systex | f82826428aa7ee89cebbc1199c3442a5d63d4936ecfa38198ee7584ccd402d58

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 10:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260712-mykr5sat3w
SHA256 f82826428aa7ee89cebbc1199c3442a5d63d4936ecfa38198ee7584ccd402d58
MD5 f1773da0a10f8957d90434264d43ed0b
SHA1 54c75df82d45caac902625c74b0f7801be786df0
SHA512 cc438e55011c6f4ed63ada699d8e15dc4e9ca54d8d4b2bd886103335efc55c415d5ab2f387c909da8a7727f5a00697d3d7f53af97fec5a243acc13ff70d332bf
SSDEEP 6144:8flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:8flfAsiVGjSGecvX
TLSH
T110747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2420	vtnlfdyvqnigaysq.exe
5992	vtnlfdyvqnigaysq.sys
3652	CreateProcess.exe
3468	dbvtnlysqi.exe
3592	CreateProcess.exe
1632	CreateProcess.exe
1564	i_dbvtnlysqi.exe
3288	gdxvsnlfdx.sys
1868	CreateProcess.exe
2428	ysqkidavsn.exe
1992	CreateProcess.exe
1228	CreateProcess.exe
4816	i_ysqkidavsn.exe
2804	kfcxvpnhfa.sys
4116	CreateProcess.exe
4124	ausnkfcaus.exe
3396	CreateProcess.exe
4408	CreateProcess.exe
5916	i_ausnkfcaus.exe
5624	jhczusmkec.sys
2944	CreateProcess.exe
1060	zusmkecwup.exe
5008	CreateProcess.exe
4612	CreateProcess.exe
5428	i_zusmkecwup.exe
4120	urmkecwupm.sys
2280	CreateProcess.exe
4300	ezxrpjhbzu.exe
2004	CreateProcess.exe
2440	CreateProcess.exe
4904	i_ezxrpjhbzu.exe
4248	ezwuomhezx.sys
2680	CreateProcess.exe
1880	uomgezwjge.exe
4168	CreateProcess.exe
2640	CreateProcess.exe
3828	i_uomgezwjge.exe
4788	gdbwtomgey.sys
5756	CreateProcess.exe
2636	ztrljebwto.exe
5964	CreateProcess.exe
4608	CreateProcess.exe
4484	i_ztrljebwto.exe
4592	qoigbytqoi.sys
3388	CreateProcess.exe
840	igaytqljdb.exe
5652	CreateProcess.exe
5428	CreateProcess.exe
1356	i_igaytqljdb.exe
3456	igdyoigays.sys
264	CreateProcess.exe
4756	sqlidavtnl.exe
4900	CreateProcess.exe
4348	CreateProcess.exe
5052	i_sqlidavtnl.exe
5880	nifdxsqnig.sys
1972	CreateProcess.exe
5624	vsnkfdxvpn.exe
3184	CreateProcess.exe
4500	CreateProcess.exe
5796	i_vsnkfdxvpn.exe
4380	xsqnlfdxvp.sys
4220	CreateProcess.exe
2156	ausnkicaus.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrljdbwtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfvpnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdyvqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zusmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgezwjge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgezwjge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqlidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzxusmkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkidavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausnkfcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezxrpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzxusmkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausnkfcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zusmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khfzxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khfzxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmhezwrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlysqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkidavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrljdbwtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfvpnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezxrpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmhezwrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlysqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausnkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausnkicaus.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
412	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4572	ipconfig.exe
4348	ipconfig.exe
1500	ipconfig.exe
5916	ipconfig.exe
2644	ipconfig.exe
5588	ipconfig.exe
400	ipconfig.exe
5736	ipconfig.exe
5220	ipconfig.exe
1496	ipconfig.exe
4080	ipconfig.exe
5060	ipconfig.exe
2016	ipconfig.exe
1860	ipconfig.exe
3500	ipconfig.exe
1428	ipconfig.exe
3328	ipconfig.exe
2852	ipconfig.exe
5564	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283271541690558"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{DB579668-34A9-45C2-B184-23CE78EC1F77}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2420	vtnlfdyvqnigaysq.exe
2420	vtnlfdyvqnigaysq.exe
2420	vtnlfdyvqnigaysq.exe
2420	vtnlfdyvqnigaysq.exe
2420	vtnlfdyvqnigaysq.exe
2420	vtnlfdyvqnigaysq.exe
2420	vtnlfdyvqnigaysq.exe
2420	vtnlfdyvqnigaysq.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1564	i_dbvtnlysqi.exe
