systex | 20ad39258f69ff81363695d0f646f6de8332261853992d6f2a4c05173e209d2f

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260815-2c3s6avbqa
SHA256 20ad39258f69ff81363695d0f646f6de8332261853992d6f2a4c05173e209d2f
MD5 9e36307d627196d60bbd066bb3941150
SHA1 84d40ffa10197b9183988b230003cd69c9ca195a
SHA512 3c2babf6f668fa3194670eeebe81aeab6cfae9bfa84bd11d104da334a651af40db02ea99fa3cafa7b519cc7c7e6f844a551158bb9d7493f1d8a6c9a684249a0e
SSDEEP 6144:5flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:5flfAsiVGjSGecvX
TLSH
T186747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3924	hbztrmjebztrpjhe.exe
4472	hbztrmjebztrpjhe.sys
2376	CreateProcess.exe
5604	jgecwupjew.exe
5388	CreateProcess.exe
4608	CreateProcess.exe
2280	i_jgecwupjew.exe
4520	ytromgezwu.sys
1616	CreateProcess.exe
3836	qoljdbztro.exe
4528	CreateProcess.exe
720	CreateProcess.exe
2044	i_qoljdbztro.exe
4336	jgebwtojgb.sys
1372	CreateProcess.exe
3060	gebvtrojgb.exe
836	CreateProcess.exe
3204	CreateProcess.exe
5096	i_gebvtrojgb.exe
1692	aywqolfdby.sys
4212	CreateProcess.exe
5568	dyvtnlgdyw.exe
2888	CreateProcess.exe
1908	CreateProcess.exe
760	i_dyvtnlgdyw.exe
3668	nigaysqkid.sys
1336	CreateProcess.exe
3100	faysqlfdxv.exe
5972	CreateProcess.exe
3148	CreateProcess.exe
5648	i_faysqlfdxv.exe
4156	aysqnifdav.sys
3700	CreateProcess.exe
4596	sqnifzxsqk.exe
4164	CreateProcess.exe
1216	CreateProcess.exe
3248	i_sqnifzxsqk.exe
1168	axspkicaup.sys
1332	CreateProcess.exe
3420	xspkicaxsq.exe
3400	CreateProcess.exe
1548	CreateProcess.exe
5812	i_xspkicaxsq.exe
4840	upmhfzxusm.sys
3940	CreateProcess.exe
2564	pnhfzxrpjh.exe
5672	CreateProcess.exe
2940	CreateProcess.exe
2088	i_pnhfzxrpjh.exe
1328	ezwuojhezw.sys
4772	CreateProcess.exe
4928	xrpjhbztrm.exe
3024	CreateProcess.exe
1036	CreateProcess.exe
2012	i_xrpjhbztrm.exe
2816	rmjhbztrpj.sys
3096	CreateProcess.exe
4232	gebwtrmjdb.exe
4820	CreateProcess.exe
2920	CreateProcess.exe
2532	i_gebwtrmjdb.exe
4704	ojgbztrljd.sys
4472	CreateProcess.exe
1744	jhbztrljeb.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5964_743099603\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5964_473912976\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5964_1897743680\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5964_1897743680\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5964_1175115981\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5964_1175115981\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5964_473912976\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5964_1175115981\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5964_1175115981\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoljdbztro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsqkifdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrmgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gebwtrmjdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxvsqkifv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khcauspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgecwupjew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czuojhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomjhbzwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faysqlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qojdbvtrlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsqkifdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khcauspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czuojhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrmgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrmjebztrpjhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoljdbztro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvtnlgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqnifzxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqnifzxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxvsqkifv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomjhbzwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgecwupjew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faysqlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkicaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gebwtrmjdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysnlfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysnlfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gebvtrojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gebvtrojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvtnlgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkicaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qojdbvtrlg.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4236	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
704	ipconfig.exe
5532	ipconfig.exe
4840	ipconfig.exe
1476	ipconfig.exe
4796	ipconfig.exe
5892	ipconfig.exe
3356	ipconfig.exe
1116	ipconfig.exe
2808	ipconfig.exe
1200	ipconfig.exe
4704	ipconfig.exe
3248	ipconfig.exe
1880	ipconfig.exe
4648	ipconfig.exe
4156	ipconfig.exe
1640	ipconfig.exe
5436	ipconfig.exe
3196	ipconfig.exe
2884	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313064358810936"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{CBCCDAFA-0F13-4DA6-9C7C-86EA9A3E23D3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3924	hbztrmjebztrpjhe.exe
3924	hbztrmjebztrpjhe.exe
3924	hbztrmjebztrpjhe.exe
3924	hbztrmjebztrpjhe.exe
3924	hbztrmjebztrpjhe.exe
3924	hbztrmjebztrpjhe.exe
3924	hbztrmjebztrpjhe.exe
3924	hbztrmjebztrpjhe.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2280	i_jgecwupjew.exe
Token: SeDebugPrivilege	2044	i_qoljdbztro.exe
Token: SeDebugPrivilege	5096	i_gebvtrojgb.exe
Token: SeDebugPrivilege	760	i_dyvtnlgdyw.exe
Token: SeDebugPrivilege	5648	i_faysqlfdxv.exe
Token: SeDebugPrivilege	3248	i_sqnifzxsqk.exe
Token: SeDebugPrivilege	5812	i_xspkicaxsq.exe
Token: SeDebugPrivilege	2088	i_pnhfzxrpjh.exe
Token: SeDebugPrivilege	2012	i_xrpjhbztrm.exe
Token: SeDebugPrivilege	2532	i_gebwtrmjdb.exe
Token: SeDebugPrivilege	1572	i_jhbztrljeb.exe
Token: SeDebugPrivilege	5692	i_qojdbvtrlg.exe
Token: SeDebugPrivilege	6088	i_avsqkifdyv.exe
Token: SeDebugPrivilege	2808	i_aysnlfdxvp.exe
Token: SeDebugPrivilege	4840	i_fzxvsqkifv.exe
Token: SeDebugPrivilege	4124	i_khcauspkhc.exe
Token: SeDebugPrivilege	5620	i_czuojhbzur.exe
Token: SeDebugPrivilege	5668	i_wuomjhbzwu.exe
Token: SeDebugPrivilege	5020	i_jhbztrmgey.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5964	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 3924	992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 992 wrote to memory of 3028	992	2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 3028 wrote to memory of 5964	3028	iexplore.exe	91
PID 5964 wrote to memory of 2824	5964	msedge.exe	92
PID 5964 wrote to memory of 4556	5964	msedge.exe	94
PID 5964 wrote to memory of 4236	5964	msedge.exe	95
PID 5964 wrote to memory of 4556	5964	msedge.exe	94
PID 5964 wrote to memory of 4556	5964	msedge.exe	94
PID 5964 wrote to memory of 2952	5964	msedge.exe	96
PID 5964 wrote to memory of 2952	5964	msedge.exe	96
PID 5964 wrote to memory of 5756	5964	msedge.exe	98
PID 5964 wrote to memory of 2816	5964	msedge.exe	97
PID 5964 wrote to memory of 5756	5964	msedge.exe	98
PID 5964 wrote to memory of 5756	5964	msedge.exe	98
PID 5964 wrote to memory of 2816	5964	msedge.exe	97
PID 5964 wrote to memory of 2816	5964	msedge.exe	97
PID 5964 wrote to memory of 3272	5964	msedge.exe	99
PID 5964 wrote to memory of 3272	5964	msedge.exe	99
PID 5964 wrote to memory of 3272	5964	msedge.exe	99
PID 5964 wrote to memory of 3000	5964	msedge.exe	100
PID 5964 wrote to memory of 3000	5964	msedge.exe	100
PID 5964 wrote to memory of 3000	5964	msedge.exe	100
PID 5964 wrote to memory of 1908	5964	msedge.exe	102
PID 5964 wrote to memory of 1908	5964	msedge.exe	102
PID 5964 wrote to memory of 2828	5964	msedge.exe	105
PID 5964 wrote to memory of 4672	5964	msedge.exe	106
PID 5964 wrote to memory of 2828	5964	msedge.exe	105
PID 5964 wrote to memory of 4672	5964	msedge.exe	106
PID 5964 wrote to memory of 4128	5964	msedge.exe	108
PID 3924 wrote to memory of 2376	3924	hbztrmjebztrpjhe.exe	109
PID 5964 wrote to memory of 5968	5964	msedge.exe	111
