systex | 1c5dcaea3baaf65923225dcde154c3e17e12b198b940c280791cd48320dcd3b6

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260722-24qb5sstdt
SHA256 1c5dcaea3baaf65923225dcde154c3e17e12b198b940c280791cd48320dcd3b6
MD5 e2e050de652aa833472a451dde579924
SHA1 c24ac13a4a713aecc80a6b419ffe38a253ab5517
SHA512 ad74aa407ff05daa3012096cc6520244970fd4c9363737e8a706907000b567f18e61a7e773b782b802844ccbb31bd572ee000345eb73b66ac17213ac7ab91cda
SSDEEP 6144:7flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:7flfAsiVGjSGecvX
TLSH
T129747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4276	tnlfdyvqoigaysql.exe
4380	tnlfdyvqoigaysql.sys
1008	CreateProcess.exe
3256	sqoigdywqo.exe
5572	CreateProcess.exe
1940	CreateProcess.exe
5424	i_sqoigdywqo.exe
2092	ysqnifaysq.sys
2808	CreateProcess.exe
3724	spnifaxsql.exe
2392	CreateProcess.exe
1896	CreateProcess.exe
2524	i_spnifaxsql.exe
2152	kifaxspnkf.sys
5312	CreateProcess.exe
3232	kifdxuspkh.exe
5164	CreateProcess.exe
3248	CreateProcess.exe
3756	i_kifdxuspkh.exe
3584	vpnkfcxvpn.sys
2104	CreateProcess.exe
4496	mkecxupnhf.exe
3120	CreateProcess.exe
1544	CreateProcess.exe
3828	i_mkecxupnhf.exe
1492	mkhcauspmh.sys
1824	CreateProcess.exe
1372	khcwupmhfz.exe
5600	CreateProcess.exe
3124	CreateProcess.exe
1444	i_khcwupmhfz.exe
2516	zwromkecwu.sys
3312	CreateProcess.exe
5612	wrpjhbztrm.exe
1156	CreateProcess.exe
5792	CreateProcess.exe
3584	i_wrpjhbztrm.exe
4188	bwtrmjebwt.sys
3936	CreateProcess.exe
5184	ebwuomgeyw.exe
3008	CreateProcess.exe
6012	CreateProcess.exe
2024	i_ebwuomgeyw.exe
3196	ojgeywqomg.sys
5200	CreateProcess.exe
4720	dbvtolgeyw.exe
4808	CreateProcess.exe
4080	CreateProcess.exe
3368	i_dbvtolgeyw.exe
3260	qolgdbytrl.sys
4900	CreateProcess.exe
3512	lgdbvqnigd.exe
6076	CreateProcess.exe
2796	CreateProcess.exe
3756	i_lgdbvqnigd.exe
3584	dxvqnifdyv.sys
4936	CreateProcess.exe
4196	vqnigaysqk.exe
1920	CreateProcess.exe
4520	CreateProcess.exe
3196	i_vqnigaysqk.exe
6108	pnlicavsnl.sys
5128	CreateProcess.exe
1256	nkfdxvpnif.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6136_1555682964\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6136_1555682964\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6136_1740351922\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6136_837502707\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6136_837502707\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6136_837502707\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6136_981574866\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6136_1740351922\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6136_837502707\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqoigdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljhecwurl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeytrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdyvqoigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqoigdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljhecwurl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeytrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnifaxsql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifdxuspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oljdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idavsnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdbvqnigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oljdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idavsnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khcwupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnifaxsql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdbvqnigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khczxrpmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzurmjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khcwupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfdxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfdxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khczxrpmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifdxuspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzurmjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idaysqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idaysqlidb.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1448	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2372	ipconfig.exe
4936	ipconfig.exe
6020	ipconfig.exe
1232	ipconfig.exe
3428	ipconfig.exe
8	ipconfig.exe
4224	ipconfig.exe
2784	ipconfig.exe
4520	ipconfig.exe
5944	ipconfig.exe
5732	ipconfig.exe
2884	ipconfig.exe
1540	ipconfig.exe
5604	ipconfig.exe
3168	ipconfig.exe
3648	ipconfig.exe
1764	ipconfig.exe
4920	ipconfig.exe
1624	ipconfig.exe
4556	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292353163697911"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{AE109342-C173-45E1-A694-D11213E7F0CB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4276	tnlfdyvqoigaysql.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4276	tnlfdyvqoigaysql.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4276	tnlfdyvqoigaysql.exe
4276	tnlfdyvqoigaysql.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4276	tnlfdyvqoigaysql.exe
4276	tnlfdyvqoigaysql.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4276	tnlfdyvqoigaysql.exe
4276	tnlfdyvqoigaysql.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4276	tnlfdyvqoigaysql.exe
4276	tnlfdyvqoigaysql.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4276	tnlfdyvqoigaysql.exe
4276	tnlfdyvqoigaysql.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5424	i_sqoigdywqo.exe
Token: SeDebugPrivilege	2524	i_spnifaxsql.exe
Token: SeDebugPrivilege	3756	i_kifdxuspkh.exe
Token: SeDebugPrivilege	3828	i_mkecxupnhf.exe
Token: SeDebugPrivilege	1444	i_khcwupmhfz.exe
Token: SeDebugPrivilege	3584	i_wrpjhbztrm.exe
Token: SeDebugPrivilege	2024	i_ebwuomgeyw.exe
Token: SeDebugPrivilege	3368	i_dbvtolgeyw.exe
Token: SeDebugPrivilege	3756	i_lgdbvqnigd.exe
Token: SeDebugPrivilege	3196	i_vqnigaysqk.exe
Token: SeDebugPrivilege	1704	i_nkfdxvpnif.exe
Token: SeDebugPrivilege	1724	i_hfzxspkhca.exe
Token: SeDebugPrivilege	1888	i_khczxrpmke.exe
Token: SeDebugPrivilege	4824	i_hbzurmjebw.exe
Token: SeDebugPrivilege	1948	i_rljhecwurl.exe
Token: SeDebugPrivilege	4288	i_omgeytrojg.exe