Token: SeDebugPrivilege	4816	i_ysqkidavsn.exe
Token: SeDebugPrivilege	5916	i_ausnkfcaus.exe
Token: SeDebugPrivilege	5428	i_zusmkecwup.exe
Token: SeDebugPrivilege	4904	i_ezxrpjhbzu.exe
Token: SeDebugPrivilege	3828	i_uomgezwjge.exe
Token: SeDebugPrivilege	4484	i_ztrljebwto.exe
Token: SeDebugPrivilege	1356	i_igaytqljdb.exe
Token: SeDebugPrivilege	5052	i_sqlidavtnl.exe
Token: SeDebugPrivilege	5796	i_vsnkfdxvpn.exe
Token: SeDebugPrivilege	4544	i_ausnkicaus.exe
Token: SeDebugPrivilege	6132	i_khfzxupnhf.exe
Token: SeDebugPrivilege	2040	i_hbzxusmkhf.exe
Token: SeDebugPrivilege	3696	i_rpmhezwrom.exe
Token: SeDebugPrivilege	5748	i_rojhbztrlj.exe
Token: SeDebugPrivilege	1708	i_wtrljdbwtr.exe
Token: SeDebugPrivilege	2120	i_dbvtnlgdyw.exe
Token: SeDebugPrivilege	3492	i_nlfvpnifay.exe
Token: SeDebugPrivilege	1152	i_xvpnhfaxsq.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 2420	4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	86
PID 4876 wrote to memory of 3336	4876	2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 3336 wrote to memory of 3012	3336	iexplore.exe	88
PID 3012 wrote to memory of 2492	3012	msedge.exe	89
PID 3012 wrote to memory of 412	3012	msedge.exe	90
PID 3012 wrote to memory of 5248	3012	msedge.exe	91
PID 3012 wrote to memory of 5248	3012	msedge.exe	91
PID 3012 wrote to memory of 5248	3012	msedge.exe	91
PID 3012 wrote to memory of 5084	3012	msedge.exe	92
PID 3012 wrote to memory of 5084	3012	msedge.exe	92
PID 3012 wrote to memory of 5808	3012	msedge.exe	93
PID 3012 wrote to memory of 5808	3012	msedge.exe	93
PID 3012 wrote to memory of 5808	3012	msedge.exe	93
PID 3012 wrote to memory of 1620	3012	msedge.exe	94
PID 3012 wrote to memory of 1620	3012	msedge.exe	94
PID 3012 wrote to memory of 1620	3012	msedge.exe	94
PID 3012 wrote to memory of 1272	3012	msedge.exe	96
PID 3012 wrote to memory of 3852	3012	msedge.exe	97
PID 3012 wrote to memory of 1272	3012	msedge.exe	96
PID 3012 wrote to memory of 1272	3012	msedge.exe	96
PID 3012 wrote to memory of 3852	3012	msedge.exe	97
PID 3012 wrote to memory of 3852	3012	msedge.exe	97
PID 3012 wrote to memory of 1048	3012	msedge.exe	98
PID 3012 wrote to memory of 1048	3012	msedge.exe	98
PID 2420 wrote to memory of 3652	2420	vtnlfdyvqnigaysq.exe	102
PID 3468 wrote to memory of 3592	3468	dbvtnlysqi.exe	105
PID 3012 wrote to memory of 248	3012	msedge.exe	106
PID 3012 wrote to memory of 4820	3012	msedge.exe	107
PID 3012 wrote to memory of 248	3012	msedge.exe	106
PID 3012 wrote to memory of 4820	3012	msedge.exe	107
PID 3012 wrote to memory of 2916	3012	msedge.exe	111
PID 3012 wrote to memory of 3064	3012	msedge.exe	112
PID 3012 wrote to memory of 3064	3012	msedge.exe	112
PID 3012 wrote to memory of 2220	3012	msedge.exe	115
PID 3012 wrote to memory of 2220	3012	msedge.exe	115
PID 2420 wrote to memory of 1632	2420	vtnlfdyvqnigaysq.exe	117
PID 2420 wrote to memory of 1868	2420	vtnlfdyvqnigaysq.exe	121
PID 2428 wrote to memory of 1992	2428	ysqkidavsn.exe	123
PID 2420 wrote to memory of 1228	2420	vtnlfdyvqnigaysq.exe	126
PID 2420 wrote to memory of 4116	2420	vtnlfdyvqnigaysq.exe	130
PID 4124 wrote to memory of 3396	4124	ausnkfcaus.exe	132
PID 2420 wrote to memory of 4408	2420	vtnlfdyvqnigaysq.exe	135
PID 3012 wrote to memory of 4848	3012	msedge.exe	139
PID 3012 wrote to memory of 4848	3012	msedge.exe	139
PID 3012 wrote to memory of 4848	3012	msedge.exe	139
PID 3012 wrote to memory of 4908	3012	msedge.exe	141
PID 3012 wrote to memory of 4908	3012	msedge.exe	141
PID 3012 wrote to memory of 4908	3012	msedge.exe	141
PID 2420 wrote to memory of 2944	2420	vtnlfdyvqnigaysq.exe	142
PID 1060 wrote to memory of 5008	1060	zusmkecwup.exe	144
PID 2420 wrote to memory of 4612	2420	vtnlfdyvqnigaysq.exe	147
PID 3012 wrote to memory of 4564	3012	msedge.exe	149
PID 3012 wrote to memory of 1720	3012	msedge.exe	150
PID 3012 wrote to memory of 6108	3012	msedge.exe	151
PID 2420 wrote to memory of 2280	2420	vtnlfdyvqnigaysq.exe	154
PID 4300 wrote to memory of 2004	4300	ezxrpjhbzu.exe	156
PID 2420 wrote to memory of 2440	2420	vtnlfdyvqnigaysq.exe	159
PID 2420 wrote to memory of 2680	2420	vtnlfdyvqnigaysq.exe	163
PID 1880 wrote to memory of 4168	1880	uomgezwjge.exe	165
PID 2420 wrote to memory of 2640	2420	vtnlfdyvqnigaysq.exe	168
PID 2420 wrote to memory of 5756	2420	vtnlfdyvqnigaysq.exe	172
PID 2636 wrote to memory of 5964	2636	ztrljebwto.exe	174
PID 2420 wrote to memory of 4608	2420	vtnlfdyvqnigaysq.exe	177
PID 3012 wrote to memory of 5612	3012	msedge.exe	179