PID 5964 wrote to memory of 5968	5964	msedge.exe	111
PID 5604 wrote to memory of 5388	5604	jgecwupjew.exe	114
PID 5964 wrote to memory of 5840	5964	msedge.exe	118
PID 5964 wrote to memory of 5840	5964	msedge.exe	118
PID 3924 wrote to memory of 4608	3924	hbztrmjebztrpjhe.exe	119
PID 3924 wrote to memory of 1616	3924	hbztrmjebztrpjhe.exe	123
PID 3836 wrote to memory of 4528	3836	qoljdbztro.exe	125
PID 3924 wrote to memory of 720	3924	hbztrmjebztrpjhe.exe	128
PID 3924 wrote to memory of 1372	3924	hbztrmjebztrpjhe.exe	132
PID 3060 wrote to memory of 836	3060	gebvtrojgb.exe	134
PID 3924 wrote to memory of 3204	3924	hbztrmjebztrpjhe.exe	137
PID 3924 wrote to memory of 4212	3924	hbztrmjebztrpjhe.exe	142
PID 5568 wrote to memory of 2888	5568	dyvtnlgdyw.exe	144
PID 3924 wrote to memory of 1908	3924	hbztrmjebztrpjhe.exe	147
PID 5964 wrote to memory of 5436	5964	msedge.exe	149
PID 5964 wrote to memory of 2976	5964	msedge.exe	150
PID 5964 wrote to memory of 5624	5964	msedge.exe	151
PID 3924 wrote to memory of 1336	3924	hbztrmjebztrpjhe.exe	154
PID 3100 wrote to memory of 5972	3100	faysqlfdxv.exe	156
PID 3924 wrote to memory of 3148	3924	hbztrmjebztrpjhe.exe	159
PID 3924 wrote to memory of 3700	3924	hbztrmjebztrpjhe.exe	163
PID 4596 wrote to memory of 4164	4596	sqnifzxsqk.exe	165
PID 3924 wrote to memory of 1216	3924	hbztrmjebztrpjhe.exe	168
PID 3924 wrote to memory of 1332	3924	hbztrmjebztrpjhe.exe	172
PID 3420 wrote to memory of 3400	3420	xspkicaxsq.exe	174
PID 3924 wrote to memory of 1548	3924	hbztrmjebztrpjhe.exe	177
PID 3924 wrote to memory of 3940	3924	hbztrmjebztrpjhe.exe	181
PID 2564 wrote to memory of 5672	2564	pnhfzxrpjh.exe	183
PID 3924 wrote to memory of 2940	3924	hbztrmjebztrpjhe.exe	186
PID 5964 wrote to memory of 3668	5964	msedge.exe	188
PID 5964 wrote to memory of 3668	5964	msedge.exe	188
PID 3924 wrote to memory of 4772	3924	hbztrmjebztrpjhe.exe	194
PID 4928 wrote to memory of 3024	4928	xrpjhbztrm.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_9e36307d627196d60bbd066bb3941150_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:992
- C:\Temp\hbztrmjebztrpjhe.exe
  C:\Temp\hbztrmjebztrpjhe.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgecwupjew.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2376
  - - C:\Temp\jgecwupjew.exe
      C:\Temp\jgecwupjew.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5604
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5388
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgecwupjew.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4608
  - - C:\Temp\i_jgecwupjew.exe
      C:\Temp\i_jgecwupjew.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoljdbztro.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1616
  - - C:\Temp\qoljdbztro.exe
      C:\Temp\qoljdbztro.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3836
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4528
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoljdbztro.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:720
  - - C:\Temp\i_qoljdbztro.exe
      C:\Temp\i_qoljdbztro.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gebvtrojgb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1372
  - - C:\Temp\gebvtrojgb.exe
      C:\Temp\gebvtrojgb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3060
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:836
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gebvtrojgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3204
  - - C:\Temp\i_gebvtrojgb.exe
      C:\Temp\i_gebvtrojgb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dyvtnlgdyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4212
  - - C:\Temp\dyvtnlgdyw.exe
      C:\Temp\dyvtnlgdyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dyvtnlgdyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1908
  - - C:\Temp\i_dyvtnlgdyw.exe
      C:\Temp\i_dyvtnlgdyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faysqlfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1336
  - - C:\Temp\faysqlfdxv.exe
      C:\Temp\faysqlfdxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3100
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5972
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faysqlfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3148
  - - C:\Temp\i_faysqlfdxv.exe
      C:\Temp\i_faysqlfdxv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqnifzxsqk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3700
  - - C:\Temp\sqnifzxsqk.exe
      C:\Temp\sqnifzxsqk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4596
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4164
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqnifzxsqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1216
  - - C:\Temp\i_sqnifzxsqk.exe
      C:\Temp\i_sqnifzxsqk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xspkicaxsq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1332
  - - C:\Temp\xspkicaxsq.exe
      C:\Temp\xspkicaxsq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3400
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xspkicaxsq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1548
  - - C:\Temp\i_xspkicaxsq.exe
      C:\Temp\i_xspkicaxsq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfzxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3940
  - - C:\Temp\pnhfzxrpjh.exe
      C:\Temp\pnhfzxrpjh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2564
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5672
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfzxrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2940
  - - C:\Temp\i_pnhfzxrpjh.exe
      C:\Temp\i_pnhfzxrpjh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpjhbztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4772
  - - C:\Temp\xrpjhbztrm.exe
      C:\Temp\xrpjhbztrm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4928
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3024
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpjhbztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1036
  - - C:\Temp\i_xrpjhbztrm.exe
      C:\Temp\i_xrpjhbztrm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2012
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gebwtrmjdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3096
  - - C:\Temp\gebwtrmjdb.exe
      C:\Temp\gebwtrmjdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4232
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4820
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gebwtrmjdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2920
  - - C:\Temp\i_gebwtrmjdb.exe
      C:\Temp\i_gebwtrmjdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbztrljeb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4472
  - - C:\Temp\jhbztrljeb.exe
      C:\Temp\jhbztrljeb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1744
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4260
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbztrljeb.exe ups_ins
    3⤵
    PID:3760
  - - C:\Temp\i_jhbztrljeb.exe
      C:\Temp\i_jhbztrljeb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qojdbvtrlg.exe ups_run
    3⤵
    PID:3484
  - - C:\Temp\qojdbvtrlg.exe
      C:\Temp\qojdbvtrlg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5096
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2036
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qojdbvtrlg.exe ups_ins
    3⤵
    PID:2804
  - - C:\Temp\i_qojdbvtrlg.exe
      C:\Temp\i_qojdbvtrlg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\avsqkifdyv.exe ups_run
    3⤵
    PID:5124
  - - C:\Temp\avsqkifdyv.exe
      C:\Temp\avsqkifdyv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4704
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3104
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_avsqkifdyv.exe ups_ins
    3⤵
    PID:240
  - - C:\Temp\i_avsqkifdyv.exe
      C:\Temp\i_avsqkifdyv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysnlfdxvp.exe ups_run
    3⤵
    PID:4460
  - - C:\Temp\aysnlfdxvp.exe
      C:\Temp\aysnlfdxvp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1820