Token: SeDebugPrivilege	4476	i_oljdywqoig.exe
Token: SeDebugPrivilege	4072	i_idaysqlidb.exe
Token: SeDebugPrivilege	4964	i_idavsnkfdx.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6136	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3844 wrote to memory of 4276	3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 3844 wrote to memory of 3060	3844	2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 3060 wrote to memory of 6136	3060	iexplore.exe	91
PID 6136 wrote to memory of 2368	6136	msedge.exe	92
PID 6136 wrote to memory of 5920	6136	msedge.exe	93
PID 6136 wrote to memory of 1448	6136	msedge.exe	94
PID 6136 wrote to memory of 5920	6136	msedge.exe	93
PID 6136 wrote to memory of 5920	6136	msedge.exe	93
PID 6136 wrote to memory of 5016	6136	msedge.exe	95
PID 6136 wrote to memory of 5016	6136	msedge.exe	95
PID 6136 wrote to memory of 4868	6136	msedge.exe	96
PID 6136 wrote to memory of 4868	6136	msedge.exe	96
PID 6136 wrote to memory of 4868	6136	msedge.exe	96
PID 6136 wrote to memory of 3560	6136	msedge.exe	97
PID 6136 wrote to memory of 3560	6136	msedge.exe	97
PID 6136 wrote to memory of 3560	6136	msedge.exe	97
PID 6136 wrote to memory of 3260	6136	msedge.exe	99
PID 6136 wrote to memory of 4948	6136	msedge.exe	100
PID 6136 wrote to memory of 3260	6136	msedge.exe	99
PID 6136 wrote to memory of 3260	6136	msedge.exe	99
PID 6136 wrote to memory of 4948	6136	msedge.exe	100
PID 6136 wrote to memory of 4948	6136	msedge.exe	100
PID 6136 wrote to memory of 1376	6136	msedge.exe	102
PID 6136 wrote to memory of 1376	6136	msedge.exe	102
PID 6136 wrote to memory of 3488	6136	msedge.exe	105
PID 6136 wrote to memory of 3488	6136	msedge.exe	105
PID 6136 wrote to memory of 4064	6136	msedge.exe	106
PID 6136 wrote to memory of 4064	6136	msedge.exe	106
PID 6136 wrote to memory of 844	6136	msedge.exe	108
PID 6136 wrote to memory of 5148	6136	msedge.exe	109
PID 6136 wrote to memory of 5148	6136	msedge.exe	109
PID 4276 wrote to memory of 1008	4276	tnlfdyvqoigaysql.exe	110
PID 3256 wrote to memory of 5572	3256	sqoigdywqo.exe	113
PID 6136 wrote to memory of 5884	6136	msedge.exe	116
PID 6136 wrote to memory of 5884	6136	msedge.exe	116
PID 4276 wrote to memory of 1940	4276	tnlfdyvqoigaysql.exe	119
PID 4276 wrote to memory of 2808	4276	tnlfdyvqoigaysql.exe	123
PID 3724 wrote to memory of 2392	3724	spnifaxsql.exe	125
PID 4276 wrote to memory of 1896	4276	tnlfdyvqoigaysql.exe	128
PID 4276 wrote to memory of 5312	4276	tnlfdyvqoigaysql.exe	132
PID 3232 wrote to memory of 5164	3232	kifdxuspkh.exe	134
PID 4276 wrote to memory of 3248	4276	tnlfdyvqoigaysql.exe	137
PID 4276 wrote to memory of 2104	4276	tnlfdyvqoigaysql.exe	142
PID 4496 wrote to memory of 3120	4496	mkecxupnhf.exe	144
PID 4276 wrote to memory of 1544	4276	tnlfdyvqoigaysql.exe	147
PID 6136 wrote to memory of 4968	6136	msedge.exe	149
PID 6136 wrote to memory of 5456	6136	msedge.exe	150
PID 6136 wrote to memory of 4448	6136	msedge.exe	151
PID 4276 wrote to memory of 1824	4276	tnlfdyvqoigaysql.exe	154
PID 1372 wrote to memory of 5600	1372	khcwupmhfz.exe	156
PID 4276 wrote to memory of 3124	4276	tnlfdyvqoigaysql.exe	159
PID 4276 wrote to memory of 3312	4276	tnlfdyvqoigaysql.exe	163
PID 5612 wrote to memory of 1156	5612	wrpjhbztrm.exe	165
PID 4276 wrote to memory of 5792	4276	tnlfdyvqoigaysql.exe	168
PID 4276 wrote to memory of 3936	4276	tnlfdyvqoigaysql.exe	172
PID 5184 wrote to memory of 3008	5184	ebwuomgeyw.exe	174
PID 4276 wrote to memory of 6012	4276	tnlfdyvqoigaysql.exe	177
PID 4276 wrote to memory of 5200	4276	tnlfdyvqoigaysql.exe	181
PID 4720 wrote to memory of 4808	4720	dbvtolgeyw.exe	183
PID 4276 wrote to memory of 4080	4276	tnlfdyvqoigaysql.exe	186
PID 6136 wrote to memory of 2672	6136	msedge.exe	188
PID 6136 wrote to memory of 2672	6136	msedge.exe	188
PID 4276 wrote to memory of 4900	4276	tnlfdyvqoigaysql.exe	194
PID 3512 wrote to memory of 6076	3512	lgdbvqnigd.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_e2e050de652aa833472a451dde579924_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Temp\tnlfdyvqoigaysql.exe
  C:\Temp\tnlfdyvqoigaysql.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqoigdywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1008
  - - C:\Temp\sqoigdywqo.exe
      C:\Temp\sqoigdywqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3256
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5572
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqoigdywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1940
  - - C:\Temp\i_sqoigdywqo.exe
      C:\Temp\i_sqoigdywqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spnifaxsql.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2808
  - - C:\Temp\spnifaxsql.exe
      C:\Temp\spnifaxsql.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3724
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2392
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spnifaxsql.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1896
  - - C:\Temp\i_spnifaxsql.exe
      C:\Temp\i_spnifaxsql.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kifdxuspkh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5312
  - - C:\Temp\kifdxuspkh.exe
      C:\Temp\kifdxuspkh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3232
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5164
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kifdxuspkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3248
  - - C:\Temp\i_kifdxuspkh.exe
      C:\Temp\i_kifdxuspkh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkecxupnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2104
  - - C:\Temp\mkecxupnhf.exe
      C:\Temp\mkecxupnhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4496
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3120
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkecxupnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1544
  - - C:\Temp\i_mkecxupnhf.exe
      C:\Temp\i_mkecxupnhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khcwupmhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1824
  - - C:\Temp\khcwupmhfz.exe
      C:\Temp\khcwupmhfz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1372
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5600
