systex | 3faec85808ea2980a66aa03eed6d8e10b8374de274854cdce5e872927353490d

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260816-e8th2azdlf
SHA256 3faec85808ea2980a66aa03eed6d8e10b8374de274854cdce5e872927353490d
MD5 5196a719505a04a349117505799741f3
SHA1 fe459b904652440d7f7b0e0c80d1d47e30ca80db
SHA512 e577a74ec5acc13f24d0af867e8b28ef063c36ff02deb6107436648e01efefe301b8ac6137468cba931c505dbfcfa0f1f13af6b1aa6591384663f7e902bce7a9
SSDEEP 6144:sflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:sflfAsiVGjSGecvX
TLSH
T1C5747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3428	jgbytqomjdbwtolg.exe
2556	jgbytqomjdbwtolg.sys
4620	CreateProcess.exe
2904	roigebwtoj.exe
4908	CreateProcess.exe
636	CreateProcess.exe
3856	i_roigebwtoj.exe
6004	trljdbvtnl.sys
1376	CreateProcess.exe
3528	lgdbvtnlfd.exe
3076	CreateProcess.exe
5412	CreateProcess.exe
3016	i_lgdbvtnlfd.exe
5332	dyvtnlfdyv.sys
4160	CreateProcess.exe
1152	tnlfdyvqni.exe
4068	CreateProcess.exe
2400	CreateProcess.exe
3832	i_tnlfdyvqni.exe
5100	lfdxvpnifd.sys
1312	CreateProcess.exe
3856	ifaysqkida.exe
5464	CreateProcess.exe
2076	CreateProcess.exe
2368	i_ifaysqkida.exe
4948	fcxvsnkica.sys
5116	CreateProcess.exe
5088	fcauspkica.exe
3220	CreateProcess.exe
2664	CreateProcess.exe
1852	i_fcauspkica.exe
2040	zxupmkhfzx.sys
5552	CreateProcess.exe
5452	xupmhfzxrp.exe
5848	CreateProcess.exe
4376	CreateProcess.exe
624	i_xupmhfzxrp.exe
2320	wupmkecwup.sys
1728	CreateProcess.exe
4488	pmhezurpjh.exe
1128	CreateProcess.exe
3764	CreateProcess.exe
1384	i_pmhezurpjh.exe
2544	wuomjhezwr.sys
2224	CreateProcess.exe
2104	zwuomhezxr.exe
4216	CreateProcess.exe
5504	CreateProcess.exe
1344	i_zwuomhezxr.exe
5744	trljebwtom.sys
6072	CreateProcess.exe
3444	mgebwtrlje.exe
4796	CreateProcess.exe
1044	CreateProcess.exe
1824	i_mgebwtrlje.exe
256	ywqojgdbvt.sys
1272	CreateProcess.exe
4240	ytrligdyvt.exe
5072	CreateProcess.exe
4360	CreateProcess.exe
3960	i_ytrligdyvt.exe
2340	dyvqoigdyw.sys
964	CreateProcess.exe
4372	tnlfdyvtnl.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_668434187\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_668434187\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1295594531\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1295594531\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1295594531\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1295594531\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_818266513\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_285873268\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_285873268\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdbvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhezurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwuomhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwuomhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytrligdyvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgebwtrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usnhfaxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwupmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytqligayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_roigebwtoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdbvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdyvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhezurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdyvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytqligayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytrligdyvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbytqomjdbwtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdyvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgebwtrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxusmki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	roigebwtoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdyvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcauspkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcauspkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idavtqliga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxusmki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwupmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usnhfaxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5924	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2696	ipconfig.exe
1272	ipconfig.exe
3924	ipconfig.exe
2124	ipconfig.exe
3676	ipconfig.exe
2304	ipconfig.exe
4060	ipconfig.exe
4816	ipconfig.exe
5328	ipconfig.exe
4588	ipconfig.exe
3240	ipconfig.exe
5828	ipconfig.exe
5960	ipconfig.exe
3472	ipconfig.exe
2512	ipconfig.exe
4900	ipconfig.exe
4556	ipconfig.exe
4972	ipconfig.exe
2760	ipconfig.exe
5096	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313286349431347"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{8742BA05-1981-49CE-A268-400D44098A0A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3428	jgbytqomjdbwtolg.exe
