
2916	ipconfig.exe
2924	ipconfig.exe
3360	ipconfig.exe
3064	ipconfig.exe
4440	ipconfig.exe
3068	ipconfig.exe
5648	ipconfig.exe
2296	ipconfig.exe
3020	ipconfig.exe
5700	ipconfig.exe
2316	ipconfig.exe
1732	ipconfig.exe
3164	ipconfig.exe
1396	ipconfig.exe
3112	ipconfig.exe
2352	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280075532222869"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3437697693-2283162250-3003737219-1000\{9330E6C9-BED3-42FC-9A5E-DC6A786C018E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5820	bztrljebwuomgeyw.exe
5820	bztrljebwuomgeyw.exe
5820	bztrljebwuomgeyw.exe
5820	bztrljebwuomgeyw.exe
5820	bztrljebwuomgeyw.exe
5820	bztrljebwuomgeyw.exe
5820	bztrljebwuomgeyw.exe
5820	bztrljebwuomgeyw.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1592	i_etrlgdbwto.exe
Token: SeDebugPrivilege	2248	i_bvtolgeywq.exe
Token: SeDebugPrivilege	5348	i_dyvqoigavt.exe
Token: SeDebugPrivilege	4484	i_nlfdxvqnli.exe
Token: SeDebugPrivilege	3304	i_kicausmkic.exe
Token: SeDebugPrivilege	4232	i_hcausmkhca.exe
Token: SeDebugPrivilege	4580	i_eczusmkecz.exe
Token: SeDebugPrivilege	3392	i_omhezxrpjh.exe
Token: SeDebugPrivilege	3384	i_trjebztolj.exe
Token: SeDebugPrivilege	3976	i_wqolgeywqo.exe
Token: SeDebugPrivilege	2212	i_gaywqoigay.exe
Token: SeDebugPrivilege	2844	i_aysqnifays.exe
Token: SeDebugPrivilege	4484	i_xvpnhfaxvp.exe
Token: SeDebugPrivilege	1888	i_spnhfcaxsp.exe
Token: SeDebugPrivilege	5396	i_kecxupmhec.exe
Token: SeDebugPrivilege	1340	i_jhbzurmjhb.exe
Token: SeDebugPrivilege	4848	i_rojhbztroj.exe
Token: SeDebugPrivilege	5500	i_ljebwtomge.exe
Token: SeDebugPrivilege	3752	i_tqljdbvtnd.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1768	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 5820	1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 1348 wrote to memory of 5488	1348	2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 5488 wrote to memory of 1768	5488	iexplore.exe	90
PID 1768 wrote to memory of 5260	1768	msedge.exe	91
PID 1768 wrote to memory of 1832	1768	msedge.exe	92
PID 1768 wrote to memory of 2380	1768	msedge.exe	93
PID 1768 wrote to memory of 2380	1768	msedge.exe	93
PID 1768 wrote to memory of 2380	1768	msedge.exe	93
PID 1768 wrote to memory of 1168	1768	msedge.exe	95
PID 1768 wrote to memory of 1168	1768	msedge.exe	95
PID 1768 wrote to memory of 4640	1768	msedge.exe	96
PID 1768 wrote to memory of 6040	1768	msedge.exe	97
PID 1768 wrote to memory of 4640	1768	msedge.exe	96
PID 1768 wrote to memory of 4640	1768	msedge.exe	96
PID 1768 wrote to memory of 6040	1768	msedge.exe	97
PID 1768 wrote to memory of 6040	1768	msedge.exe	97
PID 1768 wrote to memory of 2016	1768	msedge.exe	98
PID 1768 wrote to memory of 2016	1768	msedge.exe	98
PID 1768 wrote to memory of 2016	1768	msedge.exe	98
PID 1768 wrote to memory of 5856	1768	msedge.exe	99
PID 1768 wrote to memory of 5856	1768	msedge.exe	99
PID 1768 wrote to memory of 5856	1768	msedge.exe	99
PID 1768 wrote to memory of 2764	1768	msedge.exe	100
PID 1768 wrote to memory of 2764	1768	msedge.exe	100
PID 5820 wrote to memory of 3540	5820	bztrljebwuomgeyw.exe	104
PID 4784 wrote to memory of 1676	4784	etrlgdbwto.exe	107
PID 1768 wrote to memory of 5884	1768	msedge.exe	110
PID 1768 wrote to memory of 5884	1768	msedge.exe	110
PID 1768 wrote to memory of 1328	1768	msedge.exe	111
PID 1768 wrote to memory of 1328	1768	msedge.exe	111
PID 1768 wrote to memory of 2008	1768	msedge.exe	113
PID 1768 wrote to memory of 1712	1768	msedge.exe	114
PID 1768 wrote to memory of 1712	1768	msedge.exe	114
PID 1768 wrote to memory of 2460	1768	msedge.exe	117
PID 1768 wrote to memory of 2460	1768	msedge.exe	117
PID 5820 wrote to memory of 4276	5820	bztrljebwuomgeyw.exe	118
PID 5820 wrote to memory of 5364	5820	bztrljebwuomgeyw.exe	122
PID 4756 wrote to memory of 1960	4756	bvtolgeywq.exe	124
PID 5820 wrote to memory of 2128	5820	bztrljebwuomgeyw.exe	127
PID 5820 wrote to memory of 1276	5820	bztrljebwuomgeyw.exe	131
PID 5636 wrote to memory of 4972	5636	dyvqoigavt.exe	133
PID 5820 wrote to memory of 2468	5820	bztrljebwuomgeyw.exe	136
PID 1768 wrote to memory of 5512	1768	msedge.exe	138
PID 1768 wrote to memory of 5512	1768	msedge.exe	138
PID 1768 wrote to memory of 5512	1768	msedge.exe	138
PID 1768 wrote to memory of 1820	1768	msedge.exe	141
PID 1768 wrote to memory of 1820	1768	msedge.exe	141
PID 1768 wrote to memory of 1820	1768	msedge.exe	141
PID 5820 wrote to memory of 2912	5820	bztrljebwuomgeyw.exe	143
PID 4256 wrote to memory of 2240	4256	nlfdxvqnli.exe	145
PID 5820 wrote to memory of 4460	5820	bztrljebwuomgeyw.exe	148
PID 1768 wrote to memory of 1808	1768	msedge.exe	150
PID 1768 wrote to memory of 468	1768	msedge.exe	151
PID 1768 wrote to memory of 5748	1768	msedge.exe	152
PID 5820 wrote to memory of 764	5820	bztrljebwuomgeyw.exe	155
PID 3872 wrote to memory of 1688	3872	kicausmkic.exe	157
PID 5820 wrote to memory of 1472	5820	bztrljebwuomgeyw.exe	160
PID 5820 wrote to memory of 4516	5820	bztrljebwuomgeyw.exe	164
PID 2672 wrote to memory of 356	2672	hcausmkhca.exe	166
PID 5820 wrote to memory of 3784	5820	bztrljebwuomgeyw.exe	169
PID 5820 wrote to memory of 5384	5820	bztrljebwuomgeyw.exe	173
PID 3692 wrote to memory of 4912	3692	eczusmkecz.exe	175
PID 1768 wrote to memory of 5084	1768	msedge.exe	178
PID 1768 wrote to memory of 5084	1768	msedge.exe	178