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khcwupmhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3124
  - - C:\Temp\i_khcwupmhfz.exe
      C:\Temp\i_khcwupmhfz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrpjhbztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3312
  - - C:\Temp\wrpjhbztrm.exe
      C:\Temp\wrpjhbztrm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5612
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1156
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrpjhbztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5792
  - - C:\Temp\i_wrpjhbztrm.exe
      C:\Temp\i_wrpjhbztrm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwuomgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3936
  - - C:\Temp\ebwuomgeyw.exe
      C:\Temp\ebwuomgeyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5184
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3008
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebwuomgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6012
  - - C:\Temp\i_ebwuomgeyw.exe
      C:\Temp\i_ebwuomgeyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtolgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5200
  - - C:\Temp\dbvtolgeyw.exe
      C:\Temp\dbvtolgeyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4720
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4808
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtolgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4080
  - - C:\Temp\i_dbvtolgeyw.exe
      C:\Temp\i_dbvtolgeyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdbvqnigd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4900
  - - C:\Temp\lgdbvqnigd.exe
      C:\Temp\lgdbvqnigd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3512
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6076
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgdbvqnigd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2796
  - - C:\Temp\i_lgdbvqnigd.exe
      C:\Temp\i_lgdbvqnigd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vqnigaysqk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4936
  - - C:\Temp\vqnigaysqk.exe
      C:\Temp\vqnigaysqk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4196
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1920
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vqnigaysqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4520
  - - C:\Temp\i_vqnigaysqk.exe
      C:\Temp\i_vqnigaysqk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkfdxvpnif.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5128
  - - C:\Temp\nkfdxvpnif.exe
      C:\Temp\nkfdxvpnif.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1256
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1564
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkfdxvpnif.exe ups_ins
    3⤵
    PID:4692
  - - C:\Temp\i_nkfdxvpnif.exe
      C:\Temp\i_nkfdxvpnif.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzxspkhca.exe ups_run
    3⤵
    PID:2252
  - - C:\Temp\hfzxspkhca.exe
      C:\Temp\hfzxspkhca.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1424
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfzxspkhca.exe ups_ins
    3⤵
    PID:3660
  - - C:\Temp\i_hfzxspkhca.exe
      C:\Temp\i_hfzxspkhca.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khczxrpmke.exe ups_run
    3⤵
    PID:2568
  - - C:\Temp\khczxrpmke.exe
      C:\Temp\khczxrpmke.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4320
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3928
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:8
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khczxrpmke.exe ups_ins
    3⤵
    PID:1004
  - - C:\Temp\i_khczxrpmke.exe
      C:\Temp\i_khczxrpmke.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbzurmjebw.exe ups_run
    3⤵
    PID:4240
  - - C:\Temp\hbzurmjebw.exe
      C:\Temp\hbzurmjebw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1136
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3880
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbzurmjebw.exe ups_ins
    3⤵
    PID:2976
  - - C:\Temp\i_hbzurmjebw.exe
      C:\Temp\i_hbzurmjebw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljhecwurl.exe ups_run
    3⤵
    PID:4124
  - - C:\Temp\rljhecwurl.exe
      C:\Temp\rljhecwurl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4932
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1512
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljhecwurl.exe ups_ins
    3⤵
    PID:3192
  - - C:\Temp\i_rljhecwurl.exe
      C:\Temp\i_rljhecwurl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgeytrojg.exe ups_run
    3⤵
    PID:3524
  - - C:\Temp\omgeytrojg.exe
      C:\Temp\omgeytrojg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4168
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4572
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4224
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgeytrojg.exe ups_ins
    3⤵
    PID:2308
  - - C:\Temp\i_omgeytrojg.exe
      C:\Temp\i_omgeytrojg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oljdywqoig.exe ups_run
    3⤵
    PID:800
  - - C:\Temp\oljdywqoig.exe
      C:\Temp\oljdywqoig.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1888
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1148
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oljdywqoig.exe ups_ins
    3⤵
    PID:4592
  - - C:\Temp\i_oljdywqoig.exe
      C:\Temp\i_oljdywqoig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idaysqlidb.exe ups_run
    3⤵
    PID:4548
  - - C:\Temp\idaysqlidb.exe
      C:\Temp\idaysqlidb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2380
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4780
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4556
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_idaysqlidb.exe ups_ins
    3⤵
    PID:2188
  - - C:\Temp\i_idaysqlidb.exe
      C:\Temp\i_idaysqlidb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idavsnkfdx.exe ups_run
    3⤵
    PID:4536
  - - C:\Temp\idavsnkfdx.exe
      C:\Temp\idavsnkfdx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3360
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1092
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_idavsnkfdx.exe ups_ins