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2152
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysnlfdxvp.exe ups_ins
    3⤵
    PID:3020
  - - C:\Temp\i_aysnlfdxvp.exe
      C:\Temp\i_aysnlfdxvp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxvsqkifv.exe ups_run
    3⤵
    PID:5164
  - - C:\Temp\fzxvsqkifv.exe
      C:\Temp\fzxvsqkifv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6064
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxvsqkifv.exe ups_ins
    3⤵
    PID:700
  - - C:\Temp\i_fzxvsqkifv.exe
      C:\Temp\i_fzxvsqkifv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khcauspkhc.exe ups_run
    3⤵
    PID:252
  - - C:\Temp\khcauspkhc.exe
      C:\Temp\khcauspkhc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4944
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:832
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khcauspkhc.exe ups_ins
    3⤵
    PID:4272
  - - C:\Temp\i_khcauspkhc.exe
      C:\Temp\i_khcauspkhc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czuojhbzur.exe ups_run
    3⤵
    PID:1120
  - - C:\Temp\czuojhbzur.exe
      C:\Temp\czuojhbzur.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2024
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czuojhbzur.exe ups_ins
    3⤵
    PID:5748
  - - C:\Temp\i_czuojhbzur.exe
      C:\Temp\i_czuojhbzur.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomjhbzwu.exe ups_run
    3⤵
    PID:1692
  - - C:\Temp\wuomjhbzwu.exe
      C:\Temp\wuomjhbzwu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5752
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3332
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomjhbzwu.exe ups_ins
    3⤵
    PID:200
  - - C:\Temp\i_wuomjhbzwu.exe
      C:\Temp\i_wuomjhbzwu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbztrmgey.exe ups_run
    3⤵
    PID:704
  - - C:\Temp\jhbztrmgey.exe
      C:\Temp\jhbztrmgey.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2448
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4316
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbztrmgey.exe ups_ins
    3⤵
    PID:4376
  - - C:\Temp\i_jhbztrmgey.exe
      C:\Temp\i_jhbztrmgey.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5020
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffec25dc188,0x7ffec25dc194,0x7ffec25dc1a0
      4⤵
      PID:2824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1976,i,17916628222150657446,6719193488369963327,262144 --field-trial-handle=2532,i,12059541551696855909,5976738511155395793,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:2
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,2420983619316103913,8703524832938722613,524288 --field-trial-handle=2532,i,12059541551696855909,5976738511155395793,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:11
      4⤵
      System Time Discovery
      PID:4236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2664,i,11792100792291283320,1940968173689620853,524288 --field-trial-handle=2532,i,12059541551696855909,5976738511155395793,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:13
      4⤵
      PID:2952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,13201496538973204898,5219958391782332224,2097152 --field-trial-handle=2532,i,12059541551696855909,5976738511155395793,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:2816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,18373283256188036436,4960006171583412312,2097152 --field-trial-handle=2532,i,12059541551696855909,5976738511155395793,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:5756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,1055322995129772106,7974571062251933182,2097152 --field-trial-handle=2532,i,12059541551696855909,5976738511155395793,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
      4⤵
      PID:3272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,8902662955697556829,11258912837692238918,2097152 --field-trial-handle=2532,i,12059541551696855909,5976738511155395793,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:9
      4⤵
      PID:3000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,5413883807206839846,10132251900246375455,524288 --field-trial-handle=2532,i,12059541551696855909,5976738511155395793,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14
      4⤵
      PID:1908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,9599918379742975979,6571556684183790654,524288 --field-trial-handle=2532,i,12059541551696855909,5976738511155395793,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
      4⤵
      PID:2828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,2022697556857491635,18225918903388931687,524288 --field-trial-handle=2532,i,12059541551696855909,5976738511155395793,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
      4⤵
      PID:4672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,7325008331257667115,4409505269375934783,524288 --field-trial-handle=2532,i,12059541551696855909,5976738511155395793,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
      4⤵
      PID:2792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,7325008331257667115,4409505269375934783,524288 --field-trial-handle=2532,i,12059541551696855909,5976738511155395793,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
      4⤵
      PID:4128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,5587027869113896083,10011909862296153549,524288 --field-trial-handle=2532,i,12059541551696855909,5976738511155395793,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
      4⤵
      PID:5968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,11334922925333468179,1898993495491983604,524288 --field-trial-handle=2532,i,12059541551696855909,5976738511155395793,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
      4⤵
      PID:5840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,1175963414607742350,8680371956534022960,524288 --field-trial-handle=2532,i,12059541551696855909,5976738511155395793,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
      4⤵
      PID:5436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,5578120059048296783,16522519589441676462,524288 --field-trial-handle=2532,i,12059541551696855909,5976738511155395793,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
      4⤵
      PID:2976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,18114913662844909569,5767687581655600860,524288 --field-trial-handle=2532,i,12059541551696855909,5976738511155395793,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
      4⤵
      PID:5624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,8663650012330289914,8911128800479094314,524288 --field-trial-handle=2532,i,12059541551696855909,5976738511155395793,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
      4⤵
      PID:3668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,372661265052371392,6856335582039636586,524288 --field-trial-handle=2532,i,12059541551696855909,5976738511155395793,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
      4⤵
      PID:200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,15579014495768458389,6243278805340722537,524288 --field-trial-handle=2532,i,12059541551696855909,5976738511155395793,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
      4⤵
      PID:4372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,13243260865217202227,3352124465549270053,524288 --field-trial-handle=2532,i,12059541551696855909,5976738511155395793,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
      4⤵
      PID:5552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6668,i,18072388102181136573,4399923636901699510,262144 --field-trial-handle=2532,i,12059541551696855909,5976738511155395793,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:10
      4⤵
      PID:5320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,7021835046848452900,7797779920586889778,524288 --field-trial-handle=2532,i,12059541551696855909,5976738511155395793,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
      4⤵
      PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5704