C:\Users\Admin\AppData\Local\Temp\2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_478bf40f098f098dddb973f988451e0a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Temp\bztrljebwuomgeyw.exe
  C:\Temp\bztrljebwuomgeyw.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\etrlgdbwto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3540
  - - C:\Temp\etrlgdbwto.exe
      C:\Temp\etrlgdbwto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4784
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1676
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_etrlgdbwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4276
  - - C:\Temp\i_etrlgdbwto.exe
      C:\Temp\i_etrlgdbwto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtolgeywq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5364
  - - C:\Temp\bvtolgeywq.exe
      C:\Temp\bvtolgeywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4756
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1960
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtolgeywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2128
  - - C:\Temp\i_bvtolgeywq.exe
      C:\Temp\i_bvtolgeywq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dyvqoigavt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1276
  - - C:\Temp\dyvqoigavt.exe
      C:\Temp\dyvqoigavt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5636
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4972
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dyvqoigavt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2468
  - - C:\Temp\i_dyvqoigavt.exe
      C:\Temp\i_dyvqoigavt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5348
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfdxvqnli.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2912
  - - C:\Temp\nlfdxvqnli.exe
      C:\Temp\nlfdxvqnli.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4256
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2240
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfdxvqnli.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4460
  - - C:\Temp\i_nlfdxvqnli.exe
      C:\Temp\i_nlfdxvqnli.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicausmkic.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:764
  - - C:\Temp\kicausmkic.exe
      C:\Temp\kicausmkic.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3872
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1688
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kicausmkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1472
  - - C:\Temp\i_kicausmkic.exe
      C:\Temp\i_kicausmkic.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hcausmkhca.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4516
  - - C:\Temp\hcausmkhca.exe
      C:\Temp\hcausmkhca.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2672
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:356
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hcausmkhca.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3784
  - - C:\Temp\i_hcausmkhca.exe
      C:\Temp\i_hcausmkhca.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eczusmkecz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5384
  - - C:\Temp\eczusmkecz.exe
      C:\Temp\eczusmkecz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3692
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4912
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eczusmkecz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:680
  - - C:\Temp\i_eczusmkecz.exe
      C:\Temp\i_eczusmkecz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omhezxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2880
  - - C:\Temp\omhezxrpjh.exe
      C:\Temp\omhezxrpjh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omhezxrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1788
  - - C:\Temp\i_omhezxrpjh.exe
      C:\Temp\i_omhezxrpjh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trjebztolj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1872
  - - C:\Temp\trjebztolj.exe
      C:\Temp\trjebztolj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5312
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5052
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trjebztolj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1668
  - - C:\Temp\i_trjebztolj.exe
      C:\Temp\i_trjebztolj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqolgeywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1136
  - - C:\Temp\wqolgeywqo.exe
      C:\Temp\wqolgeywqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4868
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4084
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqolgeywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6084
  - - C:\Temp\i_wqolgeywqo.exe
      C:\Temp\i_wqolgeywqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaywqoigay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4092
  - - C:\Temp\gaywqoigay.exe
      C:\Temp\gaywqoigay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6056
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1612
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaywqoigay.exe ups_ins
    3⤵
    PID:4132
  - - C:\Temp\i_gaywqoigay.exe
      C:\Temp\i_gaywqoigay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2212
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqnifays.exe ups_run
    3⤵
    PID:5124
  - - C:\Temp\aysqnifays.exe
      C:\Temp\aysqnifays.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6072
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4532
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqnifays.exe ups_ins
    3⤵
    PID:5060
  - - C:\Temp\i_aysqnifays.exe
      C:\Temp\i_aysqnifays.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnhfaxvp.exe ups_run
    3⤵
    PID:3788
  - - C:\Temp\xvpnhfaxvp.exe
      C:\Temp\xvpnhfaxvp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2324
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5308
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnhfaxvp.exe ups_ins
    3⤵
    PID:5012
  - - C:\Temp\i_xvpnhfaxvp.exe
      C:\Temp\i_xvpnhfaxvp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spnhfcaxsp.exe ups_run
    3⤵
    PID:2712
  - - C:\Temp\spnhfcaxsp.exe
      C:\Temp\spnhfcaxsp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2708
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:916
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spnhfcaxsp.exe ups_ins
    3⤵
    PID:2948
  - - C:\Temp\i_spnhfcaxsp.exe
      C:\Temp\i_spnhfcaxsp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kecxupmhec.exe ups_run
    3⤵
    PID:4836
  - - C:\Temp\kecxupmhec.exe
      C:\Temp\kecxupmhec.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:996
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4852
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kecxupmhec.exe ups_ins
    3⤵
    PID:956
  - - C:\Temp\i_kecxupmhec.exe
      C:\Temp\i_kecxupmhec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbzurmjhb.exe ups_run
    3⤵
    PID:3048
  - - C:\Temp\jhbzurmjhb.exe
      C:\Temp\jhbzurmjhb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1288
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2552
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbzurmjhb.exe ups_ins
    3⤵
    PID:6008
  - - C:\Temp\i_jhbzurmjhb.exe
      C:\Temp\i_jhbzurmjhb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rojhbztroj.exe ups_run