    3⤵
    PID:4360
  - - C:\Temp\i_idavsnkfdx.exe
      C:\Temp\i_idavsnkfdx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvpnhfaxs.exe ups_run
    3⤵
    PID:3580
  - - C:\Temp\dxvpnhfaxs.exe
      C:\Temp\dxvpnhfaxs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1952
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4528
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1540
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ff9d083c188,0x7ff9d083c194,0x7ff9d083c1a0
      4⤵
      PID:2368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,14195823762350043934,1811089167696492401,262144 --field-trial-handle=2276,i,15579555254866768228,9333673142459015770,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
      4⤵
      PID:5920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,8616690058323091910,16893212939927950579,524288 --field-trial-handle=2276,i,15579555254866768228,9333673142459015770,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:11
      4⤵
      System Time Discovery
      PID:1448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2068,i,12722659039699348198,16186362592623243569,524288 --field-trial-handle=2276,i,15579555254866768228,9333673142459015770,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:13
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3640,i,8924982647370138358,935601115012282547,2097152 --field-trial-handle=2276,i,15579555254866768228,9333673142459015770,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
      4⤵
      PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3644,i,17172617668536557154,11268633865828536772,2097152 --field-trial-handle=2276,i,15579555254866768228,9333673142459015770,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
      4⤵
      PID:3560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,4637678979603020091,3259229522565859478,2097152 --field-trial-handle=2276,i,15579555254866768228,9333673142459015770,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:9
      4⤵
      PID:3260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4352,i,10567053896630529502,18061396446672172509,2097152 --field-trial-handle=2276,i,15579555254866768228,9333673142459015770,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
      4⤵
      PID:4948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,2591987816076456764,14539691069940623688,524288 --field-trial-handle=2276,i,15579555254866768228,9333673142459015770,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
      4⤵
      PID:1376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,12968821858990416688,8166987396855812468,524288 --field-trial-handle=2276,i,15579555254866768228,9333673142459015770,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
      4⤵
      PID:3488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,1538828098834290227,11185677347581833979,524288 --field-trial-handle=2276,i,15579555254866768228,9333673142459015770,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
      4⤵
      PID:4064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,6375778680220509508,17072303415137878384,524288 --field-trial-handle=2276,i,15579555254866768228,9333673142459015770,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
      4⤵
      PID:3496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,6375778680220509508,17072303415137878384,524288 --field-trial-handle=2276,i,15579555254866768228,9333673142459015770,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
      4⤵
      PID:844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,735572039722290068,16692921678569825908,524288 --field-trial-handle=2276,i,15579555254866768228,9333673142459015770,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:5148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,14325867813922576399,4463098194048521155,524288 --field-trial-handle=2276,i,15579555254866768228,9333673142459015770,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
      4⤵
      PID:5884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3852,i,15726377182929256058,13179089089406663766,524288 --field-trial-handle=2276,i,15579555254866768228,9333673142459015770,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,2924362652196313156,4774840598229708495,524288 --field-trial-handle=2276,i,15579555254866768228,9333673142459015770,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
      4⤵
      PID:5456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,618179107189471322,6501021144913268933,524288 --field-trial-handle=2276,i,15579555254866768228,9333673142459015770,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
      4⤵
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,6934826864204645889,9653740030764758475,524288 --field-trial-handle=2276,i,15579555254866768228,9333673142459015770,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
      4⤵
      PID:2672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,4703830131740778986,4397256623773534552,524288 --field-trial-handle=2276,i,15579555254866768228,9333673142459015770,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
      4⤵
      PID:892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,981507674715449427,5626548390736894396,524288 --field-trial-handle=2276,i,15579555254866768228,9333673142459015770,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:14
      4⤵
      PID:1716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,4037026883972566252,1520707388000689499,524288 --field-trial-handle=2276,i,15579555254866768228,9333673142459015770,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:14
      4⤵
      PID:2652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6568,i,1359506888984238427,1225841931197542203,262144 --field-trial-handle=2276,i,15579555254866768228,9333673142459015770,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:10
      4⤵
      PID:1384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,15644506781703920766,8021084255328712517,524288 --field-trial-handle=2276,i,15579555254866768228,9333673142459015770,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
      4⤵
      PID:1624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5624