C:\Users\Admin\AppData\Local\Temp\2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_f1773da0a10f8957d90434264d43ed0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Temp\vtnlfdyvqnigaysq.exe
  C:\Temp\vtnlfdyvqnigaysq.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtnlysqi.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3652
  - - C:\Temp\dbvtnlysqi.exe
      C:\Temp\dbvtnlysqi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3468
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3592
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtnlysqi.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1632
  - - C:\Temp\i_dbvtnlysqi.exe
      C:\Temp\i_dbvtnlysqi.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqkidavsn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1868
  - - C:\Temp\ysqkidavsn.exe
      C:\Temp\ysqkidavsn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2428
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1992
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqkidavsn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1228
  - - C:\Temp\i_ysqkidavsn.exe
      C:\Temp\i_ysqkidavsn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ausnkfcaus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4116
  - - C:\Temp\ausnkfcaus.exe
      C:\Temp\ausnkfcaus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4124
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3396
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4348
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ausnkfcaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4408
  - - C:\Temp\i_ausnkfcaus.exe
      C:\Temp\i_ausnkfcaus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zusmkecwup.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2944
  - - C:\Temp\zusmkecwup.exe
      C:\Temp\zusmkecwup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1060
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5008
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zusmkecwup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4612
  - - C:\Temp\i_zusmkecwup.exe
      C:\Temp\i_zusmkecwup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezxrpjhbzu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2280
  - - C:\Temp\ezxrpjhbzu.exe
      C:\Temp\ezxrpjhbzu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4300
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2004
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezxrpjhbzu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2440
  - - C:\Temp\i_ezxrpjhbzu.exe
      C:\Temp\i_ezxrpjhbzu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomgezwjge.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2680
  - - C:\Temp\uomgezwjge.exe
      C:\Temp\uomgezwjge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1880
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4168
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomgezwjge.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2640
  - - C:\Temp\i_uomgezwjge.exe
      C:\Temp\i_uomgezwjge.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrljebwto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5756
  - - C:\Temp\ztrljebwto.exe
      C:\Temp\ztrljebwto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2636
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5964
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrljebwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4608
  - - C:\Temp\i_ztrljebwto.exe
      C:\Temp\i_ztrljebwto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igaytqljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3388
  - - C:\Temp\igaytqljdb.exe
      C:\Temp\igaytqljdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:840
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5652
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igaytqljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5428
  - - C:\Temp\i_igaytqljdb.exe
      C:\Temp\i_igaytqljdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqlidavtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:264
  - - C:\Temp\sqlidavtnl.exe
      C:\Temp\sqlidavtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4756
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4900
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqlidavtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4348
  - - C:\Temp\i_sqlidavtnl.exe
      C:\Temp\i_sqlidavtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsnkfdxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1972
  - - C:\Temp\vsnkfdxvpn.exe
      C:\Temp\vsnkfdxvpn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5624
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3184
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsnkfdxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4500
  - - C:\Temp\i_vsnkfdxvpn.exe
      C:\Temp\i_vsnkfdxvpn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ausnkicaus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4220
  - - C:\Temp\ausnkicaus.exe
      C:\Temp\ausnkicaus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2156
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4724
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ausnkicaus.exe ups_ins
    3⤵
    PID:2684
  - - C:\Temp\i_ausnkicaus.exe
      C:\Temp\i_ausnkicaus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khfzxupnhf.exe ups_run
    3⤵
    PID:2044
  - - C:\Temp\khfzxupnhf.exe
      C:\Temp\khfzxupnhf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1356
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5932
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khfzxupnhf.exe ups_ins
    3⤵
    PID:3560
  - - C:\Temp\i_khfzxupnhf.exe
      C:\Temp\i_khfzxupnhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbzxusmkhf.exe ups_run
    3⤵
    PID:6136
  - - C:\Temp\hbzxusmkhf.exe
      C:\Temp\hbzxusmkhf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5868
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3712
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbzxusmkhf.exe ups_ins
    3⤵
    PID:1244
  - - C:\Temp\i_hbzxusmkhf.exe
      C:\Temp\i_hbzxusmkhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpmhezwrom.exe ups_run
    3⤵
    PID:1876
  - - C:\Temp\rpmhezwrom.exe
      C:\Temp\rpmhezwrom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2656
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5052
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpmhezwrom.exe ups_ins
    3⤵
    PID:992
  - - C:\Temp\i_rpmhezwrom.exe
      C:\Temp\i_rpmhezwrom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rojhbztrlj.exe ups_run
    3⤵
    PID:5104
  - - C:\Temp\rojhbztrlj.exe
      C:\Temp\rojhbztrlj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4788
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4660
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rojhbztrlj.exe ups_ins
    3⤵
    PID:4908
  - - C:\Temp\i_rojhbztrlj.exe
      C:\Temp\i_rojhbztrlj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtrljdbwtr.exe ups_run
    3⤵
    PID:808
  - - C:\Temp\wtrljdbwtr.exe
      C:\Temp\wtrljdbwtr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1984
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtrljdbwtr.exe ups_ins
    3⤵
    PID:3068
  - - C:\Temp\i_wtrljdbwtr.exe
      C:\Temp\i_wtrljdbwtr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtnlgdyw.exe ups_run
    3⤵
    PID:3476
  - - C:\Temp\dbvtnlgdyw.exe
      C:\Temp\dbvtnlgdyw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5424
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4400
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtnlgdyw.exe ups_ins
    3⤵
    PID:1728
  - - C:\Temp\i_dbvtnlgdyw.exe
      C:\Temp\i_dbvtnlgdyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfvpnifay.exe ups_run
    3⤵
    PID:2136
  - - C:\Temp\nlfvpnifay.exe
      C:\Temp\nlfvpnifay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4748
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5496
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfvpnifay.exe ups_ins
    3⤵
    PID:4768
  - - C:\Temp\i_nlfvpnifay.exe
      C:\Temp\i_nlfvpnifay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnhfaxsq.exe ups_run
    3⤵
    PID:5616
  - - C:\Temp\xvpnhfaxsq.exe
      C:\Temp\xvpnhfaxsq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2188
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3952
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnhfaxsq.exe ups_ins
    3⤵
    PID:2348
  - - C:\Temp\i_xvpnhfaxsq.exe
      C:\Temp\i_xvpnhfaxsq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1152
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x120,0x2f4,0x2f8,0x110,0x300,0x7ffd2baac188,0x7ffd2baac194,0x7ffd2baac1a0
      4⤵
      PID:2492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,5106266100533186182,6651497035277033502,524288 --field-trial-handle=2232,i,5502927072462379158,14804685664268114653,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:11
      4⤵
      System Time Discovery
      PID:412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,16034852919201620553,2236365220566344986,262144 --field-trial-handle=2232,i,5502927072462379158,14804685664268114653,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
      4⤵
      PID:5248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,11431525508236798788,4651597760272959117,524288 --field-trial-handle=2232,i,5502927072462379158,14804685664268114653,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:13
      4⤵
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,3644821020550410649,3564783917707330432,2097152 --field-trial-handle=2232,i,5502927072462379158,14804685664268114653,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:5808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,14070117695189705994,18297077756408703440,2097152 --field-trial-handle=2232,i,5502927072462379158,14804685664268114653,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:1620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,10519750917802632038,15296475962376086963,2097152 --field-trial-handle=2232,i,5502927072462379158,14804685664268114653,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
      4⤵
      PID:1272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,8735323179315145033,16069136195953313184,2097152 --field-trial-handle=2232,i,5502927072462379158,14804685664268114653,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:9
      4⤵
      PID:3852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,5959081178371872050,17512703757390592137,524288 --field-trial-handle=2232,i,5502927072462379158,14804685664268114653,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
      4⤵
      PID:1048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,14020932257553245152,9128557977136107629,524288 --field-trial-handle=2232,i,5502927072462379158,14804685664268114653,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
      4⤵
      PID:248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,9742244290574897627,1956732440417067468,524288 --field-trial-handle=2232,i,5502927072462379158,14804685664268114653,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
      4⤵
      PID:4820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,6722410215452175435,152243965117298474,524288 --field-trial-handle=2232,i,5502927072462379158,14804685664268114653,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
      4⤵
      PID:4816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,6722410215452175435,152243965117298474,524288 --field-trial-handle=2232,i,5502927072462379158,14804685664268114653,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
      4⤵
      PID:2916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,15778088717482453666,11145900010807210082,524288 --field-trial-handle=2232,i,5502927072462379158,14804685664268114653,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
      4⤵
      PID:3064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,10665725299575297184,17625555328331131556,524288 --field-trial-handle=2232,i,5502927072462379158,14804685664268114653,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
      4⤵
      PID:2220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4864,i,3543522573769606139,13808715264387103400,2097152 --field-trial-handle=2232,i,5502927072462379158,14804685664268114653,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:1
      4⤵
      PID:4848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3876,i,5051347877430841458,14852162955846760207,2097152 --field-trial-handle=2232,i,5502927072462379158,14804685664268114653,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:1
      4⤵
      PID:4908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,247753274769115769,1353382555698625076,524288 --field-trial-handle=2232,i,5502927072462379158,14804685664268114653,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
      4⤵
      PID:4564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,2593199233838075935,14751025224369201320,524288 --field-trial-handle=2232,i,5502927072462379158,14804685664268114653,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:14
      4⤵
      PID:1720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,13175743141325250338,9854665174323336976,524288 --field-trial-handle=2232,i,5502927072462379158,14804685664268114653,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:14
      4⤵
      PID:6108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3724,i,6178267207857763914,12578950536148567876,2097152 --field-trial-handle=2232,i,5502927072462379158,14804685664268114653,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
      4⤵
      PID:5612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,3059101553504558017,1273791621606798327,524288 --field-trial-handle=2232,i,5502927072462379158,14804685664268114653,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
      4⤵
      PID:2792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,3615629762270475230,2382001529759188040,524288 --field-trial-handle=2232,i,5502927072462379158,14804685664268114653,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:14
      4⤵
      PID:2588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=920,i,1632466640504422162,5875113817014227160,2097152 --field-trial-handle=2232,i,5502927072462379158,14804685664268114653,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:1
      4⤵
      PID:1112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6260,i,14408458938176371543,12842067088298887725,262144 --field-trial-handle=2232,i,5502927072462379158,14804685664268114653,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:10
      4⤵
      PID:3380