    3⤵
    PID:3716
  - - C:\Temp\rojhbztroj.exe
      C:\Temp\rojhbztroj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4312
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1252
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rojhbztroj.exe ups_ins
    3⤵
    PID:4292
  - - C:\Temp\i_rojhbztroj.exe
      C:\Temp\i_rojhbztroj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljebwtomge.exe ups_run
    3⤵
    PID:4508
  - - C:\Temp\ljebwtomge.exe
      C:\Temp\ljebwtomge.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3636
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2764
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljebwtomge.exe ups_ins
    3⤵
    PID:2732
  - - C:\Temp\i_ljebwtomge.exe
      C:\Temp\i_ljebwtomge.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqljdbvtnd.exe ups_run
    3⤵
    PID:5688
  - - C:\Temp\tqljdbvtnd.exe
      C:\Temp\tqljdbvtnd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5980
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:988
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqljdbvtnd.exe ups_ins
    3⤵
    PID:5148
  - - C:\Temp\i_tqljdbvtnd.exe
      C:\Temp\i_tqljdbvtnd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3752
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x35c,0x7fff1cd1c188,0x7fff1cd1c194,0x7fff1cd1c1a0
      4⤵
      PID:5260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,10395991448304325114,12637619094653318472,524288 --field-trial-handle=2612,i,5173472998886800220,8741491132573732156,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:11
      4⤵
      System Time Discovery
      PID:1832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,17881877345272956323,3322263769838588177,262144 --field-trial-handle=2612,i,5173472998886800220,8741491132573732156,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:2
      4⤵
      PID:2380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,12851868301140280555,3682881129438194907,524288 --field-trial-handle=2612,i,5173472998886800220,8741491132573732156,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:13
      4⤵
      PID:1168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,14906829071681997431,1307477885368686966,2097152 --field-trial-handle=2612,i,5173472998886800220,8741491132573732156,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,16527092146628371374,12860451568478757912,2097152 --field-trial-handle=2612,i,5173472998886800220,8741491132573732156,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:6040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,10631701775131372487,17394348524874179328,2097152 --field-trial-handle=2612,i,5173472998886800220,8741491132573732156,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:1
      4⤵
      PID:2016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,1148932990214765447,3335823245801216639,2097152 --field-trial-handle=2612,i,5173472998886800220,8741491132573732156,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:9
      4⤵
      PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,16921575673533342863,12282155433341756695,524288 --field-trial-handle=2612,i,5173472998886800220,8741491132573732156,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
      4⤵
      PID:2764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,1979091218187386905,12038104216677975934,524288 --field-trial-handle=2612,i,5173472998886800220,8741491132573732156,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
      4⤵
      PID:5884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,9683421634006012232,7491842778672630208,524288 --field-trial-handle=2612,i,5173472998886800220,8741491132573732156,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
      4⤵
      PID:1328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,16370779027912516024,10659243488971598308,524288 --field-trial-handle=2612,i,5173472998886800220,8741491132573732156,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:5636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,16370779027912516024,10659243488971598308,524288 --field-trial-handle=2612,i,5173472998886800220,8741491132573732156,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:2008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,10973085390625946031,16183929343591630600,524288 --field-trial-handle=2612,i,5173472998886800220,8741491132573732156,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
      4⤵
      PID:1712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,6244125688275244168,17490271568722627801,524288 --field-trial-handle=2612,i,5173472998886800220,8741491132573732156,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
      4⤵
      PID:2460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6724,i,13987766522931134397,1371460711459167142,2097152 --field-trial-handle=2612,i,5173472998886800220,8741491132573732156,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:1
      4⤵
      PID:5512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3612,i,16344495517856168317,18178394312888484010,2097152 --field-trial-handle=2612,i,5173472998886800220,8741491132573732156,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:1820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,4101117262885682435,17397594989126754803,524288 --field-trial-handle=2612,i,5173472998886800220,8741491132573732156,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14
      4⤵
      PID:1808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,11585648332390701727,1253288306621971825,524288 --field-trial-handle=2612,i,5173472998886800220,8741491132573732156,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:14
      4⤵
      PID:468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,5117834576379278115,8807481666724579951,524288 --field-trial-handle=2612,i,5173472998886800220,8741491132573732156,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
      4⤵
      PID:5748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4692,i,4672707580005310548,5977400175843681169,2097152 --field-trial-handle=2612,i,5173472998886800220,8741491132573732156,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
      4⤵
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,15023756885049671097,14665052170333427774,524288 --field-trial-handle=2612,i,5173472998886800220,8741491132573732156,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
      4⤵
      PID:1804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,1296906221240714483,8382129874244931270,524288 --field-trial-handle=2612,i,5173472998886800220,8741491132573732156,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
      4⤵
      PID:2340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5064,i,7022183405325082836,11826620472911295845,2097152 --field-trial-handle=2612,i,5173472998886800220,8741491132573732156,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:1
      4⤵
      PID:2440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5700,i,578879081293368637,1952047477011571380,262144 --field-trial-handle=2612,i,5173472998886800220,8741491132573732156,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:10
      4⤵
      PID:6040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,12057218403266524171,17294353531694669380,524288 --field-trial-handle=2612,i,5173472998886800220,8741491132573732156,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
      4⤵
      PID:5976