3428	jgbytqomjdbwtolg.exe
3428	jgbytqomjdbwtolg.exe
3428	jgbytqomjdbwtolg.exe
3428	jgbytqomjdbwtolg.exe
3428	jgbytqomjdbwtolg.exe
3428	jgbytqomjdbwtolg.exe
3428	jgbytqomjdbwtolg.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3856	i_roigebwtoj.exe
Token: SeDebugPrivilege	3016	i_lgdbvtnlfd.exe
Token: SeDebugPrivilege	3832	i_tnlfdyvqni.exe
Token: SeDebugPrivilege	2368	i_ifaysqkida.exe
Token: SeDebugPrivilege	1852	i_fcauspkica.exe
Token: SeDebugPrivilege	624	i_xupmhfzxrp.exe
Token: SeDebugPrivilege	1384	i_pmhezurpjh.exe
Token: SeDebugPrivilege	1344	i_zwuomhezxr.exe
Token: SeDebugPrivilege	1824	i_mgebwtrlje.exe
Token: SeDebugPrivilege	3960	i_ytrligdyvt.exe
Token: SeDebugPrivilege	2636	i_tnlfdyvtnl.exe
Token: SeDebugPrivilege	2068	i_yvqnigaysq.exe
Token: SeDebugPrivilege	5060	i_usnhfaxvpn.exe
Token: SeDebugPrivilege	5736	i_nhfzxusmki.exe
Token: SeDebugPrivilege	5392	i_mkecwupmhe.exe
Token: SeDebugPrivilege	5164	i_upmhezxrpj.exe
Token: SeDebugPrivilege	432	i_zwrpjhbztr.exe
Token: SeDebugPrivilege	2240	i_geywqoigby.exe
Token: SeDebugPrivilege	5616	i_bytqligayt.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3360	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 3428	4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4204 wrote to memory of 4836	4204	2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 4836 wrote to memory of 3360	4836	iexplore.exe	91
PID 3360 wrote to memory of 4844	3360	msedge.exe	92
PID 3360 wrote to memory of 5924	3360	msedge.exe	93
PID 3360 wrote to memory of 2148	3360	msedge.exe	94
PID 3360 wrote to memory of 2148	3360	msedge.exe	94
PID 3360 wrote to memory of 2148	3360	msedge.exe	94
PID 3360 wrote to memory of 436	3360	msedge.exe	95
PID 3360 wrote to memory of 436	3360	msedge.exe	95
PID 3360 wrote to memory of 4396	3360	msedge.exe	97
PID 3360 wrote to memory of 4396	3360	msedge.exe	97
PID 3360 wrote to memory of 4448	3360	msedge.exe	96
PID 3360 wrote to memory of 4396	3360	msedge.exe	97
PID 3360 wrote to memory of 4448	3360	msedge.exe	96
PID 3360 wrote to memory of 4448	3360	msedge.exe	96
PID 3360 wrote to memory of 3424	3360	msedge.exe	99
PID 3360 wrote to memory of 3424	3360	msedge.exe	99
PID 3360 wrote to memory of 3424	3360	msedge.exe	99
PID 3360 wrote to memory of 1132	3360	msedge.exe	100
PID 3360 wrote to memory of 1132	3360	msedge.exe	100
PID 3360 wrote to memory of 1132	3360	msedge.exe	100
PID 3360 wrote to memory of 3660	3360	msedge.exe	101
PID 3360 wrote to memory of 3660	3360	msedge.exe	101
PID 3360 wrote to memory of 3020	3360	msedge.exe	105
PID 3360 wrote to memory of 3020	3360	msedge.exe	105
PID 3360 wrote to memory of 6092	3360	msedge.exe	106
PID 3360 wrote to memory of 6092	3360	msedge.exe	106
PID 3428 wrote to memory of 4620	3428	jgbytqomjdbwtolg.exe	107
PID 3360 wrote to memory of 1940	3360	msedge.exe	110
PID 2904 wrote to memory of 4908	2904	roigebwtoj.exe	112
PID 3360 wrote to memory of 2424	3360	msedge.exe	115
PID 3360 wrote to memory of 2424	3360	msedge.exe	115
PID 3360 wrote to memory of 3832	3360	msedge.exe	116
PID 3360 wrote to memory of 3832	3360	msedge.exe	116
PID 3428 wrote to memory of 636	3428	jgbytqomjdbwtolg.exe	119
PID 3428 wrote to memory of 1376	3428	jgbytqomjdbwtolg.exe	123
PID 3528 wrote to memory of 3076	3528	lgdbvtnlfd.exe	125
PID 3428 wrote to memory of 5412	3428	jgbytqomjdbwtolg.exe	128
PID 3428 wrote to memory of 4160	3428	jgbytqomjdbwtolg.exe	132
PID 1152 wrote to memory of 4068	1152	tnlfdyvqni.exe	134
PID 3428 wrote to memory of 2400	3428	jgbytqomjdbwtolg.exe	137
PID 3428 wrote to memory of 1312	3428	jgbytqomjdbwtolg.exe	142
PID 3856 wrote to memory of 5464	3856	ifaysqkida.exe	144
PID 3428 wrote to memory of 2076	3428	jgbytqomjdbwtolg.exe	147
PID 3360 wrote to memory of 3796	3360	msedge.exe	149
PID 3360 wrote to memory of 4192	3360	msedge.exe	150
PID 3360 wrote to memory of 4360	3360	msedge.exe	151
PID 3428 wrote to memory of 5116	3428	jgbytqomjdbwtolg.exe	154
PID 5088 wrote to memory of 3220	5088	fcauspkica.exe	156
PID 3428 wrote to memory of 2664	3428	jgbytqomjdbwtolg.exe	159
PID 3428 wrote to memory of 5552	3428	jgbytqomjdbwtolg.exe	163
PID 5452 wrote to memory of 5848	5452	xupmhfzxrp.exe	165
PID 3428 wrote to memory of 4376	3428	jgbytqomjdbwtolg.exe	168
PID 3428 wrote to memory of 1728	3428	jgbytqomjdbwtolg.exe	172
PID 4488 wrote to memory of 1128	4488	pmhezurpjh.exe	174
PID 3428 wrote to memory of 3764	3428	jgbytqomjdbwtolg.exe	177
PID 3428 wrote to memory of 2224	3428	jgbytqomjdbwtolg.exe	181
PID 2104 wrote to memory of 4216	2104	zwuomhezxr.exe	183
PID 3428 wrote to memory of 5504	3428	jgbytqomjdbwtolg.exe	186
PID 3360 wrote to memory of 4452	3360	msedge.exe	188
PID 3360 wrote to memory of 4452	3360	msedge.exe	188
PID 3428 wrote to memory of 6072	3428	jgbytqomjdbwtolg.exe	194
PID 3444 wrote to memory of 4796	3444	mgebwtrlje.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_5196a719505a04a349117505799741f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Temp\jgbytqomjdbwtolg.exe