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3804

C:\Temp\vtnlfdyvqnigaysq.sys
C:\Temp\vtnlfdyvqnigaysq.sys
1⤵
- Executes dropped EXE
PID:5992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3228

C:\Temp\gdxvsnlfdx.sys
C:\Temp\gdxvsnlfdx.sys
1⤵
- Executes dropped EXE
PID:3288

C:\Temp\kfcxvpnhfa.sys
C:\Temp\kfcxvpnhfa.sys
1⤵
- Executes dropped EXE
PID:2804

C:\Temp\jhczusmkec.sys
C:\Temp\jhczusmkec.sys
1⤵
- Executes dropped EXE
PID:5624

C:\Temp\urmkecwupm.sys
C:\Temp\urmkecwupm.sys
1⤵
- Executes dropped EXE
PID:4120

C:\Temp\ezwuomhezx.sys
C:\Temp\ezwuomhezx.sys
1⤵
- Executes dropped EXE
PID:4248

C:\Temp\gdbwtomgey.sys
C:\Temp\gdbwtomgey.sys
1⤵
- Executes dropped EXE
PID:4788

C:\Temp\qoigbytqoi.sys
C:\Temp\qoigbytqoi.sys
1⤵
- Executes dropped EXE
PID:4592

C:\Temp\igdyoigays.sys
C:\Temp\igdyoigays.sys
1⤵
- Executes dropped EXE
PID:3456

C:\Temp\nifdxsqnig.sys
C:\Temp\nifdxsqnig.sys
1⤵
- Executes dropped EXE
PID:5880

C:\Temp\xsqnlfdxvp.sys
C:\Temp\xsqnlfdxvp.sys
1⤵
- Executes dropped EXE
PID:4380

C:\Temp\hfzxvpnkfc.sys
C:\Temp\hfzxvpnkfc.sys
1⤵
PID:2968

C:\Temp\upmhfzxjhc.sys
C:\Temp\upmhfzxjhc.sys
1⤵
PID:5504

C:\Temp\uomkhczxro.sys
C:\Temp\uomkhczxro.sys
1⤵
PID:1428

C:\Temp\ztrpjhbztr.sys
C:\Temp\ztrpjhbztr.sys
1⤵
PID:6048

C:\Temp\igbytrljgb.sys
C:\Temp\igbytrljgb.sys
1⤵
PID:3948

C:\Temp\trljdbvtnd.sys
C:\Temp\trljdbvtnd.sys
1⤵
PID:2488

C:\Temp\ysqlidavtn.sys
C:\Temp\ysqlidavtn.sys
1⤵
PID:4396

C:\Temp\icavsnlfdx.sys
C:\Temp\icavsnlfdx.sys
1⤵
PID:4848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ausnkfcaus.exe