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1012

C:\Temp\bztrljebwuomgeyw.sys
C:\Temp\bztrljebwuomgeyw.sys
1⤵
- Executes dropped EXE
PID:1464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1260

C:\Temp\ljdbvtolge.sys
C:\Temp\ljdbvtolge.sys
1⤵
- Executes dropped EXE
PID:4752

C:\Temp\oigaytqlid.sys
C:\Temp\oigaytqlid.sys
1⤵
- Executes dropped EXE
PID:2420

C:\Temp\davsqkidav.sys
C:\Temp\davsqkidav.sys
1⤵
- Executes dropped EXE
PID:1552

C:\Temp\spnhfaxvpn.sys
C:\Temp\spnhfaxvpn.sys
1⤵
- Executes dropped EXE
PID:3180

C:\Temp\xspnhfaxsp.sys
C:\Temp\xspnhfaxsp.sys
1⤵
- Executes dropped EXE
PID:5528

C:\Temp\hczurpkhfz.sys
C:\Temp\hczurpkhfz.sys
1⤵
- Executes dropped EXE
PID:2580

C:\Temp\ebzurmjecu.sys
C:\Temp\ebzurmjecu.sys
1⤵
- Executes dropped EXE
PID:4572

C:\Temp\ezwrojhbzt.sys
C:\Temp\ezwrojhbzt.sys
1⤵
- Executes dropped EXE
PID:3984

C:\Temp\ojhbztrlje.sys
C:\Temp\ojhbztrlje.sys
1⤵
- Executes dropped EXE
PID:4580

C:\Temp\bytqligdbv.sys
C:\Temp\bytqligdbv.sys
1⤵
- Executes dropped EXE
PID:1488

C:\Temp\lidbvtqkid.sys
C:\Temp\lidbvtqkid.sys
1⤵
PID:2320

C:\Temp\aysqnifays.sys
C:\Temp\aysqnifays.sys
1⤵
PID:4700

C:\Temp\dxusqnifzx.sys
C:\Temp\dxusqnifzx.sys
1⤵
PID:5652

C:\Temp\vpmhfzxupn.sys
C:\Temp\vpmhfzxupn.sys
1⤵
PID:2248

C:\Temp\urmkecwupm.sys
C:\Temp\urmkecwupm.sys
1⤵
PID:4568

C:\Temp\bztrljebwu.sys
C:\Temp\bztrljebwu.sys
1⤵
PID:5696

C:\Temp\ywrojgeyoj.sys
C:\Temp\ywrojgeyoj.sys
1⤵
PID:1708

C:\Temp\toljdbvtnl.sys
C:\Temp\toljdbvtnl.sys
1⤵
PID:2444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtolgeywq.exe

Path C:\Temp\bvtolgeywq.exe
Size 361KB
SHA256 530437b5cb8e386db9a1c3031e2d12241e3658b49c5fab438faab99cfd904e05
MD5 7ebcdad7af3430558690eb3d4faa192d
SHA1 f5d035393d6bfa342c79a57bbc1338df4323fd70
SHA512 324f21250be543bab6010ee6494c2bf15f4e07cd0ed86b0fd862e6aca92b446e96c958bdb44d8f4c0fd7052ebf02e570bff83e438deadc423733f49e14779f18
SSDEEP 6144:vflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:vflfAsiVGjSGecvX
TLSH
T1FE747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrljebwuomgeyw.exe

Path C:\Temp\bztrljebwuomgeyw.exe
Size 361KB
SHA256 0fe648e6bb582f14c45914bf3fca7ad599cfa54b14b572def664876da9a24aa9
MD5 81d0ead74bd09a31a62734c771734b84
SHA1 6699f754239f617921ba192e7f3829926f8144cc
SHA512 4af46e9c62bb6f5a516aea04f603f557102a7ab6da56e9a0856fd3e1f837ba9f058b5c6a136f2e29b181c04e1b4f15cf90f23ccf037f564d2778983593acff2e
SSDEEP 6144:jflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:jflfAsiVGjSGecvX
TLSH
T139747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrljebwuomgeyw.sys

