systex | 422b16f70731d7b1dab256279b5ee65b7f782e212cf165cc6b82f872dc1d18fa

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260717-ham55sc12j
SHA256 422b16f70731d7b1dab256279b5ee65b7f782e212cf165cc6b82f872dc1d18fa
MD5 49edfc348c756c5e87a73550c980e390
SHA1 bb193baa71289bc565cd2b2f569ca91348574de1
SHA512 5df9d4f407125bb6dabc1636adbe655d4aab76c85107720629d7bd8da5b50f23463ace96bad5bb45e103a1a5c867b963db7b84d994f6fdf8858c5b8d78e12328
SSDEEP 6144:YflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:YflfAsiVGjSGecvX
TLSH
T1DE747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4836	jdbwtrljgbywqojg.exe
420	jdbwtrljgbywqojg.sys
3136	CreateProcess.exe
5080	rojgbytqoj.exe
1736	CreateProcess.exe
4576	CreateProcess.exe
3480	i_rojgbytqoj.exe
5224	ayvqoigayw.sys
3324	CreateProcess.exe
4452	ysqligdytq.exe
5496	CreateProcess.exe
4608	CreateProcess.exe
3848	i_ysqligdytq.exe
4480	tqljdbvtnl.sys
4060	CreateProcess.exe
4128	igayvqniga.exe
5424	CreateProcess.exe
5312	CreateProcess.exe
5188	i_igayvqniga.exe
5884	qkidavsnki.sys
3320	CreateProcess.exe
2752	lfdavtnifa.exe
5712	CreateProcess.exe
5400	CreateProcess.exe
4024	i_lfdavtnifa.exe
756	xvsnkfdxvq.sys
3376	CreateProcess.exe
1748	pkicausnhf.exe
3456	CreateProcess.exe
2916	CreateProcess.exe
2712	i_pkicausnhf.exe
4932	fcwusmkhca.sys
932	CreateProcess.exe
4340	cwurpnhecx.exe
2336	CreateProcess.exe
1860	CreateProcess.exe
4976	i_cwurpnhecx.exe
5616	pmkecxupnh.sys
256	CreateProcess.exe
5816	ecwurmkecw.exe
4656	CreateProcess.exe
5760	CreateProcess.exe
4912	i_ecwurmkecw.exe
1220	pmhezwrpjh.sys
2012	CreateProcess.exe
5036	mkebwuomge.exe
788	CreateProcess.exe
1516	CreateProcess.exe
596	i_mkebwuomge.exe
4480	ojgebwtolj.sys
5976	CreateProcess.exe
4052	gebwuomgey.exe
1252	CreateProcess.exe
4240	CreateProcess.exe
1624	i_gebwuomgey.exe
2216	gbytqljgby.sys
5344	CreateProcess.exe
2660	eywqoigeyw.exe
5532	CreateProcess.exe
628	CreateProcess.exe
5944	i_eywqoigeyw.exe
4708	gdbvtqljda.sys
2100	CreateProcess.exe
4796	yvtnlidavt.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_168805918\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_1291338798\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_1291338798\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_1803220906\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_1803220906\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_168805918\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_1291338798\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_1291338798\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_296531420\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqligdytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igayvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkicausnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtnlidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdavtnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtnlidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkidavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkidavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwtrligeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwurpnhecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gebwuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecxuke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jheczurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwurpnhecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfcxrpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfcxrpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecxuke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jheczurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwurmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkicausnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gebwuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwurmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwtrligeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgdbvtoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojgbytqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqligdytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nigaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojgbytqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igayvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdavtnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtrljgbywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqoigeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqoigeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgdbvtoig.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
240	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
928	ipconfig.exe
5220	ipconfig.exe
5008	ipconfig.exe
5464	ipconfig.exe
4496	ipconfig.exe
2716	ipconfig.exe
4792	ipconfig.exe
1892	ipconfig.exe
4892	ipconfig.exe
4856	ipconfig.exe
4436	ipconfig.exe
5952	ipconfig.exe
1540	ipconfig.exe
1940	ipconfig.exe
2460	ipconfig.exe
1072	ipconfig.exe
4032	ipconfig.exe
5904	ipconfig.exe
3776	ipconfig.exe
5556	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134287435379287546"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{8DADDB5C-62C6-47A5-B92B-8131826D3A82}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4836	jdbwtrljgbywqojg.exe
4836	jdbwtrljgbywqojg.exe
4836	jdbwtrljgbywqojg.exe
4836	jdbwtrljgbywqojg.exe
4836	jdbwtrljgbywqojg.exe
4836	jdbwtrljgbywqojg.exe
4836	jdbwtrljgbywqojg.exe
4836	jdbwtrljgbywqojg.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3480	i_rojgbytqoj.exe
Token: SeDebugPrivilege	3848	i_ysqligdytq.exe
Token: SeDebugPrivilege	5188	i_igayvqniga.exe
Token: SeDebugPrivilege	4024	i_lfdavtnifa.exe
Token: SeDebugPrivilege	2712	i_pkicausnhf.exe
Token: SeDebugPrivilege	4976	i_cwurpnhecx.exe
Token: SeDebugPrivilege	4912	i_ecwurmkecw.exe
Token: SeDebugPrivilege	596	i_mkebwuomge.exe
Token: SeDebugPrivilege	1624	i_gebwuomgey.exe
Token: SeDebugPrivilege	5944	i_eywqoigeyw.exe
Token: SeDebugPrivilege	6124	i_yvtnlidavt.exe
Token: SeDebugPrivilege	5884	i_qkidavsnlf.exe
Token: SeDebugPrivilege	1404	i_sqkicavsnl.exe
Token: SeDebugPrivilege	2152	i_nkfcxrpnhf.exe
Token: SeDebugPrivilege	2756	i_usmkecxuke.exe
Token: SeDebugPrivilege	4960	i_jheczurpjh.exe
Token: SeDebugPrivilege	1120	i_ebwurmjecw.exe
Token: SeDebugPrivilege	5896	i_ebwtrligeb.exe
Token: SeDebugPrivilege	3148	i_olgdbvtoig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3180	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 4836	4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4224 wrote to memory of 2492	4224	2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 2492 wrote to memory of 3180	2492	iexplore.exe	91
PID 3180 wrote to memory of 6120	3180	msedge.exe	92
PID 3180 wrote to memory of 3380	3180	msedge.exe	93
PID 3180 wrote to memory of 240	3180	msedge.exe	94
PID 3180 wrote to memory of 3380	3180	msedge.exe	93
PID 3180 wrote to memory of 3380	3180	msedge.exe	93
PID 3180 wrote to memory of 5612	3180	msedge.exe	95
PID 3180 wrote to memory of 5612	3180	msedge.exe	95
PID 3180 wrote to memory of 5344	3180	msedge.exe	97
PID 3180 wrote to memory of 5344	3180	msedge.exe	97
PID 3180 wrote to memory of 5164	3180	msedge.exe	98
PID 3180 wrote to memory of 5344	3180	msedge.exe	97
PID 3180 wrote to memory of 5164	3180	msedge.exe	98
PID 3180 wrote to memory of 5164	3180	msedge.exe	98
PID 3180 wrote to memory of 3144	3180	msedge.exe	99
PID 3180 wrote to memory of 1528	3180	msedge.exe	100
PID 3180 wrote to memory of 3144	3180	msedge.exe	99
PID 3180 wrote to memory of 3144	3180	msedge.exe	99
PID 3180 wrote to memory of 1528	3180	msedge.exe	100
PID 3180 wrote to memory of 1528	3180	msedge.exe	100
PID 3180 wrote to memory of 788	3180	msedge.exe	102
PID 3180 wrote to memory of 788	3180	msedge.exe	102
PID 4836 wrote to memory of 3136	4836	jdbwtrljgbywqojg.exe	105
PID 3180 wrote to memory of 5208	3180	msedge.exe	106
PID 3180 wrote to memory of 2484	3180	msedge.exe	107
PID 3180 wrote to memory of 5208	3180	msedge.exe	106
PID 3180 wrote to memory of 2484	3180	msedge.exe	107
PID 3180 wrote to memory of 5948	3180	msedge.exe	110
PID 5080 wrote to memory of 1736	5080	rojgbytqoj.exe	112
PID 3180 wrote to memory of 2412	3180	msedge.exe	115
PID 3180 wrote to memory of 2412	3180	msedge.exe	115