C:\Temp\tnlfdyvqoigaysql.sys
C:\Temp\tnlfdyvqoigaysql.sys
1⤵
- Executes dropped EXE
PID:4380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1540

C:\Temp\ysqnifaysq.sys
C:\Temp\ysqnifaysq.sys
1⤵
- Executes dropped EXE
PID:2092

C:\Temp\kifaxspnkf.sys
C:\Temp\kifaxspnkf.sys
1⤵
- Executes dropped EXE
PID:2152

C:\Temp\vpnkfcxvpn.sys
C:\Temp\vpnkfcxvpn.sys
1⤵
- Executes dropped EXE
PID:3584

C:\Temp\mkhcauspmh.sys
C:\Temp\mkhcauspmh.sys
1⤵
- Executes dropped EXE
PID:1492

C:\Temp\zwromkecwu.sys
C:\Temp\zwromkecwu.sys
1⤵
- Executes dropped EXE
PID:2516

C:\Temp\bwtrmjebwt.sys
C:\Temp\bwtrmjebwt.sys
1⤵
- Executes dropped EXE
PID:4188

C:\Temp\ojgeywqomg.sys
C:\Temp\ojgeywqomg.sys
1⤵
- Executes dropped EXE
PID:3196

C:\Temp\qolgdbytrl.sys
C:\Temp\qolgdbytrl.sys
1⤵
- Executes dropped EXE
PID:3260

C:\Temp\dxvqnifdyv.sys
C:\Temp\dxvqnifdyv.sys
1⤵
- Executes dropped EXE
PID:3584

C:\Temp\pnlicavsnl.sys
C:\Temp\pnlicavsnl.sys
1⤵
- Executes dropped EXE
PID:6108

C:\Temp\sqkicaxsqk.sys
C:\Temp\sqkicaxsqk.sys
1⤵
PID:5500

C:\Temp\kiczxusmkh.sys
C:\Temp\kiczxusmkh.sys
1⤵
PID:1556

C:\Temp\hezxrpmhez.sys
C:\Temp\hezxrpmhez.sys
1⤵
PID:2264

C:\Temp\rljebzwuom.sys
C:\Temp\rljebzwuom.sys
1⤵
PID:4568

C:\Temp\zwuomjeywu.sys
C:\Temp\zwuomjeywu.sys
1⤵
PID:5320

C:\Temp\oigeytroig.sys
C:\Temp\oigeytroig.sys
1⤵
PID:2092

C:\Temp\jdavsqoiga.sys
C:\Temp\jdavsqoiga.sys
1⤵
PID:408

C:\Temp\lfdavtnlfd.sys
C:\Temp\lfdavtnlfd.sys
1⤵
PID:3628

C:\Temp\pnifaxsqki.sys
C:\Temp\pnifaxsqki.sys
1⤵
PID:4388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

i_khcwupmhfz.exe

Path C:\Temp\i_khcwupmhfz.exe
Size 361KB
SHA256 3959e6c7f030111a09599a6cf2eeb787f6fba362d0e0bf249e81911608db68c4
MD5 c251e67ecaddd04e3c7bc8cd1e698bce
SHA1 fbd5bddd110c808b6954b8763d795517765a5f0d
SHA512 1902466b9f9cb005615f27382a834f070bb28908ffe9edeb155204bc99f0156360fa0565cc4414e35ac5df346f9f72fdc406fbaf5681c8ddf261de6a21a9c68f
SSDEEP 6144:ZflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:ZflfAsiVGjSGecvX
TLSH
T17B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kifdxuspkh.exe

Path C:\Temp\i_kifdxuspkh.exe
Size 361KB
SHA256 8facdf6f3140a9c272b9393a4c9a8e8e49f4dc3f84c6ba6a6ca2e9853de77e3d
MD5 bd22a06cfb44b1ed7fd96b0e837bb8e7
SHA1 bdf0ed86e80849407172194cbdf89b13b957ada3
SHA512 849c652a475ff97e53a08f8ffe52001831dd3ff9bcc44a4dbe6de8e08785db2f5a06f71cd6a3e144e5bc33ffc53a76368b4a476ba78cc6530551a94c88917da2
SSDEEP 6144:oflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:oflfAsiVGjSGecvX
TLSH
T162747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkecxupnhf.exe

Path C:\Temp\i_mkecxupnhf.exe
Size 361KB
SHA256 95b2f0e7867151e2609ba1429b336ab0a5ccb644c014284267e7a70b1dedaf91
MD5 e5edb51112fbd48f5aae0210d3002e0e
SHA1 f8dd233110abd72ac9f7cf2687747074deb95162
SHA512 76ac126131f41654309956a90c3ac008224b7849cb54a57174f8090c72e0afb36a865b77b7de6c88decc2524fb716de3b1ecbbb670b5e67ac505894ec8a21d8e
SSDEEP 6144:eflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:eflfAsiVGjSGecvX
TLSH
T1C1747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_spnifaxsql.exe

Path C:\Temp\i_spnifaxsql.exe
Size 361KB
SHA256 abc7b02d0bfbe974a830aaa7b7cf75244683fb663c66cd08775d91105b767828
MD5 88330e0ce59e0ca22b6fa0c491d9822f
SHA1 d2e2520fc161578cc62f7ccfcb4541fa8b66be10
SHA512 a459cdfcaf7165388765e7d91432d5e4362d928f266d83ceb7a7141510e50976606ed0e51ad2df315f9ca0ffccf546b72b674f778b69c4a483caeb686e1464ff
SSDEEP 6144:SflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:SflfAsiVGjSGecvX
TLSH
T192747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqoigdywqo.exe

Path C:\Temp\i_sqoigdywqo.exe
Size 361KB
SHA256 6a359f0b17fc94f465e2120e4cc7d2320bac320157796eeac2111500b34d4ae6
MD5 cdac60803d715d9c6d614977693b3057
SHA1 4cb606999105ed8f3c7468b050458db3a8b8f353
SHA512 218dcec01dc80ae6be99d12675568e7115d3433e5fa3d50ac7e851929745c225bfe5da4a71083d3c547df487e08ae73a5e6671ea4f072757132d77f47859eeac
SSDEEP 6144:HflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:HflfAsiVGjSGecvX
TLSH
T11D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khcwupmhfz.exe

Path C:\Temp\khcwupmhfz.exe
Size 361KB
SHA256 d786717a8fbcf26041984971f1d5570c22cfab04d3707f463c13f67af2475aca
MD5 b2839245c225b3485cfd7eefb6aff2ae
SHA1 46e8029773a9533694c665d858ab5202669fa5fd
SHA512 31cfdf1e3a8518326cad48a26005d556e477609008778852a9f41591a99db824448afbe01fd93afc64343b8cc37232429f5a379ce64c83dd260915a71922246b
SSDEEP 6144:gflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:gflfAsiVGjSGecvX
TLSH
T136747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kifaxspnkf.sys

Path C:\Temp\kifaxspnkf.sys
Size 293KB
SHA256 1e82bc0c156fb6c92f61b94510c40a378d8619a6e90763c088332b58b584d5b3
MD5 8866f71a63f398ab0ba71b0807fe649d
SHA1 01b5be56089b7741465e6c8b2b7449dacfc9f1ba
SHA512 cf132198f2e54a4eaee0e9224963a6606a2091dbe0af9664e98ddd6644736a6dbf4f925b7e7b1a31cdc1efe076c48d9882fb3b3774e3147bd6ea024df63010de
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T162545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kifdxuspkh.exe