  C:\Temp\jgbytqomjdbwtolg.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\roigebwtoj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4620
  - - C:\Temp\roigebwtoj.exe
      C:\Temp\roigebwtoj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2904
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4908
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_roigebwtoj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:636
  - - C:\Temp\i_roigebwtoj.exe
      C:\Temp\i_roigebwtoj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdbvtnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1376
  - - C:\Temp\lgdbvtnlfd.exe
      C:\Temp\lgdbvtnlfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3528
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3076
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgdbvtnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5412
  - - C:\Temp\i_lgdbvtnlfd.exe
      C:\Temp\i_lgdbvtnlfd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnlfdyvqni.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4160
  - - C:\Temp\tnlfdyvqni.exe
      C:\Temp\tnlfdyvqni.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1152
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnlfdyvqni.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2400
  - - C:\Temp\i_tnlfdyvqni.exe
      C:\Temp\i_tnlfdyvqni.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifaysqkida.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1312
  - - C:\Temp\ifaysqkida.exe
      C:\Temp\ifaysqkida.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3856
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5464
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifaysqkida.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2076
  - - C:\Temp\i_ifaysqkida.exe
      C:\Temp\i_ifaysqkida.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcauspkica.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5116
  - - C:\Temp\fcauspkica.exe
      C:\Temp\fcauspkica.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5088
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3220
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcauspkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2664
  - - C:\Temp\i_fcauspkica.exe
      C:\Temp\i_fcauspkica.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xupmhfzxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5552
  - - C:\Temp\xupmhfzxrp.exe
      C:\Temp\xupmhfzxrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5452
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5848
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xupmhfzxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4376
  - - C:\Temp\i_xupmhfzxrp.exe
      C:\Temp\i_xupmhfzxrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmhezurpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1728
  - - C:\Temp\pmhezurpjh.exe
      C:\Temp\pmhezurpjh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4488
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1128
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmhezurpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3764
  - - C:\Temp\i_pmhezurpjh.exe
      C:\Temp\i_pmhezurpjh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwuomhezxr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2224
  - - C:\Temp\zwuomhezxr.exe
      C:\Temp\zwuomhezxr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2104
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4216
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwuomhezxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5504
  - - C:\Temp\i_zwuomhezxr.exe
      C:\Temp\i_zwuomhezxr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgebwtrlje.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6072
  - - C:\Temp\mgebwtrlje.exe
      C:\Temp\mgebwtrlje.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3444
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4796
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgebwtrlje.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1044
  - - C:\Temp\i_mgebwtrlje.exe
      C:\Temp\i_mgebwtrlje.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ytrligdyvt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1272
  - - C:\Temp\ytrligdyvt.exe
      C:\Temp\ytrligdyvt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4240
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5072
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ytrligdyvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4360
  - - C:\Temp\i_ytrligdyvt.exe
      C:\Temp\i_ytrligdyvt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnlfdyvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:964
  - - C:\Temp\tnlfdyvtnl.exe
      C:\Temp\tnlfdyvtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4372