Path C:\Temp\ausnkfcaus.exe
Size 361KB
SHA256 bc13730b473de42bead8cb9aa554a8ebe3398b683041652f5b190261f0d6ff1b
MD5 ea6947c553e59b19194ede367b50b96d
SHA1 a360535081741973561534e5d670e565a6018e9d
SHA512 b8c3acdab25e877370f1c6ce617a9339c68d0769703e71bdc88d7c7b1b31c0d738cd75855796f2370b87e9d7205de9f89f12decf81d9d0173cdc4b230ea06d98
SSDEEP 6144:UflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:UflfAsiVGjSGecvX
TLSH
T1D6747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtnlysqi.exe

Path C:\Temp\dbvtnlysqi.exe
Size 361KB
SHA256 439be1fa6e734b991940d47fa735df8f8e41d9436f290294c5ea67ce907f81eb
MD5 716c21ac14351378caea4a90e3c945af
SHA1 65e4f84499e0ad1dfc9544141df3123832776a93
SHA512 48e601370b2b7fdafbf645d823475917e8bd685131dcc3aab0d42311766166db0b3d4792af64dcb56145b25bb56b1f9c1613406af425a44878603e1e062a75be
SSDEEP 6144:JflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:JflfAsiVGjSGecvX
TLSH
T1CD747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezwuomhezx.sys

Path C:\Temp\ezwuomhezx.sys
Size 293KB
SHA256 f352355bab14b9d415c44584621e08e30a60a5bc8e84656b8f7289a53f126ad3
MD5 c8d4c0055ae3f8ad313c7bb2f983aa44
SHA1 e940db75e23df49ebf494e10d59879604c513c4f
SHA512 980c68834d6bb515d87e4f28101a154ce81b6dc47a1f9fa5e9fa3343eda9dd14aa84d07a7da5b2b7cf48abb9213aedda6fe7aca7f1d64e17c16e6855e2f210b1
SSDEEP 3072:ltKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:lIJjiJcbI03GBc3ucY5DCSj
TLSH
T118545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezxrpjhbzu.exe

Path C:\Temp\ezxrpjhbzu.exe
Size 361KB
SHA256 ecbda64321a33c41ffd4dcc884e13b632274a086b609add74ffb26db068289b2
MD5 1e7c288b6b08fc572f901590c759c26c
SHA1 fc01d567533c9e09031a001e3c81da1b314bbb6d
SHA512 03bb0134b3bc97bd4f91dc830378accee9b7d5749d9f463e3cc7d61cd8273141b647db793191bc22df4331e98cc2260164fdba35f26880508216a533d28591b0
SSDEEP 6144:dflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:dflfAsiVGjSGecvX
TLSH
T17D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdxvsnlfdx.sys

Path C:\Temp\gdxvsnlfdx.sys
Size 293KB
SHA256 77d95e9c69674307974fd1f35dee89504f87d279b3af6a4a1947fc0dd09cd5a1
MD5 91d65c9597be364bd2647cdcf8bc4ef9
SHA1 85993c05799e639d8036ed6aded347fa597a5637
SHA512 f6396ca646be24085fb8b01fb352c85e3c696a22a31d602a75528365453ae58b8181047e502df7ba24f121999ff665755ba69c8d7a16043c5ee27c894b9ee7f1
SSDEEP 3072:ItKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:IIJjiJcbI03GBc3ucY5DCSj
TLSH
T173545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ausnkfcaus.exe

Path C:\Temp\i_ausnkfcaus.exe
Size 361KB
SHA256 06d00ae5270c9ac8ba681d24e88ad60b44f3402c79e4464b451d64e9eb015b4b
MD5 32f8711b41c9907b608772b14fbe8d8c
SHA1 aadcb6d85a6726d005fd00fe79c626f94b2ae75f
SHA512 b4ff5a14073b3358834ce16d7afd51091c5479f04c5d2859c563d536dfbe288d4aa165082ddac427492926b72e0d9d0b37293332f4d79e99f64f72804ee164d3
SSDEEP 6144:TflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:TflfAsiVGjSGecvX
TLSH
T1E2747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbvtnlysqi.exe

Path C:\Temp\i_dbvtnlysqi.exe
Size 361KB
SHA256 fc0193c4b086797e92cba92e922d6d818b61ebafc346d11f6bb0146d1a668ed8
MD5 5433dca523bf0bdb08aa51eed4a759f8
SHA1 a5e827c73a2600e5e4acf8b95bb8685f0ef376de
SHA512 5be23ad01254b57e87350df3fd850c1cd0eebdcf329c90488072d099dfee745b353cfeed1e0048a20455698c7944cceb7e9f7ca8075c6f374475df617288237d
SSDEEP 6144:6flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:6flfAsiVGjSGecvX
TLSH
T193747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ezxrpjhbzu.exe

Path C:\Temp\i_ezxrpjhbzu.exe
Size 361KB
SHA256 5f3651101a9c7a0ffbc99e9118daab7ae5c209801a228e519cb334d492de8d41
MD5 a3aac0ddfdc2abdedcba10ba9539eb93
SHA1 ef71ef8ece9c135b057eabb617de2312903f7b07
SHA512 edd649b4fe967ecb89854ef37db011e7ff3ebd36b766144158fef86a7404d18d8a927c0d6bd8584cbf4787791406c7bbbf0cdb3af3a4a66db3da93000feb9a39
SSDEEP 6144:NflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:NflfAsiVGjSGecvX
TLSH
T172747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqkidavsn.exe