Path C:\Temp\kifdxuspkh.exe
Size 361KB
SHA256 8608d0cb00449a7ddbe4312c5fe61730911c38dae366dc762b88e4052e77c546
MD5 9cd65f649621b33ebde9b2a8f09dbbfa
SHA1 9b778a395f9faa8dbbea6ca6c1f54ff0b91fc35c
SHA512 97feb9e6f00ba481d074ceb07b453f47d3ad089bdfc1a3a1123967d865ec5ff2f5ef8e3d3dede1fec6fafe5f92ce2b60ff8fb063efae759b0d139217c6989a5a
SSDEEP 6144:mflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:mflfAsiVGjSGecvX
TLSH
T146747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecxupnhf.exe

Path C:\Temp\mkecxupnhf.exe
Size 361KB
SHA256 6a551d4c5e989be2f86b91119d711db07a322257bfc65d43874599b2450e8f79
MD5 634b2c7eba56b01c55dd2f12ad1cc528
SHA1 c3950ec24cc05e948581f92717e5f2f90908bae6
SHA512 2415e8e3191adc108b0c52d5ec4572dc93e24fab17f4a2b2635023902dcc6310ac0e9c2ee746d268ee8d09fae3b22407acde320c9f9df8592de0f561393a0b02
SSDEEP 6144:GflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:GflfAsiVGjSGecvX
TLSH
T1B2747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkhcauspmh.sys

Path C:\Temp\mkhcauspmh.sys
Size 293KB
SHA256 d2fb35cf165913e9570b6d1b7ce2ed2f6afb339d140ad3444d4644444f5f9af1
MD5 6de99cf4f4444f7b3199795daa7a4865
SHA1 0e775d0e795b7630486161690224baf6686a28cf
SHA512 e8a42cad117cdfea15fb6cc884afd66f32c6a37b272be56f61e1d3fe7d855698a89634815954e6ad2f40c11a9a60548f1b3a68a1ef4b7e37c8a5d23bdb8fbf26
SSDEEP 3072:4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:4IJjiJcbI03GBc3ucY5DCSj
TLSH
T181545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spnifaxsql.exe

Path C:\Temp\spnifaxsql.exe
Size 361KB
SHA256 8655f47c1c78bab666b56c015f95a27515892c0cb32d839e27e718d68752987f
MD5 ad6c65435090677ba95ef9fb454abe64
SHA1 8bb6b33460a3d017431a49e15c43a2de9e59d932
SHA512 1db77d6b54172fb8d6349a7cdfcad8765830805e7f767396b1c27391f0ebe93559353d8efec9fee0eb9dd657e94d00f71e99f6dee73f4158ba56af700b07da5a
SSDEEP 6144:8flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:8flfAsiVGjSGecvX
TLSH
T1CF747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqoigdywqo.exe

Path C:\Temp\sqoigdywqo.exe
Size 361KB
SHA256 a444943c5c69bbc4c3e4b32a36ead94dd4fcf3493e8ac48de931e18e648481de
MD5 e8ad5ef79a3476cb7ffa26b72a32c71c
SHA1 0952b412b069a9ad6fd2ce8688feb4b4c41c58a3
SHA512 610d818b88ccd319dd2c650ce3583b08944be030a46fd11d8ce1067f45ffcceb72b6109859ca1292e91ed59c14f026c26748e538dc58bba026d93ae2fecc0c70
SSDEEP 6144:OflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:OflfAsiVGjSGecvX
TLSH
T13E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdyvqoigaysql.exe

Path C:\Temp\tnlfdyvqoigaysql.exe
Size 361KB
SHA256 a6a9eb63e18a671a74c793401287b61d4dbf5405271c861e667de1e9fdfc0b76
MD5 9a834ad8877a9d978e6910309d16cacb
SHA1 2901cb49cadc8842ae9c42eac6a1f548bf0158ea
SHA512 cfb392815e735ec0164bd9c0f96d6c43ed4872cd1f6389c3c2d69e6773611cf02632e7552fea1c4eb7ad8a77eb4dbf4a17ce8386db465f22a0c8c074370ef82d
SSDEEP 6144:bflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:bflfAsiVGjSGecvX
TLSH
T109747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdyvqoigaysql.sys

Path C:\Temp\tnlfdyvqoigaysql.sys
Size 293KB
SHA256 48710d569f6363133c2a5b198900f34c5877221da910ba415ae8476ce45bd0ee
MD5 a2d50e2d56c13859ce94968e83d6917d
SHA1 16ccc36c15555f598c6eb7e17d184d986457e209
SHA512 a4ee9219612d7aed1bf09da1b129af4af46f4a530b3be6434493b606b8bb73068eea85c136813d647f389179d7dd5cbd4bbc1b691c6ac1bf8e1ae2b1ce50f975
SSDEEP 3072:ktKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:kIJjiJcbI03GBc3ucY5DCSj
TLSH
T15D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnkfcxvpn.sys

Path C:\Temp\vpnkfcxvpn.sys
Size 293KB
SHA256 db57be1f7d6adcccbb5bb127077cfa08fba8ec81b8a27b21373c87a6d3fe8242
MD5 16d41ee9349e85f540e568cbfa50993f
SHA1 2a2c289c3ef54f1f91ffd79532df7afd15df12ba
SHA512 d1365e260debc52725eff60f64182fa23171ec72e25221c0619f4bd58538dd0c83b7974d89aabd79b98096a3fa195d8b372ac5814b4aec77e9fdd0fefb2415dc
SSDEEP 3072:8tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:8IJjiJcbI03GBc3ucY5DCSj
TLSH
T188545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrpjhbztrm.exe

Path C:\Temp\wrpjhbztrm.exe
Size 361KB
SHA256 45ed3f3a137e4d1169cfa2b95c3ee79a27b808f4798b9ea7d9be2f96c221a6ef
MD5 cba6188346866459728e0e96773faae0
SHA1 71d49b8cab0f3c858982a42c913825a5837919ec
SHA512 c6e72814298630ef8cd469cc702941b34fe44882ccf48137ff75d4f9113447aabb29e9ad71289a9172956c37234b1369ff1a060b8c2635d5c9619a36f21188ed
SSDEEP 6144:mflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:mflfAsiVGjSGecvX
TLSH
T1E4747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqnifaysq.sys