PID 3180 wrote to memory of 5884	3180	msedge.exe	116
PID 3180 wrote to memory of 5884	3180	msedge.exe	116
PID 4836 wrote to memory of 4576	4836	jdbwtrljgbywqojg.exe	119
PID 4836 wrote to memory of 3324	4836	jdbwtrljgbywqojg.exe	123
PID 4452 wrote to memory of 5496	4452	ysqligdytq.exe	125
PID 4836 wrote to memory of 4608	4836	jdbwtrljgbywqojg.exe	128
PID 4836 wrote to memory of 4060	4836	jdbwtrljgbywqojg.exe	132
PID 4128 wrote to memory of 5424	4128	igayvqniga.exe	134
PID 4836 wrote to memory of 5312	4836	jdbwtrljgbywqojg.exe	137
PID 4836 wrote to memory of 3320	4836	jdbwtrljgbywqojg.exe	142
PID 2752 wrote to memory of 5712	2752	lfdavtnifa.exe	144
PID 4836 wrote to memory of 5400	4836	jdbwtrljgbywqojg.exe	147
PID 3180 wrote to memory of 928	3180	msedge.exe	149
PID 3180 wrote to memory of 4112	3180	msedge.exe	150
PID 3180 wrote to memory of 1084	3180	msedge.exe	151
PID 4836 wrote to memory of 3376	4836	jdbwtrljgbywqojg.exe	154
PID 1748 wrote to memory of 3456	1748	pkicausnhf.exe	156
PID 4836 wrote to memory of 2916	4836	jdbwtrljgbywqojg.exe	159
PID 4836 wrote to memory of 932	4836	jdbwtrljgbywqojg.exe	163
PID 4340 wrote to memory of 2336	4340	cwurpnhecx.exe	165
PID 4836 wrote to memory of 1860	4836	jdbwtrljgbywqojg.exe	168
PID 4836 wrote to memory of 256	4836	jdbwtrljgbywqojg.exe	172
PID 5816 wrote to memory of 4656	5816	ecwurmkecw.exe	174
PID 4836 wrote to memory of 5760	4836	jdbwtrljgbywqojg.exe	177
PID 4836 wrote to memory of 2012	4836	jdbwtrljgbywqojg.exe	181
PID 5036 wrote to memory of 788	5036	mkebwuomge.exe	183
PID 4836 wrote to memory of 1516	4836	jdbwtrljgbywqojg.exe	186
PID 3180 wrote to memory of 756	3180	msedge.exe	188
PID 3180 wrote to memory of 756	3180	msedge.exe	188
PID 4836 wrote to memory of 5976	4836	jdbwtrljgbywqojg.exe	194
PID 4052 wrote to memory of 1252	4052	gebwuomgey.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_49edfc348c756c5e87a73550c980e390_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Temp\jdbwtrljgbywqojg.exe
  C:\Temp\jdbwtrljgbywqojg.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rojgbytqoj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3136
  - - C:\Temp\rojgbytqoj.exe
      C:\Temp\rojgbytqoj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5080
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1736
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rojgbytqoj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4576
  - - C:\Temp\i_rojgbytqoj.exe
      C:\Temp\i_rojgbytqoj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqligdytq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3324
  - - C:\Temp\ysqligdytq.exe
      C:\Temp\ysqligdytq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4452
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5496
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqligdytq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4608
  - - C:\Temp\i_ysqligdytq.exe
      C:\Temp\i_ysqligdytq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igayvqniga.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4060
  - - C:\Temp\igayvqniga.exe
      C:\Temp\igayvqniga.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4128
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5424
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igayvqniga.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5312
  - - C:\Temp\i_igayvqniga.exe
      C:\Temp\i_igayvqniga.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5188
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdavtnifa.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3320
  - - C:\Temp\lfdavtnifa.exe
      C:\Temp\lfdavtnifa.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2752
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5712
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdavtnifa.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5400
  - - C:\Temp\i_lfdavtnifa.exe
      C:\Temp\i_lfdavtnifa.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pkicausnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3376
  - - C:\Temp\pkicausnhf.exe
      C:\Temp\pkicausnhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1748
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5008
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pkicausnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2916
  - - C:\Temp\i_pkicausnhf.exe
      C:\Temp\i_pkicausnhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwurpnhecx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:932
  - - C:\Temp\cwurpnhecx.exe
      C:\Temp\cwurpnhecx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4340
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2336
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwurpnhecx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1860
  - - C:\Temp\i_cwurpnhecx.exe
      C:\Temp\i_cwurpnhecx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwurmkecw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:256
  - - C:\Temp\ecwurmkecw.exe
      C:\Temp\ecwurmkecw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5816
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4656
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwurmkecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5760
  - - C:\Temp\i_ecwurmkecw.exe
      C:\Temp\i_ecwurmkecw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkebwuomge.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2012
  - - C:\Temp\mkebwuomge.exe
      C:\Temp\mkebwuomge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5036
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:788
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkebwuomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1516
  - - C:\Temp\i_mkebwuomge.exe
      C:\Temp\i_mkebwuomge.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:596
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gebwuomgey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5976
  - - C:\Temp\gebwuomgey.exe
      C:\Temp\gebwuomgey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4052
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1252
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gebwuomgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4240
  - - C:\Temp\i_gebwuomgey.exe
      C:\Temp\i_gebwuomgey.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywqoigeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5344
  - - C:\Temp\eywqoigeyw.exe
      C:\Temp\eywqoigeyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2660
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5532
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywqoigeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:628
  - - C:\Temp\i_eywqoigeyw.exe
      C:\Temp\i_eywqoigeyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvtnlidavt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2100
  - - C:\Temp\yvtnlidavt.exe
      C:\Temp\yvtnlidavt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2520
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvtnlidavt.exe ups_ins
    3⤵
    PID:5244
  - - C:\Temp\i_yvtnlidavt.exe
      C:\Temp\i_yvtnlidavt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkidavsnlf.exe ups_run
    3⤵
    PID:1540
  - - C:\Temp\qkidavsnlf.exe
      C:\Temp\qkidavsnlf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2932
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1776
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkidavsnlf.exe ups_ins
    3⤵
    PID:2088
  - - C:\Temp\i_qkidavsnlf.exe
      C:\Temp\i_qkidavsnlf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkicavsnl.exe ups_run
    3⤵
    PID:5844
  - - C:\Temp\sqkicavsnl.exe
      C:\Temp\sqkicavsnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5692
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkicavsnl.exe ups_ins
    3⤵
    PID:5908
  - - C:\Temp\i_sqkicavsnl.exe
      C:\Temp\i_sqkicavsnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkfcxrpnhf.exe ups_run
    3⤵
    PID:3388
  - - C:\Temp\nkfcxrpnhf.exe
      C:\Temp\nkfcxrpnhf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5124
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2792