Path C:\Temp\i_ysqkidavsn.exe
Size 361KB
SHA256 94383178b2930a256f8bfde24ffd21cd5f600a7f97dc4ef923acc3ca9e6f1d57
MD5 dc79e509a04640bbbdadd6ee9cee6811
SHA1 fb8566a85b8dd073b7b582d5bdbbcc0dd446b1be
SHA512 333e247641e6aa1927597952f5d00f7e364a5f3df68bf9585551d1fbff8b2c160002483810fd81d68589339e723ab477a58d1d23a75ac7250efcd705117c84df
SSDEEP 6144:cflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:cflfAsiVGjSGecvX
TLSH
T1FF747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zusmkecwup.exe

Path C:\Temp\i_zusmkecwup.exe
Size 361KB
SHA256 b5b49762665a918c6c73e78612aa22f4e000f2afdc5faab099504715829ec0d8
MD5 ea1264d0034211964acbce6d1b879c2d
SHA1 32e15ea874b39295b68266ad1aedddc7671ed146
SHA512 c2ff04b4b4671e21999faac4610621b91c59bbc5a3d202b8d677b3b65a0904e6ca8d1274399ec2c10d4f3c413ff9de01b801a69cf01c54ccd1507a31bde55a54
SSDEEP 6144:SflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:SflfAsiVGjSGecvX
TLSH
T1B4747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhczusmkec.sys

Path C:\Temp\jhczusmkec.sys
Size 293KB
SHA256 beb4e9bbae584565823f6aa80776a25b8e144b101e77c430ba860cd3ebb004b0
MD5 fb30aa077a607ae47bc6563109f419b9
SHA1 21a3d7a5e6f843e734be4056be6015b7ecc1ae79
SHA512 148f889c81e7effaeec5b20a0ffb9f830dd158d85d41ae4e069d3e7171cb84605b98d3df3eeaf710df94fbc64870290725f413a1bc4b7c9ba47d402cf364b1f8
SSDEEP 3072:MtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:MIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcxvpnhfa.sys

Path C:\Temp\kfcxvpnhfa.sys
Size 293KB
SHA256 bc3785ffd1ab055a427aad3441abf7206f547abbeb7213d2936251aa123835b5
MD5 8dff5bec78ec05b8da74f422f03b63bc
SHA1 9357bfbd0160b36e098f72241d1c4d3cb5c26b4a
SHA512 a13d80d20fcf0e145c8614abebfbf1028ba1f9ced2dc5bde8c584d78c88225c101253da1802b8fe532edd3cc289dd0ca4972fcf95b5970818dc3a740595e5c01
SSDEEP 3072:ttKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:tIJjiJcbI03GBc3ucY5DCSj
TLSH
T150545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgezwjge.exe

Path C:\Temp\uomgezwjge.exe
Size 361KB
SHA256 a38d0bf760201c10696fa3d6cedfe23fe7ae94214abae36832422ed6973ad9ad
MD5 b3c7e682f2db00113d0cfe4f97827092
SHA1 8d06e9cd049f3f617e2b509147ab80394aadf412
SHA512 84c952802f05870764a120f47d50d12403698fe744aae5897730a005b852960bb19842a9e1e8b99e9ee8384eabb0d78b2b80c9d2e2a1665a62b7696615cced34
SSDEEP 6144:OflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:OflfAsiVGjSGecvX
TLSH
T187747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmkecwupm.sys

Path C:\Temp\urmkecwupm.sys
Size 293KB
SHA256 f1560a0b29fc28023743aff68958787c5a0201b8e0e2fc85abd483c57bc6a9fa
MD5 478e36a8dee78c5df6e746f7a71bcf5c
SHA1 e9c64a7e43b053e7645728429b0901d25bda5c8f
SHA512 271a2fe75c42e49eb6f2c2f59e5dfd6945c3db70ca84943d1688b602d0d952878865b91f323ffe81e0c85fa2888ab3f89f7df2dff241a35896c7251369078006
SSDEEP 3072:TtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:TIJjiJcbI03GBc3ucY5DCSj
TLSH
T19E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdyvqnigaysq.exe

Path C:\Temp\vtnlfdyvqnigaysq.exe
Size 361KB
SHA256 1933c99e6a588e9576afb75acddfbb7e73da57453782271bb3f944f5dd630bb3
MD5 b1d8dc8181eb73285f29afe7ce97b615
SHA1 352f59b78ef3d2708fbc0c844deab49da655777a
SHA512 4be1a25b675446455fb4c5e11e46fdeb35d4e0cd480301c095a92c7b6c4cd37259f8e29644729f2e435231e7fd5919701fb13011733f08293420d31afef30045
SSDEEP 6144:iflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:iflfAsiVGjSGecvX
TLSH
T11D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdyvqnigaysq.sys

Path C:\Temp\vtnlfdyvqnigaysq.sys
Size 293KB
SHA256 893763992ce30d1b7510a8ce242fca7dced74381601988111f074cb54f826b12
MD5 b4638b3e8ec7a750f47d642a60588573
SHA1 3694e9c0c3965f365c5f9498210f4886231f1652
SHA512 80ba4fbcff6ff429918b22a976fcf9b0aee5dbcb6d3978bb5c4cc451d5edf6f233a825f03ca671ef5bf33f199656bb8f7a9f19dfc51b4e21b6d2447d0a97ba07
SSDEEP 3072:ztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:zIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E1545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqkidavsn.exe

Path C:\Temp\ysqkidavsn.exe
Size 361KB
SHA256 4db2a79f929aae5e5121f4f472bbbe9b217deee1cbae6988689a7c19a540fc76
MD5 881529287684e784ff30a9e231f8e290
SHA1 0e9e73a1b38b55d4d07469584a8cbc6c6c927c48
SHA512 d1fa9dd5f642214f91fe4f155feb90998b46514f10cdaa7e9d537cee642441fb9689db5e2c385ce96a84e7c08ff4a582d22832d41c152b580d05de4c0155db5e
SSDEEP 6144:vflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:vflfAsiVGjSGecvX
TLSH
T162747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zusmkecwup.exe