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4816
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnlfdyvtnl.exe ups_ins
    3⤵
    PID:5416
  - - C:\Temp\i_tnlfdyvtnl.exe
      C:\Temp\i_tnlfdyvtnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2636
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvqnigaysq.exe ups_run
    3⤵
    PID:1644
  - - C:\Temp\yvqnigaysq.exe
      C:\Temp\yvqnigaysq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3504
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1824
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvqnigaysq.exe ups_ins
    3⤵
    PID:4332
  - - C:\Temp\i_yvqnigaysq.exe
      C:\Temp\i_yvqnigaysq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usnhfaxvpn.exe ups_run
    3⤵
    PID:5824
  - - C:\Temp\usnhfaxvpn.exe
      C:\Temp\usnhfaxvpn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:260
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3812
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usnhfaxvpn.exe ups_ins
    3⤵
    PID:5564
  - - C:\Temp\i_usnhfaxvpn.exe
      C:\Temp\i_usnhfaxvpn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfzxusmki.exe ups_run
    3⤵
    PID:3772
  - - C:\Temp\nhfzxusmki.exe
      C:\Temp\nhfzxusmki.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5632
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4976
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfzxusmki.exe ups_ins
    3⤵
    PID:4580
  - - C:\Temp\i_nhfzxusmki.exe
      C:\Temp\i_nhfzxusmki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkecwupmhe.exe ups_run
    3⤵
    PID:5536
  - - C:\Temp\mkecwupmhe.exe
      C:\Temp\mkecwupmhe.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2380
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1336
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkecwupmhe.exe ups_ins
    3⤵
    PID:1492
  - - C:\Temp\i_mkecwupmhe.exe
      C:\Temp\i_mkecwupmhe.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upmhezxrpj.exe ups_run
    3⤵
    PID:1936
  - - C:\Temp\upmhezxrpj.exe
      C:\Temp\upmhezxrpj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4968
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5264
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upmhezxrpj.exe ups_ins
    3⤵
    PID:4928
  - - C:\Temp\i_upmhezxrpj.exe
      C:\Temp\i_upmhezxrpj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwrpjhbztr.exe ups_run
    3⤵
    PID:3928
  - - C:\Temp\zwrpjhbztr.exe
      C:\Temp\zwrpjhbztr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5876
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwrpjhbztr.exe ups_ins
    3⤵
    PID:4948
  - - C:\Temp\i_zwrpjhbztr.exe
      C:\Temp\i_zwrpjhbztr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywqoigby.exe ups_run
    3⤵
    PID:4264
  - - C:\Temp\geywqoigby.exe
      C:\Temp\geywqoigby.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5588
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5732
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4556
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywqoigby.exe ups_ins
    3⤵
    PID:4996
  - - C:\Temp\i_geywqoigby.exe
      C:\Temp\i_geywqoigby.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bytqligayt.exe ups_run
    3⤵
    PID:1576
  - - C:\Temp\bytqligayt.exe
      C:\Temp\bytqligayt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4304
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1848
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bytqligayt.exe ups_ins
    3⤵
    PID:2268
  - - C:\Temp\i_bytqligayt.exe
      C:\Temp\i_bytqligayt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idavtqliga.exe ups_run
    3⤵
    PID:4688
  - - C:\Temp\idavtqliga.exe
      C:\Temp\idavtqliga.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5788
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5868
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4060
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x364,0x7ff8b7a6c188,0x7ff8b7a6c194,0x7ff8b7a6c1a0
      4⤵
      PID:4844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,4366704462147243828,13352082041908866659,524288 --field-trial-handle=2736,i,5717119287281923677,10012751654344766423,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:11
      4⤵
      System Time Discovery
      PID:5924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,7488018742576557109,10549571743777678144,262144 --field-trial-handle=2736,i,5717119287281923677,10012751654344766423,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:2
      4⤵
      PID:2148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,16709314130824021837,2614259864593710245,524288 --field-trial-handle=2736,i,5717119287281923677,10012751654344766423,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:13
      4⤵