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkfcxrpnhf.exe ups_ins
    3⤵
    PID:720
  - - C:\Temp\i_nkfcxrpnhf.exe
      C:\Temp\i_nkfcxrpnhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkecxuke.exe ups_run
    3⤵
    PID:2344
  - - C:\Temp\usmkecxuke.exe
      C:\Temp\usmkecxuke.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1624
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:428
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkecxuke.exe ups_ins
    3⤵
    PID:1268
  - - C:\Temp\i_usmkecxuke.exe
      C:\Temp\i_usmkecxuke.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jheczurpjh.exe ups_run
    3⤵
    PID:5744
  - - C:\Temp\jheczurpjh.exe
      C:\Temp\jheczurpjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3480
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2808
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jheczurpjh.exe ups_ins
    3⤵
    PID:5964
  - - C:\Temp\i_jheczurpjh.exe
      C:\Temp\i_jheczurpjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwurmjecw.exe ups_run
    3⤵
    PID:2444
  - - C:\Temp\ebwurmjecw.exe
      C:\Temp\ebwurmjecw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4352
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5784
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebwurmjecw.exe ups_ins
    3⤵
    PID:3096
  - - C:\Temp\i_ebwurmjecw.exe
      C:\Temp\i_ebwurmjecw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwtrligeb.exe ups_run
    3⤵
    PID:3840
  - - C:\Temp\ebwtrligeb.exe
      C:\Temp\ebwtrligeb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2484
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5848
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebwtrligeb.exe ups_ins
    3⤵
    PID:5336
  - - C:\Temp\i_ebwtrligeb.exe
      C:\Temp\i_ebwtrligeb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\olgdbvtoig.exe ups_run
    3⤵
    PID:2392
  - - C:\Temp\olgdbvtoig.exe
      C:\Temp\olgdbvtoig.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4088
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5884
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_olgdbvtoig.exe ups_ins
    3⤵
    PID:4644
  - - C:\Temp\i_olgdbvtoig.exe
      C:\Temp\i_olgdbvtoig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nigaysqkid.exe ups_run
    3⤵
    PID:4468
  - - C:\Temp\nigaysqkid.exe
      C:\Temp\nigaysqkid.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1228
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3516
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5556
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ff89fbbc188,0x7ff89fbbc194,0x7ff89fbbc1a0
      4⤵
      PID:6120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,11720971688502290044,12587833385934164477,262144 --field-trial-handle=2312,i,2189346671056818993,2183973436109018163,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
      4⤵
      PID:3380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,4968830008669993187,16788890730488643133,524288 --field-trial-handle=2312,i,2189346671056818993,2183973436109018163,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:11
      4⤵
      System Time Discovery
      PID:240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,8311159176592569186,17761131410726948787,524288 --field-trial-handle=2312,i,2189346671056818993,2183973436109018163,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:13
      4⤵
      PID:5612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,1585286493331989908,6148815877242633960,2097152 --field-trial-handle=2312,i,2189346671056818993,2183973436109018163,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:5344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,2092723736320708149,16995025769801334463,2097152 --field-trial-handle=2312,i,2189346671056818993,2183973436109018163,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4384,i,3381291604828954383,11762706367935576214,2097152 --field-trial-handle=2312,i,2189346671056818993,2183973436109018163,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:9
      4⤵
      PID:3144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4360,i,9921017851072614060,17082549024456333650,2097152 --field-trial-handle=2312,i,2189346671056818993,2183973436109018163,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:1
      4⤵
      PID:1528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,4465095128204839847,12885448065630902221,524288 --field-trial-handle=2312,i,2189346671056818993,2183973436109018163,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:14
      4⤵
      PID:788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,13181578885505503127,12434189556724355930,524288 --field-trial-handle=2312,i,2189346671056818993,2183973436109018163,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
      4⤵
      PID:5208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,3525854810856434490,3628427226674868975,524288 --field-trial-handle=2312,i,2189346671056818993,2183973436109018163,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
      4⤵
      PID:2484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,10972285384938192051,3112724129825700199,524288 --field-trial-handle=2312,i,2189346671056818993,2183973436109018163,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
      4⤵
      PID:3848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,10972285384938192051,3112724129825700199,524288 --field-trial-handle=2312,i,2189346671056818993,2183973436109018163,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
      4⤵
      PID:5948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,8389003253112229981,1743548964197097075,524288 --field-trial-handle=2312,i,2189346671056818993,2183973436109018163,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
      4⤵
      PID:2412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,3769680911323284865,11771596861011123251,524288 --field-trial-handle=2312,i,2189346671056818993,2183973436109018163,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
      4⤵
      PID:5884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,15207978806285458450,2593883781659704211,524288 --field-trial-handle=2312,i,2189346671056818993,2183973436109018163,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
      4⤵
      PID:928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,6036405340827253575,3815795355677137134,524288 --field-trial-handle=2312,i,2189346671056818993,2183973436109018163,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,1000849273620582199,1310838470269597734,524288 --field-trial-handle=2312,i,2189346671056818993,2183973436109018163,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
      4⤵
      PID:1084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,7361317774351449908,251417714668018029,524288 --field-trial-handle=2312,i,2189346671056818993,2183973436109018163,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
      4⤵
      PID:756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,5018617889486022078,8255811111775304371,524288 --field-trial-handle=2312,i,2189346671056818993,2183973436109018163,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
      4⤵
      PID:3360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,15914707873450559479,14222266332229176047,524288 --field-trial-handle=2312,i,2189346671056818993,2183973436109018163,262144 --variations-seed-version --mojo-platform-channel-handle=928 /prefetch:14
      4⤵
      PID:5876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,16941472253767430735,18058649746862835251,524288 --field-trial-handle=2312,i,2189346671056818993,2183973436109018163,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
      4⤵
      PID:4976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5736,i,12287531424498793707,10145324381431040229,262144 --field-trial-handle=2312,i,2189346671056818993,2183973436109018163,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:10
      4⤵
      PID:4132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,2865943800049924345,11810477039373702601,524288 --field-trial-handle=2312,i,2189346671056818993,2183973436109018163,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:14
      4⤵
      PID:2168

