systex | 094d3d46847b0bcba28aa12d193b3a753df4d3a519a105a0666f2b8c534563cf

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 17:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260709-vz3ncaft61
SHA256 094d3d46847b0bcba28aa12d193b3a753df4d3a519a105a0666f2b8c534563cf
MD5 5a6a0742e8a5548b4618191d43079d20
SHA1 ca1aba07ecb70652fe645fb8142ab961bf9ddff2
SHA512 8b0b5b86eaffa17cb94c55c8dc89304b9dbe02d7e2b62d1ca841e5e6dc4cf38067c76d1a32fbf094a1d03bea34cd21e3df329a8c010f0621eb62145feaab5753
SSDEEP 12288:OflfAsiVGjSGecvXAflfAsiVGjSGecvX:qMcfcMcf
TLSH
T1A2F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
928	jeuoljdbwtrljhby.exe
2564	jeuoljdbwtrljhby.sys
4808	CreateProcess.exe
1592	gbztrlgeyt.exe
4860	CreateProcess.exe
2112	CreateProcess.exe
5484	i_gbztrlgeyt.exe
5812	jeywqolgeb.sys
4256	CreateProcess.exe
4664	nljdbvtnlg.exe
2400	CreateProcess.exe
5628	CreateProcess.exe
5836	i_nljdbvtnlg.exe
5668	tnljdbvtnl.sys
4844	CreateProcess.exe
2800	lidbvtnlgd.exe
1536	CreateProcess.exe
1424	CreateProcess.exe
4656	i_lidbvtnlgd.exe
2652	lidavsnlfd.sys
4672	CreateProcess.exe
6020	dxvpnifays.exe
2464	CreateProcess.exe
2608	CreateProcess.exe
2432	i_dxvpnifays.exe
1912	hfaxspkfdx.sys
2564	CreateProcess.exe
6124	xusnkfdxvp.exe
2424	CreateProcess.exe
5472	CreateProcess.exe
2016	i_xusnkfdxvp.exe
4620	zxvpfzxspk.sys
4784	CreateProcess.exe
4492	khcausmhfc.exe
4320	CreateProcess.exe
2200	CreateProcess.exe
2204	i_khcausmhfc.exe
4396	mhfzxrpkhc.sys
1228	CreateProcess.exe
4456	rpmhezuomk.exe
5680	CreateProcess.exe
4140	CreateProcess.exe
1208	i_rpmhezuomk.exe
1668	gecwurpjhb.sys
1676	CreateProcess.exe
1876	czuomjeczu.exe
4272	CreateProcess.exe
3696	CreateProcess.exe
3360	i_czuomjeczu.exe
4620	geywurljdb.sys
4872	CreateProcess.exe
4120	ywtrljebwt.exe
828	CreateProcess.exe
4824	CreateProcess.exe
4472	i_ywtrljebwt.exe
5056	oigbywqolg.sys
3248	CreateProcess.exe
5476	qljdaywqoi.exe
2360	CreateProcess.exe
3052	CreateProcess.exe
8	i_qljdaywqoi.exe
3796	qnljdbvtnl.sys
1900	CreateProcess.exe
1684	dyvqnliday.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1420869966\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_797562679\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1138352743\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1415781668\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1415781668\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1415781668\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_797562679\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1138352743\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1415781668\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywtrljebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqnliday.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvpnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khcausmhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khcausmhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qljdaywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqnliday.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmhezuomk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czuomjeczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkeczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nljdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywtrljebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifdaysqcax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifdaysqcax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpnkiczxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkeczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbztrlgeyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nljdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmhezuomk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czuomjeczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljdaywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbztrlgeyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpnkiczxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jeuoljdbwtrljhby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusnkfdxvp.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4540	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5316	ipconfig.exe
1292	ipconfig.exe
6040	ipconfig.exe
4804	ipconfig.exe
2404	ipconfig.exe
5944	ipconfig.exe
2512	ipconfig.exe
5424	ipconfig.exe
5248	ipconfig.exe
5752	ipconfig.exe
4876	ipconfig.exe
5380	ipconfig.exe
2160	ipconfig.exe
4824	ipconfig.exe
2268	ipconfig.exe
4552	ipconfig.exe
5948	ipconfig.exe
4052	ipconfig.exe
4504	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{F951F0CF-2CD8-4406-B198-219D7CC28304}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
928	jeuoljdbwtrljhby.exe