Path C:\Temp\zusmkecwup.exe
Size 361KB
SHA256 e4cd1c353697b5d01974c62d65a687187455b3b80ec943392731ea7502afa896
MD5 ff330cf2ef01ac94d20e1609275815cd
SHA1 15f2ca3108be3f12f2af315ba8ac3c164b10dd40
SHA512 5bca2b934dfdad7b1c13b0bcba8eb430ef5abf530ec6007f364d6b0cec4c7a9604103c6ee6c04c16b7e5bd4ae848cf92eef300e28967fd143fc5ece36f0a1245
SSDEEP 6144:QflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:QflfAsiVGjSGecvX
TLSH
T169747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 168dc438fa355b9b84e416f9d4caca14da218ad190d72da09fe489277625815d
MD5 39064a84dfec9bbd8c4b789b6d7a7c62
SHA1 5d817a4df5ed7bd1eac0c4bc0464a76007ad0c46
SHA512 3a4f32a1ad3eb6c391e6d11f4f6ba07c4d21cc935ddd8fd93306857b9e0cfda06c39786a872cae88f394320921a63296ad4df0e61334710db192febec2f48618
TLSH
T1B5D0C034763961C2C92725B2CC3163007320007030B587425171840C8E3489667CF3C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08a3eccff4cd9b05162ffe0d083662ea8cd60457899147f42dbbf95a0a97d97e
MD5 394c25b8b347a39d61b9cf28babb5c77
SHA1 c7334bcf8642ac580d30cf31659724fe1ab323c9
SHA512 8e5c09dada01bf020bbf53884d65940c521dc62e17d9ce99fe6c571edde4b95c7c7716f2eda97b70568b2cbac8823e7afed5a9bac7be39d1acc6fc95c23a4b1c
TLSH
T1F6D0C038762962C2C92725B2CC3063007330007030B587425071440C8E3489667CF3C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d4006c84da0d863903677eff563ed91e560eb23ec01731a389faeb8688e3b6c5
MD5 0fb5f03817314eec27b629b5e27134e3
SHA1 220a5eea34ca1d91d5ade53fc1f911fdccd451a1
SHA512 ebb4ec00e777ba0d9363a25e0da161c9320060abc098a5eea7169f30ec5ea2f1320c1c6e7fe88974db5fc28f9f634dc1c13a0cfc15cdead21ab4a4dff08ecc56
TLSH
T1C551D95D0B6CDDFDC722A8B660E040C93EFB8CB801835F1203FAEA78090EFA82310211
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f11d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f11d.TMP
Size 2KB
SHA256 47b577f37046cf63d67ca3298838ebecccbe91cbcf7bcad05d1e678721579ea3
MD5 5e902ace199b70c09420481d8703f0f8
SHA1 d259991a1a0478bcc286e6e22902f01e2c4ecd01
SHA512 4c713cf1f080c48b8c227e59499f31b003aa3e8a574cc62fdcceb9c8fb6fdcd37bb124caaa3aa24e07b26613d76c77915ac5329fac704677d4bf157bfcfaeffb
TLSH
T12951C95D5B6CDDFDC722A8B664E040D93EFB8CB905875F1302FAEA78490EFA82311211
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9951761cffd8819e1c5839c78d652f99271a4955bb2734f2f5949f83445ad44f
MD5 619d6f25432e9584cde25ab49d06839f
SHA1 aaac196b564743ec73bab86cf5b0abc5c3237376
SHA512 89d2a42b1fe2e4856a6018b8c5dd30ce03a28a65d4748da08d306603ef49a5107f14025f7018a2cb495e9a7e09310686987208f04776a36a172bb3c4de5fd3a4
TLSH
T189419EF3C3E8866E890156F0AB186E2BDE1D0915832C3D5AC9E4AF5BA3F3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 59fd8b39bc6f5ceab415c8f8434e9838cc39a05f122b5edefe3322fdde92b95e
MD5 e3429af4e641167fe4145fb9c24d08a0
SHA1 00e21ac6c50b6e8da7552a8f33328d997dd0fd96
SHA512 9249c8e692600ce3153122f71e6015d32a5093e864a7b9803c8bd676b5bbc827060370e2b586cbe1f45eba8ad7b627fde0506f28ee3b55d5a44e336da446e6ae
SSDEEP 192:sxRxRiyM/jK1Ml8wCV/fFsS7hZkTfkzoA8pi/g6+WNIYZ7BKs7+GDIgtJ:sxRxM8V/fFsS7vqfFi/5I+7h3
TLSH
T11352EA15AA24993BCCDBD20CFA457F93D6F95563E2900E44AAFCCA0C04E76ED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3a8d0b2baf1ce6c2bc5b0e93703401db8e368931cadcb6d56e299446c3f12873
MD5 8e0e3454870f8ed1925e7d02bddc1e8c
SHA1 4722c222d7300f43851f94a92c889c499d8573a6
SHA512 1e4e1f1002c1c6c85e1f250f3853f26327169c80d45c334fdc3297630e5f46bbdd512620621e764f35af4fa593f958892fe2d89622eb89662f1a726a18b58802
SSDEEP 192:sxR2RiyM/jK1Ml8wCV/fFsn7hZkTfkzoA8pi/g6+WNIYZ7BKs7+GDIgD0uJ:sxR2M8V/fFsn7vqfFi/5I+7hn
TLSH
T1DF52DA15AA24997BCCDBD20CFA417F93D6F95563E2900E44AAFCCA0C04E76ED621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 59e19dfd741cf0c47379569f1f9a2ab675868268bd14ef1bfa6c431505deaad7
MD5 852c38d42dca64fd424651c86253b302
SHA1 f267091ffd9575e6e704ced8662b4ed9aa8f3442
SHA512 081363a8572c4bfbbe1828b4b90d9e214fd0930958e9c723cfbba11eb57b96f7c32309a7cec17f859a0e431120aaead44b850b415b7acb2d4b27fa453cdc44a0
SSDEEP 192:sxR2RiyM/jK1Ml8UQTCV/fFsnIhZkT3kzoA8prx/g6+WNIYZ7P6s7+GDIgD0gJ:sxR2Mq2V/fFsnIvq3FF/5I87hB
TLSH
T11B62D816AA249977DCDBD20CF6417F93D6F95563A2900E44ABFCCA0C04E76ED621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 3e30873cd1d20e24731a9ebcee4d09b3c1de9018937f5888fdf89808db7418e7
MD5 faf96065eed74a8b01ac67f25f243ec1
SHA1 f7c06d9ff07d31095386b99c3e379ecce3bc621d
SHA512 dd83765092bf0ac5554a24f722b47dcb61669b3f11513b3114a94670bac332c9eeae2d71c43e52e38586fd6b67d2c8db2bbfd1abd8ac52255b57bab34645f5a6
SSDEEP 768:kfISGS7pLuL7CvWgd5fWb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVN6tSV2yroHh0wM:kfISGqE7CvWgd5fWbu1jai6tU2pHh0wM
TLSH