Path C:\Temp\bztrljebwuomgeyw.sys
Size 293KB
SHA256 90b2383b23ea5bcd7b196a6bc19a5e2f1b34fe588a5ae20e8a1f6cf2fcbe1594
MD5 dd00e04c8eb4dcca1fac6173a9cd3f97
SHA1 e791c5f7f3974fdf975433cf0a6329a214d95b51
SHA512 0159bfcb3e9a1e3e08e5ecaa9e5b61e5c4c706eeb7be0ee821af4965c95d4cc1f2551eff02ee22337b400b400448b1722c79f03e3515cd0a38d483adb27a2911
SSDEEP 3072:stKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:sIJjiJcbI03GBc3ucY5DCSj
TLSH
T184545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

davsqkidav.sys

Path C:\Temp\davsqkidav.sys
Size 293KB
SHA256 f6ea3fffee5193feef7918de5eef0e623c96d91a0dd41066df9a797050079987
MD5 a644508dc2aac18c49dac594dc157fb2
SHA1 f6c2557d3d46e5593c37390ab5abfaff76cc43d6
SHA512 2614ecb973931c261597cc5d9c76922f06a4a8aff61ca53a94ce07b4d633c77b6ca97a1bc0a8876f2de4f54bbc0bd0ddb0c6ee8d032cdfb1d337d89bffdf2ef4
SSDEEP 3072:3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:3IJjiJcbI03GBc3ucY5DCSj
TLSH
T197545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvqoigavt.exe

Path C:\Temp\dyvqoigavt.exe
Size 361KB
SHA256 30abf3d41804163b8f04e047869e8ab6caf3f5d0e57892d9116c0fed09d0f0be
MD5 e4352e90547b6480565439ce14e579a2
SHA1 071d432594a4dfa76f7c7555319165f47321869f
SHA512 f1c90fa41bbbf2ac909dc2549246484b8bb57bd8d7f93da5ae503b0921b0bb2479778016b8996ef98957eaa799a97f8658e8ddd6c7fab1ad30e72a16a8438c2b
SSDEEP 6144:aflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:aflfAsiVGjSGecvX
TLSH
T183747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

etrlgdbwto.exe

Path C:\Temp\etrlgdbwto.exe
Size 361KB
SHA256 1ead82a314a2a47ce94be2454ad41eaa77441d1b1ba1f2fd56554e3879d7af3f
MD5 3baae02b4e4679403f7181acf428c860
SHA1 c91126fa722c760e71ab64016eae7f7f0692914d
SHA512 7858e06e8cd0f2eeaf8a89144504f68da42437f50e628d135c0b9c1115e33d9c83514c168fb04d41d29b3c4593375d10728bfde77c70ee59bdc96898c90d4294
SSDEEP 6144:qflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:qflfAsiVGjSGecvX
TLSH
T148747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcausmkhca.exe

Path C:\Temp\hcausmkhca.exe
Size 361KB
SHA256 4904afdc1356a09e7bf77e693d585b50a3d9423145b95b8fee2374610b454466
MD5 56317da34b4349410d6d203a630121f9
SHA1 c64d444364be142f8c96263d1e761c9a5a218277
SHA512 3f09bf3840cb07e3fa1f52c8af945c0fec1c3c0a8e65e8faa4f72847c5ea296bd357e4b244be7ac1138fffc7d921384e7d25e9ad4a87fd2f94647ed87e481696
SSDEEP 6144:EflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:EflfAsiVGjSGecvX
TLSH
T1A2747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtolgeywq.exe

Path C:\Temp\i_bvtolgeywq.exe
Size 361KB
SHA256 6470c3a9c72d0dc429f42e883d68321a9efc49a89743cc275d024cd59326c84a
MD5 97497a08657145647c2a9bbc5f4d3ac4
SHA1 66997c69c2918e2b2381ef38debc09946f1c05cd
SHA512 49fcb38486a020e50a1d2ccbe39f415475760b92bc9f6bee36034dead005230f2e40d683d8dc9bcbec51db40aec4f1c1adda31e4b49191eff2cd04eee5d66aec
SSDEEP 6144:wflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:wflfAsiVGjSGecvX
TLSH
T13B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dyvqoigavt.exe

Path C:\Temp\i_dyvqoigavt.exe
Size 361KB
SHA256 9d45dfe3bf313fcce14820eed188d34dcd54ff515445eb48f68ff1c865ee8449
MD5 8b5f145f45f3441f22b759680c82c8da
SHA1 e1d77b520bde514239bdf7775ebdcb3c5b7debd7
SHA512 3499d8a7f8b7d4638a8b62419459cb3a588ffdabece534f2c622afbb940e02824a09dd2c4cb6f7b5022757f626459cbf045c688c1246612bcfae71ddf11d94f4
SSDEEP 6144:XflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:XflfAsiVGjSGecvX
TLSH
T18D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_etrlgdbwto.exe

Path C:\Temp\i_etrlgdbwto.exe
Size 361KB
SHA256 146279acfe544c52e2de161fb177f0f553414476b5a61200972d329c46e40b8f
MD5 835ccafc0517fe60c55d7c2aa81efef9
SHA1 8b9004f8c0f3d6f92e5e7f2ec4de2c4fdfb1eccd
SHA512 7b45ef50013292776e4ef2ec1105b6a3ed9e19675c3731f33081b31ad6a93fff4efc56a53d164eb294bbfe73c4a288b6c691141917b407466b985953ed4f1cd4
SSDEEP 6144:oflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:oflfAsiVGjSGecvX
TLSH
T149747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kicausmkic.exe