928	jeuoljdbwtrljhby.exe
928	jeuoljdbwtrljhby.exe
928	jeuoljdbwtrljhby.exe
928	jeuoljdbwtrljhby.exe
928	jeuoljdbwtrljhby.exe
928	jeuoljdbwtrljhby.exe
928	jeuoljdbwtrljhby.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5484	i_gbztrlgeyt.exe
Token: SeDebugPrivilege	5836	i_nljdbvtnlg.exe
Token: SeDebugPrivilege	4656	i_lidbvtnlgd.exe
Token: SeDebugPrivilege	2432	i_dxvpnifays.exe
Token: SeDebugPrivilege	2016	i_xusnkfdxvp.exe
Token: SeDebugPrivilege	2204	i_khcausmhfc.exe
Token: SeDebugPrivilege	1208	i_rpmhezuomk.exe
Token: SeDebugPrivilege	3360	i_czuomjeczu.exe
Token: SeDebugPrivilege	4472	i_ywtrljebwt.exe
Token: SeDebugPrivilege	8	i_qljdaywqoi.exe
Token: SeDebugPrivilege	6028	i_dyvqnliday.exe
Token: SeDebugPrivilege	3084	i_ifdaysqcax.exe
Token: SeDebugPrivilege	1208	i_xusnkfdxvp.exe
Token: SeDebugPrivilege	4380	i_xrpnkiczxr.exe
Token: SeDebugPrivilege	4184	i_usmkeczurm.exe
Token: SeDebugPrivilege	1128	i_xrpjhczurm.exe
Token: SeDebugPrivilege	8	i_gbztrljdbw.exe
Token: SeDebugPrivilege	4612	i_jdbztrljdb.exe
Token: SeDebugPrivilege	3604	i_gaysqljdbv.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5096	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 928	3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	86
PID 3368 wrote to memory of 4912	3368	2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 4912 wrote to memory of 5096	4912	iexplore.exe	88
PID 5096 wrote to memory of 3416	5096	msedge.exe	89
PID 5096 wrote to memory of 4756	5096	msedge.exe	90
PID 5096 wrote to memory of 4540	5096	msedge.exe	91
PID 5096 wrote to memory of 4756	5096	msedge.exe	90
PID 5096 wrote to memory of 4756	5096	msedge.exe	90
PID 5096 wrote to memory of 3316	5096	msedge.exe	92
PID 5096 wrote to memory of 3316	5096	msedge.exe	92
PID 5096 wrote to memory of 4240	5096	msedge.exe	94
PID 5096 wrote to memory of 4240	5096	msedge.exe	94
PID 5096 wrote to memory of 4296	5096	msedge.exe	93
PID 5096 wrote to memory of 4240	5096	msedge.exe	94
PID 5096 wrote to memory of 4296	5096	msedge.exe	93
PID 5096 wrote to memory of 4296	5096	msedge.exe	93
PID 5096 wrote to memory of 1492	5096	msedge.exe	96
PID 5096 wrote to memory of 1280	5096	msedge.exe	97
PID 5096 wrote to memory of 1492	5096	msedge.exe	96
PID 5096 wrote to memory of 1492	5096	msedge.exe	96
PID 5096 wrote to memory of 1280	5096	msedge.exe	97
PID 5096 wrote to memory of 1280	5096	msedge.exe	97
PID 5096 wrote to memory of 1912	5096	msedge.exe	98
PID 5096 wrote to memory of 1912	5096	msedge.exe	98
PID 928 wrote to memory of 4808	928	jeuoljdbwtrljhby.exe	102
PID 1592 wrote to memory of 4860	1592	gbztrlgeyt.exe	105
PID 5096 wrote to memory of 4496	5096	msedge.exe	108
PID 5096 wrote to memory of 1924	5096	msedge.exe	109
PID 5096 wrote to memory of 4496	5096	msedge.exe	108
PID 5096 wrote to memory of 1924	5096	msedge.exe	109
PID 5096 wrote to memory of 5472	5096	msedge.exe	111
PID 5096 wrote to memory of 5680	5096	msedge.exe	112
PID 5096 wrote to memory of 5680	5096	msedge.exe	112
PID 5096 wrote to memory of 2608	5096	msedge.exe	115
PID 5096 wrote to memory of 2608	5096	msedge.exe	115
PID 928 wrote to memory of 2112	928	jeuoljdbwtrljhby.exe	116
PID 928 wrote to memory of 4256	928	jeuoljdbwtrljhby.exe	120
PID 4664 wrote to memory of 2400	4664	nljdbvtnlg.exe	122
PID 928 wrote to memory of 5628	928	jeuoljdbwtrljhby.exe	125
PID 928 wrote to memory of 4844	928	jeuoljdbwtrljhby.exe	129
PID 2800 wrote to memory of 1536	2800	lidbvtnlgd.exe	131
PID 928 wrote to memory of 1424	928	jeuoljdbwtrljhby.exe	134
PID 928 wrote to memory of 4672	928	jeuoljdbwtrljhby.exe	138
PID 6020 wrote to memory of 2464	6020	dxvpnifays.exe	140
PID 5096 wrote to memory of 4408	5096	msedge.exe	143
PID 5096 wrote to memory of 5268	5096	msedge.exe	144
PID 5096 wrote to memory of 4888	5096	msedge.exe	145
PID 928 wrote to memory of 2608	928	jeuoljdbwtrljhby.exe	146
PID 5096 wrote to memory of 4908	5096	msedge.exe	148
PID 5096 wrote to memory of 4908	5096	msedge.exe	148
PID 5096 wrote to memory of 4908	5096	msedge.exe	148
PID 5096 wrote to memory of 1200	5096	msedge.exe	149
PID 5096 wrote to memory of 1200	5096	msedge.exe	149
PID 5096 wrote to memory of 1200	5096	msedge.exe	149
PID 928 wrote to memory of 2564	928	jeuoljdbwtrljhby.exe	152
PID 6124 wrote to memory of 2424	6124	xusnkfdxvp.exe	154
PID 928 wrote to memory of 5472	928	jeuoljdbwtrljhby.exe	157
PID 928 wrote to memory of 4784	928	jeuoljdbwtrljhby.exe	161
PID 4492 wrote to memory of 4320	4492	khcausmhfc.exe	163
PID 928 wrote to memory of 2200	928	jeuoljdbwtrljhby.exe	166
PID 928 wrote to memory of 1228	928	jeuoljdbwtrljhby.exe	170
PID 4456 wrote to memory of 5680	4456	rpmhezuomk.exe	172
PID 928 wrote to memory of 4140	928	jeuoljdbwtrljhby.exe	175
PID 5096 wrote to memory of 6068	5096	msedge.exe	177