      PID:436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,13446386111524120080,14508013055530124462,2097152 --field-trial-handle=2736,i,5717119287281923677,10012751654344766423,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
      4⤵
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,1309708546872290261,15507505224447306301,2097152 --field-trial-handle=2736,i,5717119287281923677,10012751654344766423,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:4396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,18148807400462734740,5906913381518476094,2097152 --field-trial-handle=2736,i,5717119287281923677,10012751654344766423,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:9
      4⤵
      PID:3424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4344,i,1909703415251997348,18029676354429275053,2097152 --field-trial-handle=2736,i,5717119287281923677,10012751654344766423,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
      4⤵
      PID:1132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,12634060338905715951,12897845415996074855,524288 --field-trial-handle=2736,i,5717119287281923677,10012751654344766423,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14
      4⤵
      PID:3660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,1211163034096403113,10145081559371530830,524288 --field-trial-handle=2736,i,5717119287281923677,10012751654344766423,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:14
      4⤵
      PID:3020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,4829163529977843601,5653766928963752046,524288 --field-trial-handle=2736,i,5717119287281923677,10012751654344766423,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
      4⤵
      PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,520630778084656873,6459503172436809667,524288 --field-trial-handle=2736,i,5717119287281923677,10012751654344766423,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:1268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,520630778084656873,6459503172436809667,524288 --field-trial-handle=2736,i,5717119287281923677,10012751654344766423,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:1940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,4201316057980301637,6333909379768153115,524288 --field-trial-handle=2736,i,5717119287281923677,10012751654344766423,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:2424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,2370838319417672194,1065945241861466001,524288 --field-trial-handle=2736,i,5717119287281923677,10012751654344766423,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
      4⤵
      PID:3832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,4117444964580257617,4254803997760930716,524288 --field-trial-handle=2736,i,5717119287281923677,10012751654344766423,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
      4⤵
      PID:3796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,1309531469970917661,7668179197815506856,524288 --field-trial-handle=2736,i,5717119287281923677,10012751654344766423,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
      4⤵
      PID:4192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,3390381502159632754,16480610569615333619,524288 --field-trial-handle=2736,i,5717119287281923677,10012751654344766423,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
      4⤵
      PID:4360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,675401193027978222,6170843119724886,524288 --field-trial-handle=2736,i,5717119287281923677,10012751654344766423,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
      4⤵
      PID:4452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,1202154637862351397,12256329797159360320,524288 --field-trial-handle=2736,i,5717119287281923677,10012751654344766423,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
      4⤵
      PID:3268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=944,i,1535511141663172172,12846746493078630331,524288 --field-trial-handle=2736,i,5717119287281923677,10012751654344766423,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:14
      4⤵
      PID:2356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,4046013080605233626,5896741926127811617,524288 --field-trial-handle=2736,i,5717119287281923677,10012751654344766423,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
      4⤵
      PID:6084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5540,i,7835958864303784415,10879226402304770197,262144 --field-trial-handle=2736,i,5717119287281923677,10012751654344766423,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:10
      4⤵
      PID:5404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3380,i,995587456516884437,939129073598098659,524288 --field-trial-handle=2736,i,5717119287281923677,10012751654344766423,262144 --variations-seed-version --mojo-platform-channel-handle=1192 /prefetch:14
      4⤵
      PID:2008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2880