T135E2DC3B680CCB7F4F8049DCEC297E9AADA801CB96D8CD9447FA850C03C66EB55165DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 536448ca8b58425fa122cff85d2936be6efe97c65de13ad95c46bd4775d2ba2e
MD5 6723bdca5ec437c9e1725ec15c5f8e45
SHA1 2b465f6546a0689b79a42d2bbaf7a28dcf7b67d0
SHA512 6f5ad399a49c997b205aedf395bd2d0efd1003a31dfe564f9c0efe4ecb8949c6aadb4160cdf93387dd5b45ff94d915f99c31ae50e5524cc1e2e9b89e74fa42b5
SSDEEP 24:KSiomEioOiovio7PiooSiopioliok1iopiooDioPI4ioDiokKXioHhPioFiok1R+:KcuI/KvK0jyJ8IjKN6c9XI5KUQEbyFz
TLSH
T186911191703A524138BD29199472D656CACAF0B3306DB47BF7E940A60F67F120EFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7493d860-cd0f-49dd-aead-c1940766e629.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7493d860-cd0f-49dd-aead-c1940766e629.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 6880c80478a62c525a5e58d11dbc75d825359b95758084896e86871d3ba7afc3
MD5 6155dfbc6368e165715d86f74ac7c7aa
SHA1 f51db2dffed6feeda6f4b0b803ba7aa08072aece
SHA512 1c00f8fa133d9c756057190672a0797118bd8d58a5629e9710df1bf19b4a4177e99fd89e85918ab79cc0b537f390b72baf1aaa4d3b79749d1b0f1bea06271407
SSDEEP 768:aF1j+9O3BwgRVjgeLHLeAam6aQMGdjWca4Ghf96aZ:/9O37cmaME6p6S
TLSH
T198F27D32D864CA6BACE797D5F71A7687EDF011A388C84DC4DAD85E0D01D719E130BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 f7dd9f10219d741acb44540635650f7c03773d00287d87cc84b13884575ae1fc
MD5 86c30d85e2c881ae5c1d7e1412a31b9e
SHA1 c45063c0346e8bf9c99b2585fdbc26cbc4a5731c
SHA512 d96c990e31f661875929b58c9e4e08fdb6e72f6085de20bf5ec16176c7727f52c583dba0624e5fca9898c4dabe22d3c24e5a07655e2bf3a755eeba2d49e2b874
SSDEEP 768:oj+9N3EVjsqsLHLyxAam6aQMGdjWca4Ghf96aZ:39N3GdzmaME6p6S
TLSH
T101D28D3158698D679CA79698B72B37C7BEF011B388C40E84D9D89F0D06D729E270BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 74bb0a0a16fa24f16f50f3ffdbbca7d7df8bdbc688081e006a486bd9ebd358a3
MD5 401d5f57783b54ec3b9fde59dcd7921b
SHA1 bd1ffb976bee80a611cb8ba06f035a6dff28fe22
SHA512 c7f074a1ee1a32218f1aea34d3948bd55a31c7557af4dedacbd3289b4d7d9f0aabcb00dd48c9c8e7ffa466740e3ad17ac6d476ef4bcc9191d26d2f1c81484a15
SSDEEP 768:/rv+4UNbdq30GqsLwAAam6aQMGdjWca4GhfBjPeU/:/bsbc3EKmaME6p7H
TLSH
T17CF2AE31A8689973DDB79A99F21B6787BEF021A384D40A84D9D92B0D43974CE3307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 887449741a7c44c21d5d2329794df0a13808e9a4c0aff3169f45bca5a22ff2e1
MD5 a0a1ce474545b30384961b9242734d10
SHA1 d1f792a12d65323ed744122dd54e8e06166c1a26
SHA512 f9ec3ff6c8db640fa0dbc198a5e6f318b477b7c9d23ecaa31facbe16109233cbb0642c748ac9ab639532c23767eeda8977458c75aed33e9a338112cbe7320f75
SSDEEP 768:jrv+4UNbd73EVEsqsLHLyxAam6aQMGdjWca4Ghf967J:jbsb53GEzmaME6p6V
TLSH
T1C103AF31A86CD9739DB7A294F21B7683BEB021A388C40E84E9D55B0D069759F330BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3012_1634545068\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 c42b83b847ff738e953871a756068a2a0c09b0932f4af64e0ad4da9735ead73d
MD5 4211338ddb8146977daf2a79a66a09c7
SHA1 f18f7b624ece896b62ac4bb403b7eeb38883afaa
SHA512 d9639123b11f7785a485a05cf30239ff37eef3ffe0617963ea745254040d338ecfe1584c37659fd235181d1525fc817bfb7331d1ed101ce5989e68c7393a2a97
TLSH
T10F71238357BCDAB3C5DE5FF102835244F6FB2238076330200BA5658AAB70B3A58B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1428-416-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2488-429-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2804-249-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2968-399-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3288-198-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3456-349-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3948-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3948-431-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4120-290-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4120-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4248-312-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4380-379-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4396-434-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4592-334-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4788-330-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4848-446-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5504-412-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5624-277-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5880-370-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5992-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6048-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6048-425-0x0000000000010000-0x00000000000AB000-memory.dmp

Download