C:\Users\Admin\AppData\Local\Temp\2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_5a6a0742e8a5548b4618191d43079d20_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Temp\jeuoljdbwtrljhby.exe
  C:\Temp\jeuoljdbwtrljhby.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbztrlgeyt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4808
  - - C:\Temp\gbztrlgeyt.exe
      C:\Temp\gbztrlgeyt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1592
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gbztrlgeyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2112
  - - C:\Temp\i_gbztrlgeyt.exe
      C:\Temp\i_gbztrlgeyt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nljdbvtnlg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4256
  - - C:\Temp\nljdbvtnlg.exe
      C:\Temp\nljdbvtnlg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4664
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2400
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nljdbvtnlg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5628
  - - C:\Temp\i_nljdbvtnlg.exe
      C:\Temp\i_nljdbvtnlg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lidbvtnlgd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4844
  - - C:\Temp\lidbvtnlgd.exe
      C:\Temp\lidbvtnlgd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2800
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1536
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lidbvtnlgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1424
  - - C:\Temp\i_lidbvtnlgd.exe
      C:\Temp\i_lidbvtnlgd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvpnifays.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4672
  - - C:\Temp\dxvpnifays.exe
      C:\Temp\dxvpnifays.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2464
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvpnifays.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2608
  - - C:\Temp\i_dxvpnifays.exe
      C:\Temp\i_dxvpnifays.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xusnkfdxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2564
  - - C:\Temp\xusnkfdxvp.exe
      C:\Temp\xusnkfdxvp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6124
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2424
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xusnkfdxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5472
  - - C:\Temp\i_xusnkfdxvp.exe
      C:\Temp\i_xusnkfdxvp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khcausmhfc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4784
  - - C:\Temp\khcausmhfc.exe
      C:\Temp\khcausmhfc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4492
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4320
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khcausmhfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2200
  - - C:\Temp\i_khcausmhfc.exe
      C:\Temp\i_khcausmhfc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpmhezuomk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1228
  - - C:\Temp\rpmhezuomk.exe
      C:\Temp\rpmhezuomk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4456
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5680
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpmhezuomk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4140
  - - C:\Temp\i_rpmhezuomk.exe
      C:\Temp\i_rpmhezuomk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czuomjeczu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1676
  - - C:\Temp\czuomjeczu.exe
      C:\Temp\czuomjeczu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1876
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4272
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czuomjeczu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3696
  - - C:\Temp\i_czuomjeczu.exe
      C:\Temp\i_czuomjeczu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywtrljebwt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4872
  - - C:\Temp\ywtrljebwt.exe
      C:\Temp\ywtrljebwt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4120
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:828
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywtrljebwt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4824
  - - C:\Temp\i_ywtrljebwt.exe
      C:\Temp\i_ywtrljebwt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qljdaywqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3248
  - - C:\Temp\qljdaywqoi.exe
      C:\Temp\qljdaywqoi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5476
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2360
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qljdaywqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3052
  - - C:\Temp\i_qljdaywqoi.exe
      C:\Temp\i_qljdaywqoi.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:8
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dyvqnliday.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1900
  - - C:\Temp\dyvqnliday.exe
      C:\Temp\dyvqnliday.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1684
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5424
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dyvqnliday.exe ups_ins
    3⤵
    PID:2628
  - - C:\Temp\i_dyvqnliday.exe
      C:\Temp\i_dyvqnliday.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifdaysqcax.exe ups_run
    3⤵
    PID:5312
  - - C:\Temp\ifdaysqcax.exe
      C:\Temp\ifdaysqcax.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2912
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1072
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifdaysqcax.exe ups_ins
    3⤵
    PID:200
  - - C:\Temp\i_ifdaysqcax.exe
      C:\Temp\i_ifdaysqcax.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xusnkfdxvp.exe ups_run
    3⤵
    PID:3160
  - - C:\Temp\xusnkfdxvp.exe
      C:\Temp\xusnkfdxvp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4356
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2372
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xusnkfdxvp.exe ups_ins
    3⤵
    PID:1088
  - - C:\Temp\i_xusnkfdxvp.exe
      C:\Temp\i_xusnkfdxvp.exe ups_ins
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpnkiczxr.exe ups_run
    3⤵
    PID:5356
  - - C:\Temp\xrpnkiczxr.exe
      C:\Temp\xrpnkiczxr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2432
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpnkiczxr.exe ups_ins
    3⤵
    PID:6040
  - - C:\Temp\i_xrpnkiczxr.exe
      C:\Temp\i_xrpnkiczxr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkeczurm.exe ups_run
    3⤵
    PID:5976
  - - C:\Temp\usmkeczurm.exe
      C:\Temp\usmkeczurm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1756
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6024
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkeczurm.exe ups_ins
    3⤵
    PID:4204
  - - C:\Temp\i_usmkeczurm.exe
      C:\Temp\i_usmkeczurm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpjhczurm.exe ups_run
    3⤵
    PID:3364
  - - C:\Temp\xrpjhczurm.exe
      C:\Temp\xrpjhczurm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3220
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpjhczurm.exe ups_ins
    3⤵
    PID:5516
  - - C:\Temp\i_xrpjhczurm.exe
      C:\Temp\i_xrpjhczurm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbztrljdbw.exe ups_run
    3⤵
    PID:1068
  - - C:\Temp\gbztrljdbw.exe
      C:\Temp\gbztrljdbw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3612
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4504
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gbztrljdbw.exe ups_ins
    3⤵
    PID:436
  - - C:\Temp\i_gbztrljdbw.exe
      C:\Temp\i_gbztrljdbw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:8
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbztrljdb.exe ups_run
    3⤵
    PID:2292
  - - C:\Temp\jdbztrljdb.exe
      C:\Temp\jdbztrljdb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1512
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1964
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbztrljdb.exe ups_ins
    3⤵
    PID:5920
  - - C:\Temp\i_jdbztrljdb.exe
      C:\Temp\i_jdbztrljdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaysqljdbv.exe ups_run
    3⤵
    PID:3812
  - - C:\Temp\gaysqljdbv.exe
      C:\Temp\gaysqljdbv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:888
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3348
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaysqljdbv.exe ups_ins
    3⤵
    PID:4232
  - - C:\Temp\i_gaysqljdbv.exe
      C:\Temp\i_gaysqljdbv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3604
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x2c8,0x7fff263ec188,0x7fff263ec194,0x7fff263ec1a0
      4⤵
      PID:3416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,2325747706858867542,9435227437138175718,262144 --field-trial-handle=2612,i,6655556418387972700,11091710483054952321,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:2
      4⤵
      PID:4756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,4920647253796196214,9739037881507614598,524288 --field-trial-handle=2612,i,6655556418387972700,11091710483054952321,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:11
      4⤵
      System Time Discovery
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,14755978785242994374,17153993812177897432,524288 --field-trial-handle=2612,i,6655556418387972700,11091710483054952321,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:13
      4⤵
      PID:3316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,8167532672897922262,8637314781369776749,2097152 --field-trial-handle=2612,i,6655556418387972700,11091710483054952321,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
      4⤵
      PID:4296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,5865430942332922357,9243473622179819086,2097152 --field-trial-handle=2612,i,6655556418387972700,11091710483054952321,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      PID:4240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4072,i,5551161351930904669,4580989381755674030,2097152 --field-trial-handle=2612,i,6655556418387972700,11091710483054952321,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
      4⤵
      PID:1492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4084,i,12271964171953048798,10872145086526096418,2097152 --field-trial-handle=2612,i,6655556418387972700,11091710483054952321,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:9
      4⤵
      PID:1280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,12878110839320325651,5686672489498708710,524288 --field-trial-handle=2612,i,6655556418387972700,11091710483054952321,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:14
      4⤵
      PID:1912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,578943117747618077,5380934419719209670,524288 --field-trial-handle=2612,i,6655556418387972700,11091710483054952321,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
      4⤵
      PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,8447315426893006898,16006337410515657004,524288 --field-trial-handle=2612,i,6655556418387972700,11091710483054952321,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:14
      4⤵
      PID:1924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,4904824978006795947,9086985377903132354,524288 --field-trial-handle=2612,i,6655556418387972700,11091710483054952321,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,4904824978006795947,9086985377903132354,524288 --field-trial-handle=2612,i,6655556418387972700,11091710483054952321,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
      4⤵
      PID:5472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,6541217155853764706,14876574709922682553,524288 --field-trial-handle=2612,i,6655556418387972700,11091710483054952321,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
      4⤵
      PID:5680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,9616301570613283720,5732383869160750236,524288 --field-trial-handle=2612,i,6655556418387972700,11091710483054952321,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
      4⤵
      PID:2608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,10241547531216299280,7711435232214474688,524288 --field-trial-handle=2612,i,6655556418387972700,11091710483054952321,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
      4⤵
      PID:4408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4640,i,16903353357905688439,18056863368347043070,524288 --field-trial-handle=2612,i,6655556418387972700,11091710483054952321,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
      4⤵
      PID:5268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,10296098020044435213,8167671530839709532,524288 --field-trial-handle=2612,i,6655556418387972700,11091710483054952321,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:4888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4956,i,10580077236412919415,2258959004648305334,2097152 --field-trial-handle=2612,i,6655556418387972700,11091710483054952321,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:1
      4⤵
      PID:4908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5052,i,3594408176780968600,403318023486655173,2097152 --field-trial-handle=2612,i,6655556418387972700,11091710483054952321,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      PID:1200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3560,i,12373465053729304064,6536373340586076649,2097152 --field-trial-handle=2612,i,6655556418387972700,11091710483054952321,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
      4⤵
      PID:6068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,12772627730351949413,956886133583105929,524288 --field-trial-handle=2612,i,6655556418387972700,11091710483054952321,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:14
      4⤵
      PID:5784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,12951539829371900023,14701661455017653408,524288 --field-trial-handle=2612,i,6655556418387972700,11091710483054952321,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:2888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,13175165369269328064,13010333656070809353,524288 --field-trial-handle=2612,i,6655556418387972700,11091710483054952321,262144 --variations-seed-version --mojo-platform-channel-handle=916 /prefetch:14
      4⤵
      PID:2136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,17788223031394976084,1104941435699874011,524288 --field-trial-handle=2612,i,6655556418387972700,11091710483054952321,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
      4⤵
      PID:3348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5632,i,4357405855134943998,6211866093882350538,262144 --field-trial-handle=2612,i,6655556418387972700,11091710483054952321,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:10
      4⤵
      PID:3880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,14977780976197888013,4886080363876384589,524288 --field-trial-handle=2612,i,6655556418387972700,11091710483054952321,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
      4⤵
      PID:4172