Path C:\Temp\ysqnifaysq.sys
Size 293KB
SHA256 8e158b2e5591e76ba83217f90db4a42e0e4ce72c69b546d26276d2e22916bfee
MD5 aff0a718122aab3737e3ccc77b261ad7
SHA1 3709de4a18ab24a2203fb19bbf099e9aef407f98
SHA512 7008f903eb445a18a9b043109136fd875d032027e8a36af9136d4a68c21431de9de4ea4975bbbed4ed9fadae012f85246eb7847380759f55a4381f4e1014bc8c
SSDEEP 3072:ptKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:pIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwromkecwu.sys

Path C:\Temp\zwromkecwu.sys
Size 293KB
SHA256 10f28c43785aa5b18b4bca8726fe0cb13c5826ef1fd794cce64b57d46b14b9cd
MD5 21dce142888699261319132a75f6f723
SHA1 0c45366db3b19b5c98f8d18ae5575056dd58c003
SHA512 250782574988e21a9b9cc0f4d04d987bd13913f1510af685cffb321743417d896cd04e3f5a564364674d3f1d1f9ed6c9b25fb89c75992d333e9732e480f13ac1
SSDEEP 3072:LtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:LIJjiJcbI03GBc3ucY5DCSj
TLSH
T183545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 1bfdf7fadd69d092f499188fc2ac5541e50e0be6920d595f0570c947c5311a77
MD5 da2a71083e50166ec2ebeaa4975202b2
SHA1 edd5888de3ccc0870012e48bbedef9e4d00aa988
SHA512 e092ec6b645cf0592672bcb29d5f32d9dd60681ab6cc1827e92ed2257bcedf242963f1fc9522897b2c1d37beb8e1854d6893bfa76176b014946273b20a8f52cd
TLSH
T16E3152A44B2B0EE1D3DA45F5A0D9ED9D33F7A4E8054B7E72864862B4AC0D3115BD9E10
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e882.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59e882.TMP
Size 1KB
SHA256 d2b664520b19ce7710a1a8a6fbd8de28900d11a7c22a31900ab6840bcd506568
MD5 d5706491ab0767e53b51df4d29b083bf
SHA1 8cfb644f7e23dc4c34ce32e70a5e27578232a948
SHA512 83ac9bd8812a0f37e0e579e6976cf4a57c786ab921a1a8523ae5074db7c5a290ffec13c374d98d056e220ebfce08d9507637a42392bd27be4223e9461d6408e1
TLSH
T1B23152A44B2B0EE1D3DA45F1A0D9ED9D33F7A4E8054B7F72864862B4AC0D3125BD9E10
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2fdc0828b767c93c79fe94e206dab0713f1a77ed9e4341f9495e31a9df12a1a6
MD5 37996ae61bb4cddefa283ce4729a50be
SHA1 cb2d2a821d068cee736079dadb90d8dc666a160a
SHA512 fd613eb8175a2bcc6f7dae491b1118bc47ca097bc5175409c0098e22af04959047806a05bce91e5910f53c61f7890933235f803aea1ccded67157aa4b9425edb
TLSH
T13F51C0F3C6E8862DC90156F0AB187E2BDE2D0954832C3D5AC8E4EF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d7cfdf4fd334ff8f0067791310b5cf2141842e8dee65a75d437a4a875056b335
MD5 00873a356466ef4713adc4a12f8e6301
SHA1 652c09cf3e70ddbd8f323f0485914caa08175e64
SHA512 7a4d97fb169c39756622ec51a979e6b4ec4c180ebce48b718328f79fd28970275267de09d39fe1094637ae5e31c799682ee3a24de1f94817288ccd66d7247977
SSDEEP 192:sxR9kRyCr/fTsay1ZZW4LzoA8p9F/g6+WNCI//YZFLy9GRhRIgV+J:sxR9kTr/fTsay704q7/5J/SVo
TLSH
T1C242C81A6D28993B4CC7D21DBA55BF53E2F96032A1951E48A6FCDB0C04EB6CD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 be790956bbb85a38f472012c9b43d71372b32d43d09d588032ebe28e575576bc
MD5 18fcde034eb4219f11394cb19aa9b80d
SHA1 64338b1b3453c4cf3ef7dd26e854f3c97c5dfe31
SHA512 24e4b9c73c4b6058766238834337ccdacc5045d1929528fe2ff93d233391295631a4743ca5b9b8b660ffd4abec063fb4381c9a38e444201520273d2cdf7a400d
SSDEEP 192:sxR9rRyCr/fTs8y1ZZW4LzoA8p9F/g6+WNCI//YZFLy9GRhRIgDP+J:sxR9rTr/fTs8y704q7/5J/SVe
TLSH
T10242C91A6D28993B4CCBD21DBB55BF53E2F95032A1951E48A6FCDB0C04EB6CD221741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a91d1389bbc772c1d4b5bcbe086987aeb3cc2ec362c2ef6688af1cd6390624f8
MD5 cef109156ff5e34085d73272182cd894
SHA1 c95f3c98e2dad2c19bb37315b0ac2270352905fa
SHA512 f83e8a3cee7f2d40eec347874c6eb6025d72a8d52db091e6b6cdaf7d3b53ac16782d5bb7b7fd180d8c89f6e178601e1616f2a592470589eb532ddd576b5f0592
SSDEEP 192:sxR9rRyCr/fTs8o1ZZW4LzoA8p9F/g6+WNCI//YZFLM9GRhRIgDd+J:sxR9rTr/fTs8o704q7/5J/Szc
TLSH
T18D42D91A6D28993B4CC7E21DBA55BF53E2F95032A1951E48A7FCDB0C00EB6CD221741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 0b8b964274990f954a961713480e1cc18d1f472f4be227c07455abfe38d4b1b6
MD5 51c3243544583ab42cec9d3f6fca57e8
SHA1 79c09d33dd75d82170e9409ea2d973fc98744b50
SHA512 a666415002b344f77f9a3d079ed4f520980f075aa21483ebc8cb35cee54d621b8485c40d88758929c23896225881fb86464f4b182165960b9d0ef1c4608c1522
SSDEEP 768:K80Ea67pLuL7FwWgNhfVN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMeowLW4roL3T2:K80EaSE7FwWgNhfVNu1jaHeogWDL3T2
TLSH
T140D2D97B740DCB7E4F804ADDAC197E9B7DA802CB96D8C94047FE851C02C6BEA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 93687f73176733880786fc2db40c20e0aaab42f4385bea0a9d63fb6119ed6e5c