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2272

C:\Temp\jdbwtrljgbywqojg.sys
C:\Temp\jdbwtrljgbywqojg.sys
1⤵
- Executes dropped EXE
PID:420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2060

C:\Temp\ayvqoigayw.sys
C:\Temp\ayvqoigayw.sys
1⤵
- Executes dropped EXE
PID:5224

C:\Temp\tqljdbvtnl.sys
C:\Temp\tqljdbvtnl.sys
1⤵
- Executes dropped EXE
PID:4480

C:\Temp\qkidavsnki.sys
C:\Temp\qkidavsnki.sys
1⤵
- Executes dropped EXE
PID:5884

C:\Temp\xvsnkfdxvq.sys
C:\Temp\xvsnkfdxvq.sys
1⤵
- Executes dropped EXE
PID:756

C:\Temp\fcwusmkhca.sys
C:\Temp\fcwusmkhca.sys
1⤵
- Executes dropped EXE
PID:4932

C:\Temp\pmkecxupnh.sys
C:\Temp\pmkecxupnh.sys
1⤵
- Executes dropped EXE
PID:5616

C:\Temp\pmhezwrpjh.sys
C:\Temp\pmhezwrpjh.sys
1⤵
- Executes dropped EXE
PID:1220

C:\Temp\ojgebwtolj.sys
C:\Temp\ojgebwtolj.sys
1⤵
- Executes dropped EXE
PID:4480

C:\Temp\gbytqljgby.sys
C:\Temp\gbytqljgby.sys
1⤵
- Executes dropped EXE
PID:2216

C:\Temp\gdbvtqljda.sys
C:\Temp\gdbvtqljda.sys
1⤵
- Executes dropped EXE
PID:4708

C:\Temp\qkidavtnlf.sys
C:\Temp\qkidavtnlf.sys
1⤵
PID:1508

C:\Temp\pnifaxvsnk.sys
C:\Temp\pnifaxvsnk.sys
1⤵
PID:5952

C:\Temp\usnkiuspkh.sys
C:\Temp\usnkiuspkh.sys
1⤵
PID:928

C:\Temp\rpnhczuspk.sys
C:\Temp\rpnhczuspk.sys
1⤵
PID:1056

C:\Temp\pjhbzurmjh.sys
C:\Temp\pjhbzurmjh.sys
1⤵
PID:3444

C:\Temp\heywrojhbz.sys
C:\Temp\heywrojhbz.sys
1⤵
PID:5000

C:\Temp\jgebwtrljd.sys
C:\Temp\jgebwtrljd.sys
1⤵
PID:6124

C:\Temp\oljgbytqoj.sys
C:\Temp\oljgbytqoj.sys
1⤵
PID:1960

C:\Temp\qlidbvtqlj.sys
C:\Temp\qlidbvtqlj.sys
1⤵
PID:1800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ayvqoigayw.sys