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:236

C:\Temp\jeuoljdbwtrljhby.sys
C:\Temp\jeuoljdbwtrljhby.sys
1⤵
- Executes dropped EXE
PID:2564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4640

C:\Temp\jeywqolgeb.sys
C:\Temp\jeywqolgeb.sys
1⤵
- Executes dropped EXE
PID:5812

C:\Temp\tnljdbvtnl.sys
C:\Temp\tnljdbvtnl.sys
1⤵
- Executes dropped EXE
PID:5668

C:\Temp\lidavsnlfd.sys
C:\Temp\lidavsnlfd.sys
1⤵
- Executes dropped EXE
PID:2652

C:\Temp\hfaxspkfdx.sys
C:\Temp\hfaxspkfdx.sys
1⤵
- Executes dropped EXE
PID:1912

C:\Temp\zxvpfzxspk.sys
C:\Temp\zxvpfzxspk.sys
1⤵
- Executes dropped EXE
PID:4620

C:\Temp\mhfzxrpkhc.sys
C:\Temp\mhfzxrpkhc.sys
1⤵
- Executes dropped EXE
PID:4396

C:\Temp\gecwurpjhb.sys
C:\Temp\gecwurpjhb.sys
1⤵
- Executes dropped EXE
PID:1668

C:\Temp\geywurljdb.sys
C:\Temp\geywurljdb.sys
1⤵
- Executes dropped EXE
PID:4620

C:\Temp\oigbywqolg.sys
C:\Temp\oigbywqolg.sys
1⤵
- Executes dropped EXE
PID:5056

C:\Temp\qnljdbvtnl.sys
C:\Temp\qnljdbvtnl.sys
1⤵
- Executes dropped EXE
PID:3796

C:\Temp\igaysqnlid.sys
C:\Temp\igaysqnlid.sys
1⤵
PID:1280

C:\Temp\davsqkicau.sys
C:\Temp\davsqkicau.sys
1⤵
PID:1220

C:\Temp\xspkhcausp.sys
C:\Temp\xspkhcausp.sys
1⤵
PID:5268

C:\Temp\hfzxrpjhcz.sys
C:\Temp\hfzxrpjhcz.sys
1⤵
PID:6028

C:\Temp\wrpjhbzurm.sys
C:\Temp\wrpjhbzurm.sys
1⤵
PID:1340

C:\Temp\jgbztrojhb.sys
C:\Temp\jgbztrojhb.sys
1⤵
PID:3036

C:\Temp\jdbwtoljdb.sys
C:\Temp\jdbwtoljdb.sys
1⤵
PID:5224

C:\Temp\igaywqoljd.sys
C:\Temp\igaywqoljd.sys
1⤵
PID:252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dxvpnifays.exe