Path C:\Temp\i_kicausmkic.exe
Size 361KB
SHA256 dc6f82c9a830f5cd85da275c34d0ec6806d3d576bc6e1169f80e75c18f01b4fa
MD5 05ad3435dd3fc530a91ad0c5cf47745b
SHA1 74bfb9fbcca1ca0586db3fde39f451dd0ff7f521
SHA512 c54c597f4fa95c071f6b9c43686a830c787203c742319770b7cea0dff1467c93cdc54e9c8b8639c6839da1fd378c9a90872f022ac89194e857baf549e3a85999
SSDEEP 6144:JflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:JflfAsiVGjSGecvX
TLSH
T15D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlfdxvqnli.exe

Path C:\Temp\i_nlfdxvqnli.exe
Size 361KB
SHA256 71df7f667c36a873bc72922758e7753200d68b6064e5e89b6ecd8a661d095b2e
MD5 184c9f24d25788a3fbe1e0ab05f5a056
SHA1 36bc038906874b39275f77016f206b70934b17bc
SHA512 814d0824ca3b358d8840740bd7aa9290c15115d56da88be47a5e5cf8855d79e53292b929b31ee1df254e7dcfe102b1e372a6cba17e5c04ccb3e9a9c3fe131989
SSDEEP 6144:PflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:PflfAsiVGjSGecvX
TLSH
T16A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicausmkic.exe

Path C:\Temp\kicausmkic.exe
Size 361KB
SHA256 eb5a05da7a1fe0487d9e8b63e4b8207c9f0450e68ad57b28b0c57ff700e7e898
MD5 3cd547bf10635942bceb7bb0aa155a70
SHA1 6603b3b8e577dde93582fb700762a8062ee1a3e2
SHA512 d75f4b0b7fd8a99453fb824638b91e6096eba852c56e0b04e4453ce44558c54f793e3f4f5ead07a739170252ee0cbad1e4f839a322abaa4eb981ad8fdc6974ed
SSDEEP 6144:AflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:AflfAsiVGjSGecvX
TLSH
T17B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbvtolge.sys

Path C:\Temp\ljdbvtolge.sys
Size 293KB
SHA256 52e4bf93e984a8527ee0ad50c8ae3d6563395e1573f1581436ba2eb9f69c17fe
MD5 2b21629656e6c234b1366ce72d2bfd99
SHA1 3633081f294ddd95951013c4dc31df6c967a4c69
SHA512 2d4f729d583db23c99ed33996ed308a525ab860d0713d25ae6372acc7077d37331190c297b210407d5b8248dbb165e231466e5c7ced48d685beb042a39c08fc2
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdxvqnli.exe

Path C:\Temp\nlfdxvqnli.exe
Size 361KB
SHA256 ceea308b90d3f3bc7b14e0ad34059a2b2535a678f6015d920cf8dd7ac025921d
MD5 149126d92b71cc6a2d8683b7190439ef
SHA1 48c6857529518a7982df7e1875c22afdf868d1f4
SHA512 35d0564f975a2ae68e1868b1d5140a511dc20dc4ef11512b3b63d9f75cabf381ef14db22b041410303a4a6cf9878d8e8301d2f8359378962abc09825d55cf32a
SSDEEP 6144:9flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:9flfAsiVGjSGecvX
TLSH
T1B8747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigaytqlid.sys

Path C:\Temp\oigaytqlid.sys
Size 293KB
SHA256 1080f82433e3e9caee588316cbede33021d2356ef233fba2366b91d9cd257dad
MD5 645f262b209c2a194bc409b18b3b35fb
SHA1 b1d99859acf9e9f897063b68073cc1d777398dff
SHA512 b688cefb8940037eb9f719610c59b9ca5f0e5d3e64f6f94a1004bb42478cdf302081ed31ca5f31f72856e0a6636b26fc57f9ff89c5b8db32fdcbc945f0d03f6a
SSDEEP 3072:ktKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:kIJjiJcbI03GBc3ucY5DCSj
TLSH
T148545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spnhfaxvpn.sys

Path C:\Temp\spnhfaxvpn.sys
Size 293KB
SHA256 b68135ce67f7c965e337c255a60151b1cb18017131f6c22e284d9756b5006ebe
MD5 bffc3d212506a387c6230ae2eca3ff52
SHA1 43c5ade9e268a13ba5bf3ebf5adce42f99ffebc6
SHA512 4a147a04ff9328e55de3525d99656af4b9286b76074edaf4d91345d61b169ab9dbf135bf1c94a82446ae6814e86f5be1e3655c28f85e59b49f2c9fec11c68684
SSDEEP 3072:+tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:+IJjiJcbI03GBc3ucY5DCSj
TLSH
T18E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspnhfaxsp.sys