C:\Temp\jgbytqomjdbwtolg.sys
C:\Temp\jgbytqomjdbwtolg.sys
1⤵
- Executes dropped EXE
PID:2556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2856

C:\Temp\trljdbvtnl.sys
C:\Temp\trljdbvtnl.sys
1⤵
- Executes dropped EXE
PID:6004

C:\Temp\dyvtnlfdyv.sys
C:\Temp\dyvtnlfdyv.sys
1⤵
- Executes dropped EXE
PID:5332

C:\Temp\lfdxvpnifd.sys
C:\Temp\lfdxvpnifd.sys
1⤵
- Executes dropped EXE
PID:5100

C:\Temp\fcxvsnkica.sys
C:\Temp\fcxvsnkica.sys
1⤵
- Executes dropped EXE
PID:4948

C:\Temp\zxupmkhfzx.sys
C:\Temp\zxupmkhfzx.sys
1⤵
- Executes dropped EXE
PID:2040

C:\Temp\wupmkecwup.sys
C:\Temp\wupmkecwup.sys
1⤵
- Executes dropped EXE
PID:2320

C:\Temp\wuomjhezwr.sys
C:\Temp\wuomjhezwr.sys
1⤵
- Executes dropped EXE
PID:2544

C:\Temp\trljebwtom.sys
C:\Temp\trljebwtom.sys
1⤵
- Executes dropped EXE
PID:5744

C:\Temp\ywqojgdbvt.sys
C:\Temp\ywqojgdbvt.sys
1⤵
- Executes dropped EXE
PID:256

C:\Temp\dyvqoigdyw.sys
C:\Temp\dyvqoigdyw.sys
1⤵
- Executes dropped EXE
PID:2340

C:\Temp\yvqnifdays.sys
C:\Temp\yvqnifdays.sys
1⤵
PID:5448

C:\Temp\ayvpnkicxv.sys
C:\Temp\ayvpnkicxv.sys
1⤵
PID:2520

C:\Temp\nhfaxrpkhf.sys
C:\Temp\nhfaxrpkhf.sys
1⤵
PID:5328

C:\Temp\rpnhecaxsp.sys
C:\Temp\rpnhecaxsp.sys
1⤵
PID:1268

C:\Temp\wupmhczurm.sys
C:\Temp\wupmhczurm.sys
1⤵
PID:6096

C:\Temp\ebztrpjhey.sys
C:\Temp\ebztrpjhey.sys
1⤵
PID:3676

C:\Temp\geywtolgey.sys
C:\Temp\geywtolgey.sys
1⤵
PID:1932

C:\Temp\oigeywqojg.sys
C:\Temp\oigeywqojg.sys
1⤵
PID:5448

C:\Temp\igaytnlfdy.sys
C:\Temp\igaytnlfdy.sys
1⤵
PID:4760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dyvtnlfdyv.sys