Path C:\Temp\ayvqoigayw.sys
Size 293KB
SHA256 8b3d5dd673ab0cd591a0a48f99bdd7458609bc265f18ee3a9fa25e85c04888bd
MD5 bde3cc3f7cbc6dcb59d347475ead8f7e
SHA1 4fba09e8482aca350ad6ee3918280aec5243ad3d
SHA512 0a7c18e4355c9ec7e750dd69d34be6ef9bc7f0d2c5e8fb2dc2dc8ecbbbe1d751be93e8ff619670a89d73cee081949398952c2df8ea2400e063f340df04aff3b7
SSDEEP 3072:ztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:zIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwurpnhecx.exe

Path C:\Temp\cwurpnhecx.exe
Size 361KB
SHA256 ac36a5c6a1a65c51a80993a825180d1ec51a859a6ca1275ed09f1f8ab721c083
MD5 2d268ad91ce574b2c6eadac8392e6236
SHA1 01e4a442578ffb34bb0fef4e0788d3609d4eb47b
SHA512 3efa43478e71f2856a93fea7bd5c06f8241f1bd36666166e279a64cfc209db40edc6032e205543c16d1107b02e79a948c373e0ddd3b3c5bcdd18b5c818ec7bc1
SSDEEP 6144:MflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:MflfAsiVGjSGecvX
TLSH
T134747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcwusmkhca.sys

Path C:\Temp\fcwusmkhca.sys
Size 293KB
SHA256 a81e3fcf38c0615c936813a64e80dfd5e0a8d0824d993df88a800e1636f1134c
MD5 a3de38683c226822869c242d0796fd69
SHA1 bc430c1e8343cc9e942d66a6f4ec2c9a405e2d97
SHA512 313fc198a8419db6837e3e79f8c4582507e9156b59a7fcd593ec71dd3f7630b9994448e2a9c573f8ddd253a9eca92229c87eba3afb57f8a1313bc4e4d71d5912
SSDEEP 3072:vtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:vIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igayvqniga.exe

Path C:\Temp\i_igayvqniga.exe
Size 361KB
SHA256 8966b7dba8233d5ebd65ff920b0699983d71166a96a351cc12649d52edd8e203
MD5 03e74d282f9f750be54e839987c7e339
SHA1 28989e02709e3f6451e645727e8c0ce5389967aa
SHA512 678926f48abc96b1003ff1f1ff2f2e08cff254f790a7c9de154f3c0ae486ae0e74f5c1e19bfde09afe66f04e07834e3292b9f8c289aeca96c968f5a35589a5f4
SSDEEP 6144:gflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:gflfAsiVGjSGecvX
TLSH
T164747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdavtnifa.exe

Path C:\Temp\i_lfdavtnifa.exe
Size 361KB
SHA256 8640a767bc33778014e6c9822fe27a885080d24745c263896a9b2ff0c22b1dc1
MD5 919480fe0176462d18a7bc9cd2742d34
SHA1 19e7015ebf33efef8ca60eb3db9f8dd6d71683e5
SHA512 72e1cea8c1a2db97f5aec8d912c2ecf5c4da75a2c85f446fda074d2e3d9730e91675fb25b57a4e6755a270ae84ba8444c4512b5c3a923d538e9e4add6a277b6f
SSDEEP 6144:lflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:lflfAsiVGjSGecvX
TLSH
T11D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pkicausnhf.exe

Path C:\Temp\i_pkicausnhf.exe
Size 361KB
SHA256 7a94a28b0e8cde69801dfec12ffc7d1954c0d4a735fdf45ca217f9f65def5a2c
MD5 bf8bb388d2040ce17d84dbe4395996ef
SHA1 871491691f1fa9f33d07ef2f5991d283641a0320
SHA512 1bfd96db4cfb759bc9f81f2aaef87a5becf0b8f57fc92a88d1bcef928043de9d271676ff50df3ee9e4af09dfd3fc208ea595ba5f0965f43cd13d0c168719fe68
SSDEEP 6144:rflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:rflfAsiVGjSGecvX
TLSH
T144747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rojgbytqoj.exe

Path C:\Temp\i_rojgbytqoj.exe
Size 361KB
SHA256 e12918f29fbe398e7ac27d89c153b200b769c5e5642cb656e33a1af25faed332
MD5 40e82ccd43953d2cfd3fd237a305a64e
SHA1 943cd0d13fe94a2c3759c3ac70762b9a39f3506a
SHA512 2675197aa82735162237aa6a86d0cf8b0bd2805efdb556f155b3baa6c6a2ccd7c9d3555b1df6cba1f230cd598aff9c9b6c151a2df9a4ff3b210930eb7259e769
SSDEEP 6144:zflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:zflfAsiVGjSGecvX
TLSH
T10F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqligdytq.exe