C:\Temp\hbztrmjebztrpjhe.sys
C:\Temp\hbztrmjebztrpjhe.sys
1⤵
- Executes dropped EXE
PID:4472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3436

C:\Temp\ytromgezwu.sys
C:\Temp\ytromgezwu.sys
1⤵
- Executes dropped EXE
PID:4520

C:\Temp\jgebwtojgb.sys
C:\Temp\jgebwtojgb.sys
1⤵
- Executes dropped EXE
PID:4336

C:\Temp\aywqolfdby.sys
C:\Temp\aywqolfdby.sys
1⤵
- Executes dropped EXE
PID:1692

C:\Temp\nigaysqkid.sys
C:\Temp\nigaysqkid.sys
1⤵
- Executes dropped EXE
PID:3668

C:\Temp\aysqnifdav.sys
C:\Temp\aysqnifdav.sys
1⤵
- Executes dropped EXE
PID:4156

C:\Temp\axspkicaup.sys
C:\Temp\axspkicaup.sys
1⤵
- Executes dropped EXE
PID:1168

C:\Temp\upmhfzxusm.sys
C:\Temp\upmhfzxusm.sys
1⤵
- Executes dropped EXE
PID:4840

C:\Temp\ezwuojhezw.sys
C:\Temp\ezwuojhezw.sys
1⤵
- Executes dropped EXE
PID:1328

C:\Temp\rmjhbztrpj.sys
C:\Temp\rmjhbztrpj.sys
1⤵
- Executes dropped EXE
PID:2816

C:\Temp\ojgbztrljd.sys
C:\Temp\ojgbztrljd.sys
1⤵
- Executes dropped EXE
PID:4704

C:\Temp\vtqljdywqo.sys
C:\Temp\vtqljdywqo.sys
1⤵
PID:2812

C:\Temp\fdyvqnlfdy.sys
C:\Temp\fdyvqnlfdy.sys
1⤵
PID:2468

C:\Temp\gaysqcaxsq.sys
C:\Temp\gaysqcaxsq.sys
1⤵
PID:2884

C:\Temp\ifausqkica.sys
C:\Temp\ifausqkica.sys
1⤵
PID:5752

C:\Temp\hfcaxspkhc.sys
C:\Temp\hfcaxspkhc.sys
1⤵
PID:1404

C:\Temp\khczupmhez.sys
C:\Temp\khczupmhez.sys
1⤵
PID:4636

C:\Temp\ezwromkecz.sys
C:\Temp\ezwromkecz.sys
1⤵
PID:4864

C:\Temp\jgezwrojhb.sys
C:\Temp\jgezwrojhb.sys
1⤵
PID:2956

C:\Temp\geywqojgby.sys
C:\Temp\geywqojgby.sys
1⤵
PID:3324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aysqnifdav.sys