Path C:\Temp\dyvtnlfdyv.sys
Size 293KB
SHA256 f5c3e96099364401a96ccd4dcde7166de452c9b6e61d74aafc639a1c5510c499
MD5 3345f4bca25f312a03de8551445ca1c9
SHA1 7a877cff29c677dc4e5e69505bee5b24b2e17b2c
SHA512 14d3fd3dea51357e58ad24d5010ff41edf56988023b36175cab7e9d5594577f6ccf5f7a8af77fd2f3db25bb601d7d1af0f26f56588d70edb4389e677fd8698e9
SSDEEP 3072:FtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:FIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D0545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcauspkica.exe

Path C:\Temp\fcauspkica.exe
Size 361KB
SHA256 6147e85810d4fd9e390d32914a966b6db3c1f2296e2cca2d032ce885f4c572f1
MD5 7a55bf95817abec74f493b0e569d9a64
SHA1 162df1be3ffb2e2f490d35718117053420dc7479
SHA512 41f69b46455d6002f52e4f9c49a8cc6e28ee7a0e07bf8fd3c59441fd5b437d6546d0002a171c1a9b6b11f916afb0f39f0a9407ada949a046870ea4d00d3d4818
SSDEEP 6144:5flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:5flfAsiVGjSGecvX
TLSH
T183747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxvsnkica.sys

Path C:\Temp\fcxvsnkica.sys
Size 293KB
SHA256 db7a01ad3c4dd812001df005c79fb4d6b349b9d27f64823b0be65f3c4276c693
MD5 9803e739b7f0e2c3f083e25e778bcf59
SHA1 58917b92eb57e4f7a6bc70b19e2f1ca2cbac6318
SHA512 7b4236c9b9fc23422e35392b6f3c310065fe812c987f005a7a645c3f5580a41f04e56a169d9fd03ffee581bcc444f2847fa44f10acfec7e34a6f22c33e5c2219
SSDEEP 3072:ctKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:cIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fcauspkica.exe

Path C:\Temp\i_fcauspkica.exe
Size 361KB
SHA256 47492739aabc0304a05b9c443b928c5502e76b890f87cf3b4bb3e2d91929d5a9
MD5 ee4002efcd92a76bf0c4b4a5736e2fd8
SHA1 1140117b529848f05a943acb7095b76758a38b30
SHA512 5304e508a24e958252736f7d28225ba9702ec456364f60b5f789128b3a9081d8bc02216b41238417d39f88814e16f9006918acc226e9c23200b90243afdfcf5c
SSDEEP 6144:WflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:WflfAsiVGjSGecvX
TLSH
T16B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ifaysqkida.exe

Path C:\Temp\i_ifaysqkida.exe
Size 361KB
SHA256 f105c228dccc9a8d412218730853857641ba31e14314804f18f465443dac0213
MD5 a34629cd9ab5b3d13819a6e58f720fbb
SHA1 02d7d4ad0f493ef11e50b9d820aebf0b117003fb
SHA512 c7dccc6e91ccfed7fbf3f3a54ed5d22969c014585d69dff7de5893df78f5d6f2afbe37b442384148d04677e91122fb01ff13d334088a41f4aeb76451d820ef87
SSDEEP 6144:jflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:jflfAsiVGjSGecvX
TLSH
T194747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgdbvtnlfd.exe

Path C:\Temp\i_lgdbvtnlfd.exe
Size 361KB
SHA256 509fdfb419e60a0f9141f004b9f77c646c53f7e7b9385fef878fef0664a99db2
MD5 48c9460967a328b0dd42fe54ba4e136b
SHA1 016c9116874348ef574d4ed1d3201dfaccd0411f
SHA512 bd8cf35b87742dea4f971fc852312a01c60996a7cccaf1311e2db2bf10d2a10d62882c753124453f048a9bc77291fac3cc72def94370d46b79eaa415f5018938
SSDEEP 6144:qflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:qflfAsiVGjSGecvX
TLSH
T1ED747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_roigebwtoj.exe