Path C:\Temp\i_ysqligdytq.exe
Size 361KB
SHA256 21f0d261364843f67bd896f3569968b5ca62bc7c6ca73116231a358639400abc
MD5 b922f41564ff4b480ba1eac2a37159ab
SHA1 2e69dcca2ee3939404de5876868861143f839c62
SHA512 f4ca0fea8d38bbb5fb7fbab5fda127eaafdfb5c278c4f464ea6a497ccacc92d52a559db9a911c87e0c6dff9dbd6b9e02356488fa59432c1d71b8f63f9338dc5a
SSDEEP 6144:6flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:6flfAsiVGjSGecvX
TLSH
T10F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igayvqniga.exe

Path C:\Temp\igayvqniga.exe
Size 361KB
SHA256 41b84d85b69c5cb227db7d0851b7120c44197bebf9eadfb2384af311dd1239ba
MD5 f79bc81f612d9b41b1a9a1032e96746e
SHA1 887f19e4a45c89c660ab0261fb86246f1f3249ea
SHA512 20e078954f7f81b0308276ba3480c52e0def39fa982a6a2586510382bf995e059b22485617904518b086846132132fe45f5316c713072357e2c8936b6eb7c57e
SSDEEP 6144:PflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:PflfAsiVGjSGecvX
TLSH
T16F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbwtrljgbywqojg.exe

Path C:\Temp\jdbwtrljgbywqojg.exe
Size 361KB
SHA256 173e31ceaec818b57e99adfea2229411a2248700acf094cc369c3a3c5dfec984
MD5 5585e1351232b200b312b3f2e553a01d
SHA1 818a327307b4432ddf663137f2c83a6da04a1bd4
SHA512 9054bcc1967c343bcfaeee429b1ec0d15de5d6b04ff20e719539a6d5ad25ed63af4f067ee6794381bf1731a157c5a7f5036edbe03c119f70fca724c7386d925c
SSDEEP 6144:BflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:BflfAsiVGjSGecvX
TLSH
T1F8747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbwtrljgbywqojg.sys

Path C:\Temp\jdbwtrljgbywqojg.sys
Size 293KB
SHA256 1a18b5313d740121ed9a710a336f5b28744dd7d7fde3ec2f0b1f334ca7254c91
MD5 bd3e4cc795ef909c89b431e8bee8a383
SHA1 2a5b66db6e9bb0ed4d2fb9ad07238dbf26ac0f32
SHA512 e8d37842238102af6811681b3e4f15af4a36af2e7ca264e40b889362bc96d17cd6ca0c4c9baac0db3ecc00c576c052ef39a36e74de6f93aaf1f5e9e92106f74b
SSDEEP 3072:CtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:CIJjiJcbI03GBc3ucY5DCSj
TLSH
T11F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdavtnifa.exe

Path C:\Temp\lfdavtnifa.exe
Size 361KB
SHA256 9ddee9e7e92536e9a764b9ce50b72ed49b4a122ad569bf6d46896bbc49ba8e71
MD5 d996417f6703fcabc24282a6694eed7b
SHA1 6439056703c88fb1ea847ad15420fd5d86e2d3b2
SHA512 712a7b6b9e561f1ccb469b9e6a518da54db759cd508e4b7f2a06bbb161602fbc9643368ab29361aa52837a8c4b5b14af089b1a479039355a265b6b2e8971d697
SSDEEP 6144:BflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:BflfAsiVGjSGecvX
TLSH
T1FC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkicausnhf.exe

Path C:\Temp\pkicausnhf.exe
Size 361KB
SHA256 604670a5bf80e1c621bd23227111cc524bc296fc24aed33f782bd553b38d3068
MD5 75720997cd774ea71fb5ac2fad325ed2
SHA1 f50685ed9b37723c43c8fa7987e2a502371e274e
SHA512 fe73112c5553e1bb15e9a365d6e4f24f2071057a8dcf8fc4bc0bc5794d3a29bc2ab56affe7db9de0d077d9c3553971c7af8118493e51c57e9fd60d8862329620
SSDEEP 6144:7flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:7flfAsiVGjSGecvX
TLSH
T1B1747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkidavsnki.sys

Path C:\Temp\qkidavsnki.sys
Size 293KB
SHA256 48e2e7c94f9aeb2b131171f03d83daa9813353b93a56e84e2e414e5e3b60bdb9
MD5 4d750d7c3bc75ec873717138e909e2f4
SHA1 292426ff84221df86c7ed9d0c323779e0056f85e
SHA512 504d514f866b3161dba15702bbb49668b77afd9ea3a5a16e9be081be76b0e049cea3701162ecef1e52d9c4ca253a5f3eb43236f4ea3d701cca2c0fac05fe3b03
SSDEEP 3072:ItKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:IIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojgbytqoj.exe

Path C:\Temp\rojgbytqoj.exe
Size 361KB
SHA256 7751e481a2788713428f1150136531a93b4b4568491b22c1317973a7ac6125b8
MD5 1e5ade930f738435f627c6120071064f
SHA1 15f1c6446fb6d515f7a1bf500adf0e7893586886
SHA512 586d31d402aef301a575ba4d5fbf3d461b3e22a53f50696e823e883ee4e97378780a76c363869eddae3b8ba85b058662ba91a6a11ed6cb30030410652762c197
SSDEEP 6144:xflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:xflfAsiVGjSGecvX
TLSH
T117747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqljdbvtnl.sys

Path C:\Temp\tqljdbvtnl.sys
Size 293KB
SHA256 7d74906a358ff01e4ab61ebb555e08d74c93d236d092ec406fcda4e9e919e8a3
MD5 08ae298d88b6f4d58bd888a567fc8908
SHA1 c8e90f5e07edf0fdd243f42051b449ea849ae03d
SHA512 17f6e62e135ed2d47e6a7aa80add94168ed0654cdb8491a4d929800539436640eea05c4696256e37ff7cad28c2eeab3397cdf1d4dccc8961dcbd96bd0aaaef1b
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T178545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvsnkfdxvq.sys