Path C:\Temp\aysqnifdav.sys
Size 293KB
SHA256 52ab3a2f13e2e0b306fec54b017d358ad064ad67abb9f64d4b4ff70c0af98fc7
MD5 7cd089fc2c52490cd8cb6c73afc32a0f
SHA1 405b4ce46329820525d9d13af81dac2c27c04fc5
SHA512 0f3b44bf91915f27aea5fa8ad88b5b9734b3141f73318e89e3d66452672c1af4443d71d30917d3bf294ed23db3724c8ce6619defc38464ba27eff1c6b7b6675d
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T16B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aywqolfdby.sys

Path C:\Temp\aywqolfdby.sys
Size 293KB
SHA256 2e68ceb663c724552c65f868e1a698cde935e7e9be62a91760edf604053e81eb
MD5 6ed9d670c61d0c4b7a2ee871f0916732
SHA1 7d1d98d55870a01648f11f78e30f9a7d7502eb4e
SHA512 7160a20be2f292bb9e6e8eb1c26966a9a5241d8bdbd4053c8e755eb27d586fdf1ed443d1519f069a88bf06cfee3f4b16c1f027f0036a61a245c8c6d05778f091
SSDEEP 3072:otKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:oIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvtnlgdyw.exe

Path C:\Temp\dyvtnlgdyw.exe
Size 361KB
SHA256 75d2ba276aa68b9ebc759e2e210b7da9c510ff0713ce89d38af8119c104c6e2e
MD5 8fdb94cb8d9141aeb52fbd3547b5d71c
SHA1 7b3cfc0f6c76591bc89bd49c55deb3ee553113f4
SHA512 e267b3e96b7ab9b01240fcd43538aa3071994bd08b0f139eb6d6bfd5f030b53ee38a730dbe1af4ac3762e830ed239cc3d6555cb8d76628b087e79266903957d2
SSDEEP 6144:PflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:PflfAsiVGjSGecvX
TLSH
T12B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faysqlfdxv.exe

Path C:\Temp\faysqlfdxv.exe
Size 361KB
SHA256 8e631db7ee558e6ec27fe82d333776a4ca0688458929b479e7ed168f946544a0
MD5 cb869346c36217a3eac6b26b6f2312ee
SHA1 3fb42849c2c0c56b06156fdfaac9e9f41be62336
SHA512 6b5f9971a4196d0b9b40b1f698ef4951c9d1e97401440ebc4f9017ab2b83024e4cad734449f8f48497e7c28e9193fbe6906b4c68098144e03f46e7e30d5db329
SSDEEP 6144:GflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:GflfAsiVGjSGecvX
TLSH
T1A1747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gebvtrojgb.exe

Path C:\Temp\gebvtrojgb.exe
Size 361KB
SHA256 d1aef8f9ed250ea70306b010af024f2aa2434b46ac85f73084640e34e51c169b
MD5 310da1c13e73763ea224e7a1c50e6e74
SHA1 87c7f8f3bb14cf35b3d7fb6093d8293639d2de3d
SHA512 717b1e1101c2c2be97cc043325c823d194a952b69fdd1848552c24c9ac997ad013c273e10128c5283eb29e329cdd0d8855f882b3b7dca7e7f0e6e4141f4a2fc5
SSDEEP 6144:AflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:AflfAsiVGjSGecvX
TLSH
T19D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbztrmjebztrpjhe.exe

Path C:\Temp\hbztrmjebztrpjhe.exe
Size 361KB
SHA256 0db4e6c707b43cab4f7554b4b229899a839d6eaf4340c314ff57875158c32eda
MD5 032583a45480c859fc33c4234519701a
SHA1 7bb3667310ea1bc93c80142e1e4d415fd91f42e7
SHA512 ab7dc6a5fdc363392fd6058cfb6462ee28786c216650202e6c0aa1e19473864d1c033cd9e4de5dc0ab2bb14d500b6ba3aad435399c8c80414f7b6ca1e321526f
SSDEEP 6144:wflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:wflfAsiVGjSGecvX
TLSH
T1AC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbztrmjebztrpjhe.sys

Path C:\Temp\hbztrmjebztrpjhe.sys
Size 293KB
SHA256 4ecf86803502a00749ed53febc3debd1cf02a493523729b499a5ec54f9239277
MD5 c73646ee36e56ab3803cb76782883ab3
SHA1 d021f7ecf66b137b1994861f48d17e5f0546b7b4
SHA512 8945090e672ff222b2aede62d72621e8aa4b37c8569703dd4345df4a630b1510bf23482908bcde3eb75bd8c8474928eb61f548f470eea8f38a37039fbf6fa5c9
SSDEEP 3072:ZtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:ZIJjiJcbI03GBc3ucY5DCSj
TLSH
T12D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dyvtnlgdyw.exe

Path C:\Temp\i_dyvtnlgdyw.exe
Size 361KB
SHA256 9ecbd27d1016bd0e455c12db750f6cefb68d80605bcef13e08188d995711e26e
MD5 0f5b2561b7a91cf81289ab0a65a70331
SHA1 eeed9e473de510d0b5896b5c3f7d462ffd23a88d
SHA512 ab98de7d62197b03a5834d2fd3c7a7e8c2f9a396cfc288e265d45e3eb5cd3479affe2cff8e4115e27c95a4a25a9d38a1b0c2ecc5e37aae2e924424206752a283
SSDEEP 6144:fflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:fflfAsiVGjSGecvX
TLSH
T18D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_faysqlfdxv.exe

Path C:\Temp\i_faysqlfdxv.exe
Size 361KB
SHA256 34d6025602eda075934a49ee6b9ccd2f7b713f040490f9b5c7ba9ebc0eace2a4
MD5 e9c1688bb5f09c6bbda54bdf0934aedf
SHA1 9998678040b57ce93b9ba2eac5583880ed379dc6
SHA512 043836effc9aab2fa3689b25f3ea315938e4bfcecf91947ab1c0047ecd5670b9e09849cb7fd8771496c7e59a21decfb2c9f4e42ea6775ff9a2d826a2052b3709
SSDEEP 6144:zflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:zflfAsiVGjSGecvX
TLSH
T1A7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gebvtrojgb.exe