Path C:\Temp\dxvpnifays.exe
Size 722KB
SHA256 09c9298c83e7ac3049f9b1c4bb9719ec7397bd89b75245af47a5ed5cb2f2dd93
MD5 2e71edfa012b84faf9137efffc8ef8c8
SHA1 902dd071bad5cf37670d7cb9b24063a3553f0633
SHA512 9ba5cf0c90838f94503d2487704a6fc112dcf37d07316e66e61f7d503fe554c75bce4f68d284a4e14241987a7262062234000db5ef85dc9beceb094edad1f517
SSDEEP 12288:SflfAsiVGjSGecvXAflfAsiVGjSGecvX:eMcfcMcf
TLSH
T10DF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbztrlgeyt.exe

Path C:\Temp\gbztrlgeyt.exe
Size 722KB
SHA256 0e01c910aa1582f1621547beb771d142ef4019e870daf77c8e842fe3dd170393
MD5 2a58b1d427ca0c91f6ca362d768cfe37
SHA1 b0caf5ec0df083f828f80000910fc6c50b079c07
SHA512 14ae70bec90979997a5d524a6ea961494f1e87ff595925b3ac2addf7695df90f7b6d631dd51c7817ef2f545ce16be1b641ae5cc9a55046ac925a2fe0ff09ac7a
SSDEEP 12288:sflfAsiVGjSGecvXAflfAsiVGjSGecvX:4McfcMcf
TLSH
T1CCF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfaxspkfdx.sys

Path C:\Temp\hfaxspkfdx.sys
Size 293KB
SHA256 aa390b134fab1d1f0f8712716d6a84a4a4dd6da9b40984b5e8cae7b9b8d6edcc
MD5 375a70cea1d2a4e11e315687442b3233
SHA1 d51a1a95b16aa61565845c009eea11d22b653c01
SHA512 8e36052b6233a191dbce3c4f26adb93096a605502df0337aa480111ef0aae7992185da6e939d0ebc7d964d38e6e4b0de61ed54752a9825dd6690569882293246
SSDEEP 3072:4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:4IJjiJcbI03GBc3ucY5DCSj
TLSH
T163545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dxvpnifays.exe

Path C:\Temp\i_dxvpnifays.exe
Size 722KB
SHA256 34fe84ba74ff51fe0991eac4d93d14dcd0b084a8e18b3d1dfeb3bcd84073d523
MD5 55de20bed4c6304007ad2dc088892c67
SHA1 3e407c88308bdde33fbeaa0b9f1c2225b5d36a05
SHA512 21b88d0e7d2580d45d79cd332a0a04224599df688a4edeaaf79c6fb146b2ccfc9f44afb3d2f270d92f330fec1eaa8028145d7a9a3cfa7dfb481bd61bc44eb9ab
SSDEEP 12288:hflfAsiVGjSGecvXAflfAsiVGjSGecvX:JMcfcMcf
TLSH
T125F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbztrlgeyt.exe

Path C:\Temp\i_gbztrlgeyt.exe
Size 722KB
SHA256 54a36b9a98a909ee2d4a5541569fd8ab7dfcd3b23f82fa7608425d1b25e798a9
MD5 28240f350c40d84ec0a5465ee01c7038
SHA1 27a514761100d0423bffbfb67b5aa0baa6146051
SHA512 c598794c1122656e9b78d2b7a75abc3a475a20d87152203475e51078590b31dc242423fc149b1d7e05356f3818f517479da3223f160f1f0e775430fdba6da8d9
SSDEEP 12288:IflfAsiVGjSGecvXAflfAsiVGjSGecvX:UMcfcMcf
TLSH
T1AAF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lidbvtnlgd.exe

Path C:\Temp\i_lidbvtnlgd.exe
Size 722KB
SHA256 952284866a72f60d9f5d83644500dc99b1cce8f9d93f649cc7e9f070ae2d9bc6
MD5 60de3e769d7928788c0d6a763f336e94
SHA1 ee5adbd90c830da0366551be9edc1340dc862d53
SHA512 e2ace96796f1d8c31f6351a2fa84f0b89595bb3f09058055e17f578f299c6c7785d63bbaa358b4def3f678e8d462a115dfcccba5c159f2fc972b08cc4646a2a4
SSDEEP 12288:NflfAsiVGjSGecvXAflfAsiVGjSGecvX:lMcfcMcf
TLSH
T1EDF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nljdbvtnlg.exe

Path C:\Temp\i_nljdbvtnlg.exe
Size 722KB
SHA256 060aee8d6f482f39d4d03b1b7bee163904219b5046f6f1fb2a0793a5c5b2f722
MD5 d9ab52dfce87279d0364435cc322eaa5
SHA1 f2e93fdfe155dc22ce481e06a80c0a9bca33c06a
SHA512 eb0885de7df5f5911c08cdddb7317317b10a6851c2647ca7384c61a4c84c45629cf04809645a0cee9298c859ccbc09a966db8e8f04e087fcab2446297f76b49a
SSDEEP 12288:wflfAsiVGjSGecvXAflfAsiVGjSGecvX:sMcfcMcf
TLSH
T1A7F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xusnkfdxvp.exe