Path C:\Temp\xvsnkfdxvq.sys
Size 293KB
SHA256 fa594b1ff9b2a0f2c163853ada93c2d1ad41bd17fb1e6bfcaf79331efa685cd9
MD5 d9a06d9524ef5b4f153739b2c0ba6463
SHA1 11a5efab0bd8ec940a135fe841329b61eb18c561
SHA512 564d73632dbf1405b9e197f24b3760ff69cabdbf13361eaf2aa52baaf920c8de4ed3c6a577dfab4324a98d0d25cd5375dd498c09d642e36ce49c547255d09a61
SSDEEP 3072:4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:4IJjiJcbI03GBc3ucY5DCSj
TLSH
T157545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqligdytq.exe

Path C:\Temp\ysqligdytq.exe
Size 361KB
SHA256 0e7607f6954da76054932a0ba47109288953b8be81a9bfd60b8adc576e9ef767
MD5 446a432785afd19b43a58c0fe63a5204
SHA1 1ddd917c747bcca0336181f9e4e14f076bba5151
SHA512 25298064f6b2531db7533bb7446b6bab39b1d49365f435ce479a1533edccde1bac3ac791ec1da17619c68ceadebf4002af9c487e533924a97e775141059b5085
SSDEEP 6144:MflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:MflfAsiVGjSGecvX
TLSH
T122747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 205fff710fd1c78b2ce8dcbf65b72e9c5c9ce1f5cb48a56de9b4f81942f94d80
MD5 3801fd1f06688d09f73c4e7ff080ac97
SHA1 9635842afc271c48d655389689f863418dc9eb17
SHA512 8ef6733fcd55ce4ef8817c5b6e0008ec96b315420379533065d1832dd2809bb1e27a599ff5a0e7b3d4ae641a8e960f5c03ec27ab2a098ccb3121a0b8f3580c71
TLSH
T1D16150D5231A6B92EF204EB1DDE2764D35F3C754090BAAB048006D360B2EF1954D2DE3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b53d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b53d.TMP
Size 3KB
SHA256 bc99f5492897dc5b7f0f81243e1b5858642fb1dc57bdd743009c4867b2824de1
MD5 2d6536501787e80acb7211f683c5a375
SHA1 7d1850822e8c8d891fd026c1bcb6062ea3e94adf
SHA512 df8137251567c7a008842fec1e109caafa91019d5deb553b4a8c853b2f17a2879cda35a37000c2b3a4cc4970faf8d3146c49791aa4e6f0215d9e25ee88baecc0
TLSH
T1AB6150D5271A2B92EF204EB1DDE2764D35F3C754090BAAB048006D360B6EF1954D2DE3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 da24728490a6ae29e31ace3684bd624fef7da6cd229964901136efb58cc0f883
MD5 c17e950084ed303c0682f5628a842854
SHA1 7867a2bb48471b43cee7ec5ae2975cf79013bfda
SHA512 86a7fd1402e7d432526ce9b33d422882974b4564cb4ff15be5833e6a87a99f4e7a0abec65ab3e1ab96fc7d758fe5d1d6b87671a0208719a7cea81be2899ff7d8
TLSH
T1EB41BDF3C3E8866E890156F0AA147E1BCE1D0915832C3D5AC9E4EF5BA3E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ae1bf5da2515a4de75eeb721927d9c1d3b53923397f4b39cce6a4f14dc113188
MD5 037da83f121a7a53ecaeb7a1acd8f774
SHA1 3dd66bc995f31a8fe8076b565263813223f35b50
SHA512 b0bfcc69eb868bed38d5573b7fc376c7b46edaa70e20abfa884e4e469afbfb68a2d77f91a5502363e56dce206a006c237ffed71d44f543e4ec18c7d8d5d035e4
SSDEEP 192:sxRLRtCcG/f+snnO9ZKgCPBzoA8p9L/g6+WNCmV/YD926SMYGLZIgtJ:sxRLKp/f+snnOzKg1Z/5x/2Su3
TLSH
T13032B7566D28A93B5CCBD219FB55BF53E2F96032A1D15E48E7FC960C00E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b6f44279110cd2b107c82c27eb125c064a9f45d1db66514f4bdc13fe7aca162e
MD5 e6c1aa29f51d2f15bbe4855a759e1d63
SHA1 ae4f675e1f94622951e7509908ecba8062ae8c34
SHA512 a7b15310e96a657c5d47475a5106b994c61f741b7ac4e35ccab293cb19e0884dbf233f302386ae4345c814d388274510a4049a0fb26a3aefd85b7f3495c16a96
SSDEEP 192:sxRsRtCcG/f+sEnO9ZKgCPBzoA8p9L/g6+WNCmV/YD926SMYGLZIgD7J:sxRsKp/f+sEnOzKg1Z/5x/2Suh
TLSH
T15642B6566D28A93B5CCBD219FB55BF53E2F96032A1D15E48E7FC960C00E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 97b4e265ac745840c4ac464283c86951e810975cc94114474adc6a4d55b253f9
MD5 0fc65de67a6f6c0f0f75e388645eeae7
SHA1 a98a91c010c34f998bceabef6fb413c39f860b1d
SHA512 1f5f50535d5a3a653e21b189d6bfa7e05a473a79cb402aa699d2f81d65ded78b1f8619f924777c936413f4b179fbb050937b58912a98ee0d0830cdbc517039ab
SSDEEP 192:sxRsRtCcG/f+sEnf9ZKgCPBzoA8p9L/g6+WNCmV/YD94U6SMYGLZIgDxJ:sxRsKp/f+sEnfzKg1Z/5x/fZSuv
TLSH
T1E442A6566D28A93B5CCBD219BB55BF53E2F96032A1915E48A7FC970C00E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 c07be34a9069bf146cf0f4433404cd499bc3e0fe1858bf8a0b0206b830294792
MD5 dc5d06a1c2858b38150e2750597287fe
SHA1 7e08b2f0487c44290a4bfa22fdc176e80258be92
SHA512 1c9fbcd83d87b53b97784081d11cc198297f0c1ce6925c8ae553addb9643b236ae5aa04ef6243309130199fd1f1f3a4ff2db2d0d3d0f35bb55813849bb7e81aa
SSDEEP 768:azfW/L7pLuL7J0Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVuoYc161ropiWNX:azfW/dE7J0Wg/XfHfu1jaJoYy6Opiq
TLSH
T1DAD2EA7B240CCA7F4F800ADDAD197EDF6DA802CB9698CD5047FE951C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 169468a6e8149f4c148856733325c81789b04083a1826d6cdfafc094bdd9f812
MD5 d61c34893f5bba3cd4aada209c8371f4