Path C:\Temp\xspnhfaxsp.sys
Size 293KB
SHA256 4a8b706a649207b6cae24540e09b948ab934b46183039a9960ab6bb1ae6a01a1
MD5 bc308b077dc9400f60b28d2c0d35c833
SHA1 0d7efff681de8d44472b0d576f0f489a539b12cb
SHA512 96b409ce6af945b3e304d1337dec3f2ecaeddc141599654eee1216d425ab3754484cb4c57f525c957d604f62daee864e4f8489cbfeecbb692b4f4f6f2166bf91
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T166545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5985c09ea5aba349ed09b6fbc8eb9de203d87b937b3d15e178f9c8ddcbff5fc4
MD5 e9a5ff2b0bd541088cbaf6dbd9eb6cfa
SHA1 60e6975adef4a868df5a5d6f9fb782231278bcf5
SHA512 e573c63ce0ec4d161da9da1b14857404f5c1f5af8b80f751885854997c605c94192d043d14e48d5f6bfbcb5acfd0c3f0babe2845bc5a88fcfea7fe29c0156ca2
TLSH
T1CFD02220BB200808C882B230B0B0830CA220C2E8800082280000FA388EA22820A2B8AE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3b373b285262d249dbcb9a3049cb52ea4237fe0652081e7e8fc809216bf0741c
MD5 d654bc36905ca65fa089ed6415e1c5a5
SHA1 32d7e4997a7ad3c5350ef0dea5604fb990fb1c21
SHA512 b3861ef455d1d571b80f1b2c3f4170907ac4ef2bccdff0e11f8d8be2450c0e927dd70ff2e49f8dd530aa5a889e7a5d1a3bb70bb176dc5b1cac4c1a3139df7931
TLSH
T188D09265BB555A48D982B631B4B4935DA224C6E9A40486284050FA798EA26820A6B8AE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 644d2fce4948a660a5aa82621b94a6a5312c5210a281cd758434c30e27cffb05
MD5 79c1f44cb48cd35894e0e8aaf0ac9df2
SHA1 07f112b4b0c9c718fcf2aacc34992c689833c112
SHA512 203d622cd9fe508090e1c270fad7dd1905c2009266490611a00e506a2ee4b5a59a94ee26b5c674e93879999de5f4649ffd2ebae431790e59af39fe6bde5dde5d
TLSH
T1A261746403A904EAD71E867297D3139BB63399BB01C7DE409C90B0F2D836F20D6B3CA0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 56b3d00856bdf323f32f4baf31931d03e29f4f4ed4de8f646590be24aba24432
MD5 4ca98d276d85fa64d71cc3965117c3d6
SHA1 18b901018222197da90d2826d336436f0740a2ef
SHA512 5f9893eaadde8c5a6fc31955f2f06b483c5699a0849e213332bbaa2234f95a9170091d385f8e503a96394d120ca917d5e551ff86d8521a18b8ebae7c45ab2c16
TLSH
T16161746403A904EAD71E867297D31387B63399BB01C7DE409C80B0F2D836F20D6B2CA0
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 77739418c4dbe8bdb0d8b46d64fa85e37e70d58f18b51f8abbc81cf0bbb41c2d
MD5 3fa2870d2b48911d634a897521aaadc0
SHA1 45f5534ff0af54ef46fa41a9a66221436e19655a
SHA512 86847e49a7fbd87db39e879275100a025caa31203018073c49c932c871ad9d205b8b8309c9a3124e5a19d8ebe7af430268bc6803f02275e135c995199e8c7713
TLSH
T12E41ADF3C3E4856E8A1196F4AA187E2BCE1D0915432C3D5A89E4EF1BA3E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 25e3c54aa6f86f3d761326bc3e32e3c66637f6cbb1cc88e6b796f4fa6ae462d9
MD5 6d80f6d5547f8424112e3d48e2457fe6
SHA1 afd9280a80a6bd1097d238d4695a1c0c97a52354
SHA512 53a8d73ce88da56aed0ce63131fce0a2de3ae2108377c12bfd495f5ef581a20884936fea6d288a8a47d9308ee08a9df26a169f142c1de7054d7c2c1ca1131b40
SSDEEP 192:sxRhROyM/jK1Ml8wCI/fbs3NNKZ9lOzoA8pi/g6+WNIYmb5jGvIgD/1J:sxRhk8I/fbs3Xc9lzi/5ISj
TLSH
T1EC52C915AA285937CCDBD309FA557F53D6F81563A6901E44AAFCCA0C01E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5ec007a6a96aa1ef3a1ed79f23849b761c425a3bf47a08aabce783c7ec2d4473
MD5 11845e5cf900dad4c149a4e1aaf2b1e3
SHA1 5cb8d0c9f6f739f7e3bdd062f3c87d94e8d8bcf8
SHA512 851aa711a78e69976df90cf26b079eb487c49dd55bc31efb3422814a3970f327ab6e2f1d07e1aa373113880f7e5daf3adccf45af92f162c32683aeebd8822dfd
SSDEEP 192:sxR+ROyM/jK1Ml8wCI/fbseNNKZ9lOzoA8pi/g6+WNIYmb5jGvIgtJ:sxR+k8I/fbseXc9lzi/5IS3
TLSH
T1CE52C9156A28993BCCDBD30DFA557F53D6F81563A6901E44AAFCCA0C01E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b6184264511b6af98084ed86776caf53d086448d915626dea216d7256435881c
MD5 4e96ba4e1929bf423b32fb40e10c901c
SHA1 dd6cce2da8dd68cd2e92d791eeda0b68517c2a34
SHA512 230cdfe5c460187f67fefb9f4e4aea6f8ff3b613359397f97aaedc23d77553abb5b69d294d8a20a631a5d98a070d1848aa0917037f125d619a4da70b9fc0de44
SSDEEP 192:sxRhROyM/jK1Ml8UQbCI/fbs3NFKZ9tOzoA8prV/g6+WNIYmnDjGvIgD/HJ:sxRhkquI/fbs3Tc9tzJ/5IYN
TLSH
T14A62D915AA285937DCDBD709FA557F53D6F81463A6901E04AAFCCB0C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 2283bcfbf1dfa224dc4ccbc68829ee5922343083a3f274a11b127c69a660ef10
MD5 5998d0c3da1ad7e49d90822f471b34ca
SHA1 154ed71f65be46712f5ce151ececc03d5f906521
SHA512 0495bcb18a281e9e2e30eecc3f91788d542b6fa58df54224f6a2dca2d78e513cb6e3f6e0e19825c4b8a477411034e75c354ae9d62095ab647a6fbc40da9d385f
SSDEEP 768:zdWTf+7pLuL7VoWg0afNy8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXHUIu6Qro3fmdT:zdWTf+E7VoWg0afNyu1jawHUR67+dT
TLSH