Path C:\Temp\i_xusnkfdxvp.exe
Size 722KB
SHA256 550a6f97cb6f19a841bed5bcd52d7bcdf11a37b84d58680279860717f2fdfd8b
MD5 c83de121aeb2edc1917d77007b303ab5
SHA1 b7d9004659cbe62db673468c943f0ac48b4f47de
SHA512 927436440f3e91724a38b81a4975369f08b0d7bf1f06495dd64e86d3ce4b19b66ba6989308c49758ae47e77606009898ebf102a44f802083f837a132a42de986
SSDEEP 12288:NflfAsiVGjSGecvXAflfAsiVGjSGecvX:lMcfcMcf
TLSH
T1EEF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jeuoljdbwtrljhby.exe

Path C:\Temp\jeuoljdbwtrljhby.exe
Size 722KB
SHA256 02dc0a4e5bf6cbb1323e14bda29a3cdc366025fe815710bcf5fbae3332e4a85b
MD5 c009c5e7f3d7f11224693ff27ed5d961
SHA1 2e45770c2cf38517efbc3f73c2c11de420af5bb6
SHA512 a1b27f09ef91da3bbf5cf8c96ed0ee4f29cfc8e1097d8c260848929e1570c4a36627922f3d142f4e4231a1b56d736a75db0d436dfaed504d927d93cc84e955ac
SSDEEP 12288:iflfAsiVGjSGecvXAflfAsiVGjSGecvX:OMcfcMcf
TLSH
T105F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jeuoljdbwtrljhby.sys

Path C:\Temp\jeuoljdbwtrljhby.sys
Size 293KB
SHA256 e2268c91fd8542daf27a3521cb1e29c1c36917ff46180eee523b428c3df8adf4
MD5 9c3cf4afc916685c0c2f5e90cb479a36
SHA1 6717a40efd1fb9b73a5d5844f6e89c1928f8584e
SHA512 35e70e49c8d7afbc5a7d5896e07b8f3e04461d960ea87d3b7d3df60b62854192d064fb910e0d5f1e062d83b01336cf85384569bed6226145e764bf636443ef18
SSDEEP 3072:ptKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:pIJjiJcbI03GBc3ucY5DCSj
TLSH
T195545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jeywqolgeb.sys

Path C:\Temp\jeywqolgeb.sys
Size 293KB
SHA256 0f1cef6704a20469c15b25a09d5ce228bf0f51b04478a24227074504d7068fca
MD5 2952e627057ce6a0954041aade64ee0b
SHA1 2e9d1348d6f6bba6663a118a289103d45751559b
SHA512 6c01549f5aeacc01277e78153254c79fda7bb82cf6c3639855a3762d38ed4dac365bb3266a4941b3c9a6720f681d7b9704a404a9d2917f198ffa981106f73c4b
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T128545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khcausmhfc.exe

Path C:\Temp\khcausmhfc.exe
Size 722KB
SHA256 600846f8e2be23cb7d31fa5362516eeef90db86cb65d742ff16e508fc5249941
MD5 2f0856ef8f77fd68a1505515c223b12d
SHA1 fdd1465b3f4a2cd502871307b4000d28bd243ebb
SHA512 37ccccc9aee55227839e45a08d28f94672474bba58537b7109f9557b5a590935b5b7ea4975bdaaa8dfd06a156faffdb7c187f4be134ce7e76a3b747625808550
SSDEEP 12288:FflfAsiVGjSGecvXAflfAsiVGjSGecvX:NMcfcMcf
TLSH
T15AF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidavsnlfd.sys

Path C:\Temp\lidavsnlfd.sys
Size 293KB
SHA256 95a029a164df5ba2d18515855e1bc17db9560a99fdf86453add2620fe87c05d2
MD5 e8875ed382b0115f00625465b27dcd19
SHA1 fb72ee04f5e23f9721f9bc1a081a342dd3a6dfed
SHA512 b3e3b8f9381847fbc4356056a7429bb97b631c0474df82dc4702f62ac4b082ef11e8f97776825f72519b27109dc1a6e9f0da8d723ac64a3939c63690c4d0ae97
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T13B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidbvtnlgd.exe

Path C:\Temp\lidbvtnlgd.exe
Size 722KB
SHA256 da526bd41eb922248d8f7b6b2cdb4de3d0a2af512530ca13119f422b9e71c050
MD5 59a3721a833ae4146d58d774f76e4e04
SHA1 4595fe5ec9aa6ccd0ee77dc4eafe77c4345b1af8
SHA512 1841e3f2be74196c40f6310cf57df2a34e8883addbb351634f4ea86a5419a0ca3df286f006c9108263edecf456d5c322567a1584dcffe39bfb8785bfd026e34c
SSDEEP 12288:BflfAsiVGjSGecvXAflfAsiVGjSGecvX:pMcfcMcf
TLSH
T10EF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nljdbvtnlg.exe

Path C:\Temp\nljdbvtnlg.exe
Size 722KB
SHA256 6c4007efc5189e22f1357e858e15da5d5e8ac50932d839e785b28036861db866
MD5 432207e07160da28fe414f9057257707
SHA1 a748af2d3a75785b4bf537facc6ca8ec39a6c001
SHA512 002bc458eac02e52afef06ffd0b2a4e5a7ecbf564a843d1154190b21a1d8521ba8d510e5c9530402c0ee33a09c4ba6050c0082df32db2ea9c04d6e823367be26
SSDEEP 12288:XflfAsiVGjSGecvXAflfAsiVGjSGecvX:vMcfcMcf
TLSH
T12FF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnljdbvtnl.sys

Path C:\Temp\tnljdbvtnl.sys
Size 293KB
SHA256 4fe6b086ffd235ce746d0803e459261a906f5babc302e18642cb544113c8371f
MD5 b0284cbc07db1659aaf0d13ff19e0b2c
SHA1 3d776639c2f60cb7bc8ed715d34817da3a268889
SHA512 13cb34dda52504633b421fb63ba765c81d32fdc3718785dd3ad1b47a48f3d72dd38c81525f46424bc46c0df3c50fefb8ac41753facc2c8b9e471b43adf363c6b
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T139545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xusnkfdxvp.exe