Path C:\Temp\i_gebvtrojgb.exe
Size 361KB
SHA256 690f614ab957ae6c21235cc60cf230facb28d19cf17f9d380ef60211c4099d56
MD5 9848aa13a11c3f6e2498ed80d813650e
SHA1 0103fcca5f353be106cadab3bdfc79d5fe79f2d2
SHA512 994ee99faeb2951c0812317787030594bcdb29bb81320a44184e1edc908332131b0cc562f18c3f63e50db59598fa6b7d796d470d1005375a261c525e8026f085
SSDEEP 6144:ZflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:ZflfAsiVGjSGecvX
TLSH
T128747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgecwupjew.exe

Path C:\Temp\i_jgecwupjew.exe
Size 361KB
SHA256 9bec6e7c9f033206825687cd54811e0d6c6983cb8393a4cf1866966a52b9c9fa
MD5 d9ca387a052de4640c107b0c3531267a
SHA1 876a5610d7b85923169cabe689e2e8145aba0d1d
SHA512 5acc6027dd627b6b4496fd33ec86e9cd6e6306367f20835f5a1c26fc10cc434a611d8ccae1efdc3e952fccd0f0384e58c59260a927bfb6d5d48e653c9d182d4a
SSDEEP 6144:aflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:aflfAsiVGjSGecvX
TLSH
T1AB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoljdbztro.exe

Path C:\Temp\i_qoljdbztro.exe
Size 361KB
SHA256 260497153cd49ab8409ecd8b632a1ed47b9c8e8f8884f9bacb37604676080b64
MD5 097780e1c3936ea2f0009461a31ed95c
SHA1 77131ee68b853640387b7ffe0003612be8f97107
SHA512 29edf488f8e74dabd1e3db7337435c7954bfe43b5c9708417a3cc9cdbdeec68ddd44a7c850ce037242e8a6d0797e2a639a39c12b6cdb91c9d96571c23b78737e
SSDEEP 6144:VflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:VflfAsiVGjSGecvX
TLSH
T1CD747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgebwtojgb.sys

Path C:\Temp\jgebwtojgb.sys
Size 293KB
SHA256 4c8f5efd44ad8ff93ac0dcc0996abf94e69558c53160b6120f24327450659bbd
MD5 8bb3690add92d94b9167ec75d3ea39db
SHA1 f4c4ed58bbea9baa9714b0c829e2dead21e1cbb8
SHA512 f0e827a42cd9e22a375d2889abd53d01c5153cd1d9ac8d8f225a5ef4eaae73781f0f71d7af5bb95cce31e20ef5d18b50066e258ec41b258a74063cadbb9ca9db
SSDEEP 3072:QtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:QIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgecwupjew.exe

Path C:\Temp\jgecwupjew.exe
Size 361KB
SHA256 78bf42707d62bc3838a777a4f40549b0fe92f55dda0f419ee025a8d17d81ae74
MD5 cf13e44e01c5a1979adda73e2821e32f
SHA1 d786750a4ded390ad6cb111d086700bc1411354d
SHA512 a55e1c623848eaf6dd0ed3e36ebde182aa3dca98ccc1fee97d5b254254b4adac927606b59a9fb0cd64b703027cc8a4508232b1fca83061074d4c1bcb184fab32
SSDEEP 6144:IflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:IflfAsiVGjSGecvX
TLSH
T100747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nigaysqkid.sys

Path C:\Temp\nigaysqkid.sys
Size 293KB
SHA256 60bf5a04632e180399acbae4bb03f3296aae006261ae22333e3d7f766eb56e1c
MD5 c750129e010f17a8365acfc1e517c35a
SHA1 d0c4bec527c81a4d09c296bf7b7531be76058315
SHA512 633b2fdc931edfe5ca1eb13623faf4965af1c1605d5d74f67e3c63519ad3664510e09d6aeb6ae54ae7c90d73efc58ece02dcc6dc78837a2db6a7dd40ee585dc5
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T16A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoljdbztro.exe

Path C:\Temp\qoljdbztro.exe
Size 361KB
SHA256 64c27603618c18c4f9e0fb4b72cc731dd93ef12b9473a18b7af8c4a285fe4585
MD5 8d56b3aee9a0bc440852e4e25e883c29
SHA1 bffd39675c22df5f071331103dbd78c7a0ec9c8c
SHA512 52609efa3c9b2f0fe7c6422ec3beb586723e769983cefcccc14f632e7c1ae8c98796b62dd6a53f4b2d576f7a940563ffc68199bf85bc71d7ad9917f0cc9c7d6b
SSDEEP 6144:SflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:SflfAsiVGjSGecvX
TLSH
T143747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqnifzxsqk.exe

Path C:\Temp\sqnifzxsqk.exe
Size 361KB
SHA256 e33be1fcec5df31016deabc0261b8d316a18c27f2c14a4f27d82067db54502c2
MD5 a5f1c46fdff9584893bdff92da70e555
SHA1 6e2bb4930ebfa02c7bf801eaad825aabbd44e6ef
SHA512 30addebf37b802dbf431c9b04fb0d045226fb43ddb4de4709df27b2d448439f492b91ba0406f7f0bf415e120295c8d8e69b60ed9d16b8ab8923c0b7cafd2d40c
SSDEEP 6144:JflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:JflfAsiVGjSGecvX
TLSH
T1DF747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytromgezwu.sys