SHA1 ae84ccc6b1c03cd6cc3f451dbf648b31fcba8367
SHA512 66f3ae4947e2dda51a3b3df8dc5842cf6e302fb32d74e68d064daefd9efe979a22e8a3a358ee1512b8d7ec499ea30e1480e4f242312a1c8818dd125983360f21
SSDEEP 96:KRE/iE/nE/OE/iE/UE/0E/kE/iWE/sE/5E/RgE/SE/iK4E/HgE/IE/icE/yE/6ES:CE/iE/nE/OE/iE/UE/0E/kE/dE/sE/5U
TLSH
T194915241323E1290387FAA48C664896A92C1B4A33069E56B7FE951651F2FE135CFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81fbbb05-800c-4454-9fda-5c88347a040e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\81fbbb05-800c-4454-9fda-5c88347a040e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9157c448a979acfb94a927681fa7e19f43299c8a31e0e9d9bdf841c85f44d41d
MD5 dfc5dd30e0a71047609eae101d3072c5
SHA1 889d34a3ed97469ebc36e5b0110e8ee0ed471f63
SHA512 d1ea27b7fa1c4dbe25ada746c382460437ae74b1a4a53c9e711a1d57c0563cec283341998e404441cd8979af9e4ec26e5a3888d2f457db2a58cc6a68bdd7aaa1
SSDEEP 384:n4tNn/s3n9Sj38NX4aJmqE8uWZlf8hyEG6f77h7F+ry2rEoajo4cdR8eHhVODjYl:4j+9g3xii0QWNrEnjN3Gac1F6b9MV
TLSH
T1BBF2BF3468698EB34CEBD79576473B87AFE017A385C50F94DAC9AB0C05C36EC170B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f22e6ce79330fefeeb2a9d3e6ae3fae63237a08cfa80ee7af589f164a13e6b86
MD5 9e6761e1ab77a5ad7db8d0f0d0c68b21
SHA1 70d61870d4ab08e633b3c631f9505f329b7c35bb
SHA512 08ad5e800aaf9bb41c6dffdd2da530cf2b5907b67ad4d0f9b7d7e07afa6d42c26e830141d18aeafaba6d7550d7444bd78663117b4e08e094d310626f6b5f33af
SSDEEP 768:rrv+4UNbdS3Mmi0QyrEnjN3Gac1ZveVH1SCz:rbsbg3r7QnjMaMEH1V
TLSH
T10E03CF3269A88AB39CE7E38575877A037FB4525385D40BE0C6DD6B0D02DB5EC230B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8f3d943c53c2e9a998f1845de2a84a6aa48a3d3b9ec28bc252f6b08efa062c29
MD5 f0698d0ec8bc1bcccb2fcf9794edb5fc
SHA1 386e6e7da578fd82de521a7a8a27691dc49c0002
SHA512 c117bafe43079b95afca73986b6434e07f6e9d72166c61d555e16cd3f38c021b76c55d25144ac8d1546dee5c7dc24dfa9e764fe3b7c0ec9d8ace120ff5c1a130
SSDEEP 384:n+tNn/s3n9Sj38NXxaJmW7E8uWZlf8hyEG6f77h7F+ry2rEoajo4cdR8eHhVODjM:+j+9g3Voii0QWNrEnjN3Gac1F6b9MV
TLSH
T147F2BF3468699EB34CDBD79576473B83AFE017A385C50F94DAD9AB0C05C36EC130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 4edf2a553b17a2d8dd86a2501a626a79d656ca1a43c7d22c6a3cc541fe79040e
MD5 f9194d7d31d8fe12b3232092c7cad1c6
SHA1 908d23dc477962cfc1ba76ce4455dc0b2c833c51
SHA512 4b79e17defe3406d74f4a600a323a62b099ad53218f9700508b4de59d82abfc6c28b40582dc01c84691ce4d2f8245a7e19f797ad6a749bfccd1ee0d82deb6d8a
SSDEEP 768:fF1j+9D3qwgeLlsQW1rEnjN3Gac1F6b9MV:W9D3PCX1QnjMapb+V
TLSH
T1A21317F598D78A77D8AE8787673E6E469EBCC263B4884994B7C45D0CCC831BFC206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3180_841465112\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 86e84c1baefac1d436cbe3ca853bc7e7cf2e9c8b73ab3182c1dcd82305a73721
MD5 0eb2e771c91eb71fcf24e56ae31676e0
SHA1 d6e62b4820eb8fd2d93a031da699d9de9d8dd0b5
SHA512 19e9ecaa8dcdadace28710d3f7a16316e0d8feabf0e0c2a4d60fb6ce35bfe2a905df9295de8e5b1b792e25daf9cd655b45cdaed0c61f68bd800e7467daa5620b
TLSH
T11371008357A8D5F2C5DA9BF502835644F5BB2238076330700B91998AFA30A7A64B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/420-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/756-273-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/928-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1056-429-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1220-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1508-384-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1508-406-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1800-487-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1960-489-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1960-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2216-365-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2216-334-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3444-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4480-233-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4480-330-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4708-363-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4932-286-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5000-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5224-186-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5616-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5884-261-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5952-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6124-466-0x0000000000010000-0x00000000000AB000-memory.dmp

Download