Path C:\Temp\xusnkfdxvp.exe
Size 722KB
SHA256 998d2faae306b557c88f4ac0ed9003df8f834f5325f23245c6c18bb6187461e3
MD5 4825a891ddf796cd689568b326ecb21b
SHA1 14eade687888ef4c5614e2711a69a93601c7c356
SHA512 e553bfdbadd2671606f0d353107d6948a6f1de027e480c4a1c67ce8834eb13dea105e31b8868c6a670284c9bc77d254cda2d5dd923b5cd925a684ec2bb7beac9
SSDEEP 12288:oflfAsiVGjSGecvXAflfAsiVGjSGecvX:0McfcMcf
TLSH
T12EF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxvpfzxspk.sys

Path C:\Temp\zxvpfzxspk.sys
Size 293KB
SHA256 7838c86aaec6810f86c17bad86c5761c9207ec8d135522f050ce9f94704a9d99
MD5 f37b46c6de6ba5b0efd922f41208c905
SHA1 e048ad3a9b3e5eaf623a88929680e6555c508d3c
SHA512 6734abd173d102ba2d53011e343c508583f3ce1d02fcaa315e7f235aa1844112196dd0f4589d975ac0faa04801afef848c046daf440a4814ba4979e22f26776c
SSDEEP 3072:NtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:NIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 16c97ccea458693565f0a9ab138dc20ffd72ed22178e5aa30438f7ed5df2c1e9
MD5 bf69ea56774048a863c32e1d4ecd03a6
SHA1 e429dfa9415227da89e6318515d51f24a4f9b447
SHA512 b160a63afabf512d54c791c615a27c01bef0b57390dbe4df923f7819136310eac22f781e49d0b951114c9614e9cad97efe258c5ed1b6ca72f7e5d4c762d84f43
TLSH
T10051528203263AC1E77955F297E984C8B7F9B7A9490B5EFA120C1C7A5E0EF4490C812F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a7df.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a7df.TMP
Size 2KB
SHA256 0a941c9772f5b6f6b4a486ea1702dc2fa820d148f4740c70a4aebc600a3fe21f
MD5 448d34af2baa154d27520a253ec81add
SHA1 cc489d7506848553d3b3a39629bd798b1a1be2d8
SHA512 48709f5e416ae28199115940562e5841ff69cf21bb3c37ed7d11496125762d7d6004a09f3db0c1d81d921a7b8d5bc822369f34e2f2af6119643e6531f97dc74f
TLSH
T1DF51458203263AC1E77955F29BE944C8B7F9B7A94C0B5EFA120C1C7A5D4EF4494C912F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 16fa9742cd2d05cd48ba6b762ee996a8607af835f515dced842b8d426efba2b1
MD5 d5ea8ca733d8150a06f0dcbd6b4c9acb
SHA1 e6d4d6643e539ca5ddb0413bc08f6bee24f8652e
SHA512 1e5b99ad56d830aa7b0eb593f6122e1953fbc4ff1ae0b9dccd5a5d346274f92ca14ac8009f3ce44ed8783475dc133276b1d9a267a0a21bba16a77288d9375f49
TLSH
T16351E0F3C7E8866DC91156F0AB147E2BDE2D0914432C3D5AC9E4EF1BA3E2471D14195E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b04335dd417a0feda176b70fe0e837e106e93c36a7fb87d16baf88ff86e09ca3
MD5 d3ad8663ea42c10f844d27989e56908d
SHA1 78905a19d7f4baa18231f01f70036c8eaf9dc662
SHA512 8980e53abecc0baa124081f449d4b7ce6a08dab5564f9026970ba76542f4af03364cc3a6323c54f4123be8bb8af0a81cb02ddee6c7697e6bed1797145054147e
SSDEEP 192:sxRtRJyM/jK1Ml8wCD/fqsS2jL9cDZJ5zoD8pi/g6+WNIYCsuOhGNIgtJ:sxRtB8D/fqsSOatfi/5Iey3
TLSH
T11452E9166A34597BCCCBD20DFA557F93D6F85573A2901E44AAFCCA0C04E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e2a295dd4ddbd7cee080d97e8ec87fc91904002fe4c3a5745011b26b9a358960
MD5 fda3e09a078f9efa6550e4251c1361f6
SHA1 312134480383b819af8e559fd7feac190ece6e92
SHA512 acede684c7a94a5ddde8b0210adf05a72fb3814ae418699a31ac9a3e657a0968e0736c4185e48339fa8ed565997ced58d1e75503289e4cfb08c71035ca93200f
SSDEEP 192:sxReRJyM/jK1Ml8wCD/fqsI2jL9cDZJNzoD8pr//g6+WNCKJ/YCQuOhGNIgDrJ:sxRez8D/fqsIOatHL/5Z/eyB
TLSH
T14962EB15AA345D77CCCBD209FA517F93D6F85473A2901E44AAFC8B0C04E6ADD621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4b92325c24ed6e2bf8dff23a544dafb76fe02e10b1d0d7e5877622491afa7147
MD5 4ea50eb43ae19b52bd5bb693b2901dde
SHA1 8374846bd8a8dff32bc0088c2536893068842263
SHA512 c3ab991c6df18e3db12902018c5fec065c1259c638d133ebad047347976ce5f614030d58681203906be51b194afcc4e94ff4f48312b945bd032f30799f6425c6
SSDEEP 192:sxReRJyM/jK1Ml8wCD/fqsI2jL9cDZJ5zoD8pi/g6+WNIYCsuOhGNIgDrJ:sxReB8D/fqsIOatfi/5IeyB
TLSH
T1E252EA15AA34597BDCCBD20DFA457F93D6F85473A2901E44AAFC8A0C04E6AED621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 50296015c3419ecacb6bc8a13363dff696c23fc2ccd1d02f7598b7da9303e9d3
MD5 8daa77424de627853cafdb76d102a31b
SHA1 b5294b155078fd3c65fa12197056f2e926f33703
SHA512 4ea6b411c7662faaf6ce270a1de2c44b8c0a0fac92162f30d1cadd52f3e3e3b4d99f8e196ac0a7b5ddf8e512bb13941305a21279b17b35c09912b27428cff867
SSDEEP 192:sxReRJyM/jK1Ml8UQECD/fqsI2jL9cDZJNzoD8pr//g6+WNCKJ/YCQuOhGNIgDrJ:sxRezqTD/fqsIOatHL/5Z/eyB
TLSH
T16562EA16AA345D77CCC7D209FA51BF93D6F85473A2901E44AAFC8B0C04E6ADD611381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 c80c4440147a3481167cf2eb86d02466f9454ca45795140c0639942a80b3bea6
MD5 88d2fcb3e204c513295ee1eb38e8d5d6
SHA1 3a36972a29d036da5c1b00628004d89b6a8e6412
SHA512 6113fd9c45fe89d584c50f077b276f6ec90fe04e9c968d84380a10f433aeacbadc3503814479c65fd6ebfb5350a26ca915960969d5f9c829c127f45f6339f72d