Path C:\Temp\ytromgezwu.sys
Size 293KB
SHA256 65ee9e76d064895ba4e6a46a2f80fa227d0bb32c09f6d05bcd047189b7d092c2
MD5 723ea445925ee3ee353c6f94fc652299
SHA1 dc3412e1d6e8004a2e41c2cf9bff809c6fd09ff6
SHA512 b67adf93ce9a8f6dd7b0cc9df45013ecd8f9ff5e776c69f558ff191f088fec27040deffe69707a28858685477ab720f20c3cae35de019127f595da63efc75861
SSDEEP 3072:6tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:6IJjiJcbI03GBc3ucY5DCSj
TLSH
T160545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a89f31f92ab07493aff39eed6d1979567f73f2e5a7a81092397f676429490f6d
MD5 434e5c5baa64516acdd443587668eb87
SHA1 5eff3ae36f04e3cb4a5f59f0d016aa05053377e4
SHA512 0ea85b5e59e1ec5e461761d8f0bcd5f1cc91013a30b464628587fed52f3f48ed157830f8342fe9126883ff9b10fff9738fb16c49c9031d791a4e032e60a2b315
TLSH
T1C961EC5493611EF2CBE94AB3F2F06C9833E88446668B2A0DC05EAFF51406F5D93E1633
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5984b7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5984b7.TMP
Size 3KB
SHA256 ad6f420a57ad7e6f87e1f5b5e29b8324ceccf2c21c2bef2fb617475c7d34a2e1
MD5 f1bbe29f8225eb5927299e99805a2f29
SHA1 5fdad0525d1ee1a4a6dee8d7905507af3f5706fd
SHA512 f4ff72ea9342c30c53b750071a12271b0dac8b4c6c62cb0d83cd054176437ad7c959d25c30e02c767467a7dfda54dee288524b702ee543f61b60b852a5208b2a
TLSH
T17861EC5493611EF2CBE94AB3F2B06C9833E88446668B2A0DC05EAEF55406F5D93E1633
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 689f549fadf4ef086f7a98da708623d11de43d7698ab60567352fd257138b125
MD5 fd73f65a7add71ad38dd7554afe38150
SHA1 60959ec438d5a2be0cb1638171edf86783ab6be5
SHA512 0d488ab3dcc5ee792ce95d85e7c37576cf978abfb6296f38997da99e7f0acf98d5202c90e6ac9e69e7769c9b4d98eebca38dffb4efb6178689244ab46b642699
TLSH
T135419EF383F4867E890156F0AB146E1FCE1D0515432C7D5AC9E4AE2B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 81f66ed1d7713c4043671017633c57ab250148e90c0c3dac38c6808f964c78ef
MD5 78e8e5b9c3e31194adcb98d5f9b46f0d
SHA1 c78ba124b50bd85ee36c8e4208512268164883de
SHA512 9c7d459ec8b6dfa3eb929f1f555ce42695e9459428f7175d089e8b7b952b99faa926dc8a47148f155aa6c73d0eb0ee621d29e54ad8d6f5ff602c57941a6ca56e
SSDEEP 192:sxR6BRWyM/jK1Ml8wCU5/fUsZsT1WZYmzoA8p9//g6+WNCQp/YnSUehwGOIgDLWJ:sxRgU8s/fUsZS1gyB/57/T1ii
TLSH
T17D62E845AA3469778CDBD20CFA557F63D6F81473A1941E44AAFC9A1C04E6AEC2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 69814c3ad227dfd5c66208692c2962d3c5c6bfda33bed73a255e3077be80fcb5
MD5 c6732bc78c9ec69cc8c6662ebf60e8ce
SHA1 e453001ea4f7be0470cac3188240eeb16a663cd8
SHA512 aae12f11aee68cf751c7d25df839144dff6a8ace79d98e033aa65f72c75aff7ad556f117e37e9427642d5a5e6f0b9e2abce95fb526181ea5eafa474edc4baf61
SSDEEP 192:sxRtBRWyM/jK1Ml8wCU5/fUs6sT1WZYmzoA8p9//g6+WNCQp/YnSUehwGOIgVWJ:sxRbU8s/fUs6S1gyB/57/T1ik
TLSH
T12E62E8156A24A9778CDBD20CFA557F63D6F81573A2941E44AAFCDA1C04E6AEC2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d327f82a59c51a1d0afe76a4976e0316cdf8ec533c8bc360160666c1fb8aa5a9
MD5 c6660a59b0b9fe51df00e0fd0c5e828f
SHA1 1890987c82312911a21316a29bb9e0a9704a7575
SHA512 b490ccf214b854a7503f8a5acf13380cc1858fd3faad082483e5eb4e47d5a7fdb11f9379e98c0a9b0cc7684b9d0bf7705406554197b15951f6f407d1abb80c2d
SSDEEP 192:sxR6BRWyM/jK1Ml8UQ9CU5/fUsZsTpWZYmzoA8pr//g6+WNCQp/YnSqEhwGOIgDg:sxRgUq8s/fUsZSpgyT/57/TXi0
TLSH
T1E362E855AA2469779CDBE20CFA517F63D6F81473A1941E44AAFCDA1C04E6AEC2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 717c0d793d8091d61b10504eb0813a309ceb230af5b0cc4f41cbfa97dbaa0d94
MD5 723f63f28534483a4b4ffaac29c6934b
SHA1 000bf3029fddfeea8a726be25c7fbfec3a1c5fc0
SHA512 91ccf417bbdc7e943816a1968c201483c0f1e06457ee19b510c0912b0832abc8dad9bbbe0d1e0fd748df4539575f676275302a7ec94ef0ac24c6d1696a198157
SSDEEP 768:wGedKg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvOOu4YHroS/8Hg:wGedKsE7X6WgoufDMu1ja0OOVYUbg
TLSH
T10AE2EB7B680CCB7E4F804EDCEC29BE9FADA801CB5AD8895447EA840C03C57EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 59f13eb1c190f7bdd2dbf32dd85a98b21116e23fef2d41e6a1e7ab8068a9045f
MD5 21286f294a0ad1073baaa3a41d7c06eb
SHA1 22dc95e279e60b71fe19e13bf4552868dcf26c3d
SHA512 5eeee47b945f69acd091c0056d9fac39c31aa3f10384c6afdccf18a35fa7eb340060a781d377eddc0480a4360b9ec1c13bf240df44d1bb841c1c9373437dee4d
SSDEEP 96:KReTieYgQGWAltgeGK4DgcGcW+9M+XHklQUuSW0Wyf/gc0K4xgW0cUUfO3MAKVah:CeTieYgQxAl+eODgc1W+9M+XHklQUuSp
TLSH
T127917011357B07943CBF654C94AAAC2B928674633114F92B3BEA51D10F67E424DFE8C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 dba985bdf3661d14fc9d865178145fd4f0c4f68b816cef1ea2491d721a4c228c
MD5 75b2143f282427ad22d6288b97e538cb
SHA1 c6536f118902abd671a459daa05f3ec1ec571563