T159E2EB7B684CCB7F4F404ADCEC297D8A6DA801CB9AD8C99447FA881C03C67EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a3ea0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a3ea0.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 8b5abcc46316e223abf8d85ce765d3151e3bde207182c75be5f475f345ecac5c
MD5 bc8133a272b5e77cab1038995f3f6ad9
SHA1 0dd1886a82386a6e7c2f6710dc1ac370e1d590d8
SHA512 73d690bc1c402a22dce3b1037221784e156fbee60c18164f735cad54eb196d64d430501ee0c1c89dd03ac5e603f5f0f554043d70d5f8e2b7362caf3370b0ea58
SSDEEP 768:Lrv+4UNbdl3/yam4xWsT0uIi/+ap+Xeq7VBeVH1SVP:LbsbT332RqPI57XEH1o
TLSH
T1C603BF3298A48C738CF2D7C9364B7A177FB8555396840BC0D8E92F0E879B5AD1307A67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 d8f8b5864ac23e2720a0a68ae56777f5a15351fcd26e0d26249d8a576224f26a
MD5 a1b1b6331324b9f598f4cf2502606c8f
SHA1 1ff7f3b9ef5a3dbcb86869961ebe32008042f7a9
SHA512 c84e73931734ee2c427b07413edbb23122d982830d8dda5e0fcace1c14a23fe876817cad0ee42f925a6f90d9dad5923a41e1da5ed913be047ac797b0e5622ccb
SSDEEP 768:WFKj+9h3awg31rUCsT0uIi/+ap+Xeq7pKMj+4:u9h38RqPI57wh4
TLSH
T1B4039E32D895CD6BADE287D9770A7B97DEE411A38AC85DC4DAD86D4D00C32EE0307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 89bc26a918465cff7486a5b1b54db04cb14e4724c1a5a715a461aafb65e7a8b8
MD5 29bbf7879cae4cd0adfdbcf36d879487
SHA1 9f5bdadb5aa0a1075591692f8c08e79a65b9003d
SHA512 a0ebdd9a71b95c4c6af60e4c1787536c40e87ac848593e8408c18820c398ad2f138890e537a8900b7df31629f7033b30888f52916e47358d0e8e7914e84b4dac
SSDEEP 768:jj+9o3D1Ham4xAesT0uIi/+ap+Xeq7pKMj+4:m9o3YzRqPI57wh4
TLSH
T170F2C03298558C638DE5C399360B3B97EFA825A38AC41FC4DDE96E0D41C36AD1707937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 d7d50d3e9125251fd31a4a55507ba62de97b0ae3a7f4df00d22ed1c8ae4b5820
MD5 8198e20489b2067d6a9b9553acb7ae26
SHA1 c52846282ceb259a237bf79a7a22938c4644a009
SHA512 a65ff31eaa143159eb4487ffbacfa927dbf42cd180b41ce4866c4435d9224c08276a12e08796c98f8f73c96bfdb0461315af9863b4a16f1ab56bd9875f912764
SSDEEP 768:qj+9o3m1Ham4xAHsT0uIi/+ap+Xeq7pKMj+4:J9o31MRqPI57wh4
TLSH
T19BF2B0329C958C638DE6C399360B3B97EFA415A34AC41FC4D9E86E0D41C36AD1707937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5c30207c880da5710b518204425ba80aa5152387120bd301b94a9d7552054b1b
MD5 acde57262365b444d895439051712d73
SHA1 d93827d2d99099f2d3cc2a2433853b0d2050de13
SHA512 585d1f362399724042a0069f0411f8cfef0a8725e9e3f79d8aaa8c175c17d97959c3434dcf16fc7f2eeea7b48ca25decb69ce7c888bafee2511273c106b25a1b
SSDEEP 768:oj+9o3j1Ham4xAysT0uIi/+ap+Xeq7pKMj+4:39o349RqPI57wh4
TLSH
T132F2B0329C958C638DE6C399360B3B97EFA415A38AC41FC4D9E96E0D41C36AD1707937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

7992f155-908b-4c56-bbef-0b38963a76a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7992f155-908b-4c56-bbef-0b38963a76a7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1768_1964805456\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 d2952f9274d2cea4a86c79d93a4d30765355c927cedb5fe3ee487cecd19f7e93
MD5 c9d1155fcf384c2d1260555e7d2dde68
SHA1 0d3ca62ebc7bfb7f8db5baf723ca2d61dc588d37
SHA512 a5b855eb7964f99fe040604dfc29965972f7c47575c10c6d622c3dafc2fa88de09a6585c8875d57c2cea4bc19d0e71692074bb3c010f6e22f6e36b6886c7569d
TLSH
T13D71238357B9C5B2C5DE9FF002835644F6FB2238073330300B915546BB30A3A24B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1464-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1488-365-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1552-268-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1708-438-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2248-418-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2320-377-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2420-240-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2444-450-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2580-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3180-280-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3984-335-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4568-422-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4572-336-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4572-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4580-361-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4700-394-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4752-193-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5528-310-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5652-398-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5696-427-0x0000000000010000-0x00000000000AB000-memory.dmp

Download