SSDEEP 768:j/8vNN7pLuL7tQWgQ+fB+8F1+UoAYDCx9Tuqh0VfUC9xbog/OV7RMQqqFrovy:j/8vN7E7tQWgQ+fB+u1jaARMVq+6
TLSH
T156E2FB7B680CCB7E4F404E9DEC29BD9AADE801CF5698CD5447EA840C03C57EB561A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6b0c4b708f10fd3f141b3841141b6bb44b11ed8e56c8faac50067a7795bb594d
MD5 62ae7c3bf612b4f04768010ad2ceed67
SHA1 650b91b1e60b4d659fe054f565e0fae654b2adf3
SHA512 1800d6cd5b4726feeaa5b8f0c9055cbde3de12020346af343c975bf1de4b977df0c556e82dbb4c18bd52177692b2032289d3c18896f8a3443349f74fc438f632
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHuDSOowg2Ww19gO2K4TgM2cmut8unHafGl:CbEBVj5JAdSp9/EgTK7j6dJOHuDSOowA
TLSH
T15991E454713B0241783EB95D84BC882E86C27473341DA96B7BA846AA0F27E43DDFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a4382.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a4382.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 98137723259d690ac13d77c25c7874e91e147e86010fe5b5561bfedd1c1a2d16
MD5 c49aebb09d9b537e1e0a4d5d59583029
SHA1 99d7c53a3942d2b6e6e89d13e0ffb7d2e289e4e6
SHA512 2bcbf5d56e064be294c392d414ff680ac2d9496cd0b0542ee89ddda2c67b559e9801bfdbb322754aabc0aaa24a2c796390f3b0dcea581484d8b6c492265e7326
SSDEEP 768:Irv+4UNbdD3yccNp8+p3bd66j+4BRv86aLIiw2bwCl1:Ibsbp3yL8+p3Z6n4yO0ww
TLSH
T16003CE73F8A899739CE6C644B2467A437FF851A3A6C00EC4D5DD2B4E419A19E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 16e7e60c55adf5bfbc6d185748c5e4c82bd8b7c50f55f418257e95aabfa5ca0a
MD5 7f2401e61cf90da8bf2300b6409766ed
SHA1 93a9cd754c9b88febd0ae2278b51136e9ad7fb3d
SHA512 167c03b9b9ae3304ec561253aab9e03043f5b7adf8e0bc8ba8dada2773a8d113fdafecdcf118e1faf274c9ff8adc4e8e1ad3762c67cc14933b591b20eed467fe
SSDEEP 768:gj+983agOXAop8+p3bd66j+4BRv86aLIWtb9MF:f983aFA28+p3Z6n4yjb+F
TLSH
T1C6F2BF71F85ADD738CE6C754B2563783AFF421B796C01D88E9D96F0E00872AD5B0742A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 31709d2fa9d80fff4e6075c745c7c3b138712c63eb205199e895625b9fef53f6
MD5 61250cb55fd7c359c3c06727ff0f7e69
SHA1 fac71121f50be57e2b67ad0c43faf97fcb256bba
SHA512 caaf63dfa0e4b8b145523cdac1b5e1c45c3eb189c15109e8214903bc7d8bdd5c1b424cb7513c238a229185ca9e19a6a62e0297f933c25ebcc2fa459ef60baad4
SSDEEP 768:DF1j+983EwgwWt+2p8+p3bd66j+4BRv86aLIWtb9MF:S983N9g8+p3Z6n4yjb+F
TLSH
T13F1328F198D78977D89E8787A33D2E429EFCD1A3B5841884B7D85E4DCC821BFC606815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

7ab953bb-58a8-4a32-a6ee-5d45bf277367.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7ab953bb-58a8-4a32-a6ee-5d45bf277367.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5096_1745043346\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 97d115f2d8cccd67aab339d3464741f6f37821f9086bf87fb648c6ddf379226d
MD5 4a59a812cbb614bebd3d9ffe91c9a610
SHA1 61f5a98b2ae7aaa4a539349805686f2caa1ab721
SHA512 a65930c1268034cfe3730b6393b251a406a3377f709e24d3c1944fb165ffe88ae786e8459e4419aaf6584715164e1ccf2010d07bac4821eafa4b5d088d84dc80
TLSH
T13971009357B8D5B2C1DA5FF002835648F5BB22780B2330340B515546AA34B7A24B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/252-493-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/928-336-0x0000000000AB0000-0x0000000000B0F000-memory.dmp

Download

memory/1220-408-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1280-388-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1340-443-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1668-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1912-276-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2564-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2652-264-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2652-278-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3036-464-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3796-368-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4396-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4396-313-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4620-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4620-306-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4620-334-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5056-360-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5224-476-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5268-428-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5668-236-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5812-189-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6028-432-0x0000000000010000-0x00000000000AB000-memory.dmp

Download