SHA512 d5d73bb41038b2c7e531a9d1603dc8cdb921a51f81b53316dd78f7d56d628bb1df33fd39e3856aefaaa19b784cf279e764fd19959d117a11dceba97d48902849
SSDEEP 768:6rv+4UNbds3YiDZIO0CEl8dNzc4ReyIsXCeVH1S5D:6bsbS3pDtc44bsSEH1Y
TLSH
T19003CF32A8689977ACF69685B44B76137EF8612B82C81ED4C5DE2F0C4A4B1DD130F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9f125bc5d642e173906469af15a1582a2593ece3d1aee130fc72b923307169be
MD5 dea539eb05f8982ec54914f5f34ba45e
SHA1 99119161a49d62207eb45935ef323d9a30a55fbc
SHA512 b5f6d552f8541069daa1a36165d3f9cc503f9224361d723bb79f239a1547b08aef968a6ce0a05eeef018d6e6b4e7a25be8c87422dfdcb2932485c0a2a9e38d26
SSDEEP 768:l132ONDZIO0CEl8sVNzc4ReyIsPDPi9Pzy:l132QiVtc44bsbPp
TLSH
T1A1F2BF71EC249D63ACFAA742B6463643BEF02167C1C82E98E5ED9F0C098369D071F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 d5913c96649606b212d157d62e76e42d5d82e98e1d1eeef0f7f860b6ae29c367
MD5 acc2d24fbae0f66cfd61880941770627
SHA1 79dd812456a236e218173e08d614aa092868f3aa
SHA512 76cded88322b9807d3505e4abe8eaee2b75ede4dd17f7125c7953863d055e31ddef98adb2c2b7ba05365b1d5a4db1c8a56402f9ffd1d691974f425712e3d0a31
SSDEEP 768:1rv+4UNbds3azDZIO0CEl8siNzc4ReyIs2DeVH1S5D:1bsbS3Oiitc44bsUEH1Y
TLSH
T14703DF32E828D933ACFAA742B44736937EF4216B85C80E94D9EA5F0C4A471DD135F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c6254f3c30ee2b49dfafa2e1e528a25890d606bff39dad7dded9ef1bd15927fb
MD5 7683db76504e472a61ab09ee9ae53d58
SHA1 b31b699a77a7506f57cdeb18ab97c1b1481b4a29
SHA512 dbf925f122a230a4c5bf0a06f0985b04224cc28674f9b7109f9b09bd6f902cbdcc6af7e3ba0afaf966724546d8fe78a6d42ff0cd3e302ae6f40b57bdf0e22b6c
SSDEEP 768:q133ONDZIO0CEl8sVNzc4ReyIsPDPi9Pzy:q133QiVtc44bsbPp
TLSH
T108F2BF71EC249D63ACFAE742B6463653BEF02167C1C82E98E5ED9B0C098369D171F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 b832165fc4d9407ffabb20a9b489994e3eb192ff1bc457d53a3a5be251c0382f
MD5 1f62a3d7cb7cfed03b6cb23403d92514
SHA1 81a3d81c3ab2c631b9724f114d0f228f166f8db0
SHA512 eb023d9c4b5a073c89e6a1bb689d435224da6637b9fa4c246b12612ca04e25a8d12945ac80a5c9921278109332acb021b4f793e61e951a76a34be03d854f4981
SSDEEP 768:rrv+4UNbdG3YNDZIO0CEl8sBNzc4ReyIsPDPi9PzU:rbsbg3iiBtc44bsbPn
TLSH
T1E213CF31F928DD63ACFAA682B54736437EF4256784C81EA4E5E95F0C0A871DD171F813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 626913fc0395ece898a7e530928e19d9600a8e67ce09aec8d97374a8a9417b33
MD5 3cb12b5ea85797b42cf4054fa59a0cab
SHA1 bca37c5d19fb134c96f3959cfbee5d8247803dc1
SHA512 12a420f5105db8dcfbb90ea373e105e89e342e10eac762b293846388aa4c88a4c2ed6e0cbaf907a46fee6d8cfed30f325a06daa8c46a7cd825ab24f589eb93db
SSDEEP 768:TFQG3vwgHXUZJ5O0CEl8sJNzc4ReyIsPDPi9Pzy:2G3BNiJtc44bsbPp
TLSH
T1141317F598D79976E8AE5743A73D2D42ADFCD167B0885994B7D84E0CCC821BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

ee1be0e2-9e21-4200-9962-eb90879b58b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ee1be0e2-9e21-4200-9962-eb90879b58b4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5964_797395783\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 e72faf47e825c3ab7d60e792723d2d96abfc74a919dce91d736b2e93d1d51f51
MD5 7e82e8d5875e8339c165afa3034a6328
SHA1 6c884a4aede051a1ad6a9f29cb22abf37a19b6d8
SHA512 8914167bb9dd7c9dcff98e22818d95806612f6c251a8290c382a7f66976d99c8c7f69b76c37202fb9625d0e37df6377d740a86d99373985a84beb086456d1e8c
TLSH
T1A071008357B9C9B3C1DB5BF102835608F6FB2238072360340B555586AA30A7A14B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1168-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1328-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1404-442-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1692-266-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2468-407-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2812-386-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2816-334-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2884-418-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2956-493-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3324-497-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3668-278-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4156-291-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4336-238-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4472-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4520-191-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4636-460-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4704-359-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4840-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4864-465-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5752-422-0x0000000000010000-0x00000000000AB000-memory.dmp

Download