MD5 fa9e1e73861a9cd6a5ede9a6d7763689
SHA1 cfd8004de0d64d05425fa3a8430edc5cc4532765
SHA512 7c5e830872c5970b4f86f0ae88d9f2f12c696ae1410a2da844bd3b077e1f2e9d452e1a3c4ce6ca87dad775a19eba614245926c7d643eb26ee8c974477395f6d7
SSDEEP 96:KR3gFB31lpWRekgJpK4ggHpcvHG5F8HtaTHd3LfWTI2gPfK4Ogxfc1NAjgm8KLaA:C3gFB31lERe1JDggH2vHG5F8HtaTHd3t
TLSH
T17E912814327F0280383E655D9479D55B82C3B1623119B83F7BA842A74F67E138DFEAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a859c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a859c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0043071707dedfe8098e94c67ba9b11de24ac0f970ecaa44dd41b6a902a2cecb
MD5 ea9e826fdb66224a59cda6714b582b2a
SHA1 c813c44a8b9221cd061b935db52518c693cea9a1
SHA512 e5b26e279dac268c78ffbfa413d5b7950a3b27f973dcd674c9f5bebf5ba1762e3108ee038e74877c375b77ab91f64891c5f50cf66b1144c0c773ba63853cbef0
SSDEEP 768:grv+4UNbdH3VL+LeSFOUAReX4fouOToPvB2thtA9VAwWeVH1SlX:gbsbh3QsnnwthttzEH1Y
TLSH
T16803CF32A8A88933DDE6D388320B72572FF4915396900FC49EDD1B4D069B9DE070BD6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b8609acfe2bc3c4ac5dde361fe9c322bce7ae6d7da5365bc974e7ed6254f8595
MD5 1734edeba989799305b2cd162ff54742
SHA1 3e2933770232791701ef421edfdb93bc04e471d9
SHA512 8da4bfcb6d2a77c7229a55ca4e58d062c18b15a0ed69bec8d8560786d70390852182ce973eb1f41c16a2c88aa106d6c41f7ad012a4f60518eef79291e5efc688
SSDEEP 768:D83OR+LeSFOUAdX4fouOToPvB2thtA9VAgcb9MB:D83csnnwthttdb+B
TLSH
T108F2D071B8AD8D73DDDAD3A4710A36966FF0607395D40FC8AAEDD70D0543A9D0B0B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 fdd4cc22776944b7bad9d955a8003f8d36e78b281d00e4379b2804d3382f0763
MD5 88ece12c7a425d939305eee4a72c84af
SHA1 8b81ae05a2e88585bb695e4e06a6ef4b36c398a5
SHA512 2da9652a70bbff511f42a3d9ed2d19483a56fb9319d8abc6fd3e102a85430bfe26853a10a380d99ad1d0685303856e21466b9a02b8671c2f6f077fe3e7e19c8c
SSDEEP 768:283LR+LeSFOUAdX4fouOToPvB2thtA9VAgcb9MB:2833snnwthttdb+B
TLSH
T1B0F2D071B8AD8C73DDDAD3A4710A36966FF0607395D41FC8AAEDDB0D0543A9D0B0B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 376119755c207ee9a23b386066a7e4bd39c53df923ea94fa7d3b42597baa0cb2
MD5 081bff733cc65eee92ea9c498e233d77
SHA1 292061e8ba0edc859112e24e5933b1d2a403d8ff
SHA512 a7d60811b5891a19332d14a32d1737bbe2308d5f72d88d50b92384115275417082b28c6c9e72707295c3a541583af75c914ecc21de2e9260b4d2a768e6e9a788
SSDEEP 768:FFQ13UwgEUE1OUAJX4fouOToPvB2thtA9VAgcb9MB:k138snnwthttdb+B
TLSH
T16F1327F198D78937E89E8397633D2D469EFCD063B5984A84BB985A0CCC425BFC70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

fb02953b-a60f-4907-8af6-aa444bb0badc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fb02953b-a60f-4907-8af6-aa444bb0badc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6136_826444698\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 43907a7faf217f1f694f469f6d7bd3d61f0e68c2c576fd4ff61a16dff8b2b91e
MD5 dcc8570a19fcc5af8e8306236894de2a
SHA1 0284f97f1ae88af47cf431d8d09fcf24e32ac40a
SHA512 8a27e3c7f62a3a9d200b8500b5fa88b9d84bc9fe6f473c76bb7a462bad4b3101a80d32eee62b15f9b6f1ed890356234d5f894a2fcf529369dd905fabf939f85b
TLSH
T1BD71238356ADDAB3C1DE5BF102835244F2FB22384B63302007A55586AB30A7A58B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/408-468-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1492-278-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1556-407-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2092-191-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2092-447-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2152-238-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2264-411-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2516-290-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3196-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3260-359-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3584-367-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3584-266-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3628-472-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4188-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4380-65-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4388-489-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4568-431-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5320-442-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5500-387-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6108-366-0x0000000000010000-0x00000000000AB000-memory.dmp

Download