Path C:\Temp\i_roigebwtoj.exe
Size 361KB
SHA256 f1e6757be3902b519caf4fd2cf9af0a001d54c54c74a4bf3fd70656c1cfd9385
MD5 fb442b878ddfb82edd5bf100a920297c
SHA1 d54fd82782b9971fd93b5295e20eb58b989d9457
SHA512 e17c9bbfac3d752452ef9be3d97b3a1a325005541f3439ce3fe056880f731d781af9c1e984bd1be06c77e75463795ee85095cbae1992259ec039b41e839aa8e8
SSDEEP 6144:WflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:WflfAsiVGjSGecvX
TLSH
T1F0747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnlfdyvqni.exe

Path C:\Temp\i_tnlfdyvqni.exe
Size 361KB
SHA256 eb463c1c668b23d00d64977dab29c893e538ce9039118d3c462a131e8061c9ce
MD5 363150b6434d6db72b3c0d0c8322c646
SHA1 63244039225c734cd15803d2054735656d6df393
SHA512 6401f55b19dff78b6849b61d238ef6d4f3b56e92cd898d96b6c37667b4ab84e7481dbea66a71f1d0b13ade26ed635423f484062930258592e91f70ca2db4503c
SSDEEP 6144:kflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:kflfAsiVGjSGecvX
TLSH
T144747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaysqkida.exe

Path C:\Temp\ifaysqkida.exe
Size 361KB
SHA256 970389020210a5b9ff79b61d7aef12807f20dd9ff9ac001e4500366b4c72a40d
MD5 06177831c38c7729269d3ae3d0874a90
SHA1 dfb70d61742b393484c0ef999c5922e303a5dcd6
SHA512 c4eeea673b9e82434b8e123e9f0a9620a6d6bbf2094439e598654dbd2d94909817039eac5f775667b4d63b4c38355d8050d2b427378fb7ff7c84ec1d5eff41f5
SSDEEP 6144:/flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:/flfAsiVGjSGecvX
TLSH
T1D7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbytqomjdbwtolg.exe

Path C:\Temp\jgbytqomjdbwtolg.exe
Size 361KB
SHA256 1ae7ca9d7386cd81aee91b0d6127e7e2cdfd17e66f1a14389a23b52c431b565d
MD5 034a56169025219ee6d0127fdf2b573f
SHA1 5a824a9b1a0b9aa308c176d0830dbeacd51a1261
SHA512 f58d93afe0d297f9b2be997e118cc179a412a4732b9f97e47996f7b5fc2c497184b73fb0f4c90a4c31c31e225124921e01a7473f9d0cd67033cd1c8cbb526f4a
SSDEEP 6144:5flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:5flfAsiVGjSGecvX
TLSH
T132747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbytqomjdbwtolg.sys

Path C:\Temp\jgbytqomjdbwtolg.sys
Size 293KB
SHA256 1034fc69673544d9e01d6ec1a59f87c849995e2dc7e1353beb4bdbd4d408cbd4
MD5 df74c9c85b5f624c9187fe1ae7af221e
SHA1 34a714a97659d537f15a88995605e0eaf757570c
SHA512 9063b429e6e30035c3d511ef3b81d4d19069efb4155121b5e74d8af2688c7550fbfcbabeebb247946c7c3b16dc257632348d7ebe65a6b91434f1d84e22449ec4
SSDEEP 3072:QtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:QIJjiJcbI03GBc3ucY5DCSj
TLSH
T189545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvpnifd.sys

Path C:\Temp\lfdxvpnifd.sys
Size 293KB
SHA256 58f5270aeeb099cb300f5a5f97f615fc212e34602357cfed4357794599becccf
MD5 ef742ab6e0dbb6624fb659326413587a
SHA1 50b2058e85e5413e8018e385100a0f3afaa4f2f0
SHA512 5a97340fd1134cdc60b56565e259e2dd0aa1a44f1a9ec3111c41a1fd25570ab386fe4a67d786aaa10c9762636b0ef1ef405a9bd35ffc96943abc97d63cdc56e8
SSDEEP 3072:+tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:+IJjiJcbI03GBc3ucY5DCSj
TLSH
T17D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdbvtnlfd.exe

Path C:\Temp\lgdbvtnlfd.exe
Size 361KB
SHA256 8e3a8d089a7091b8cf0d33476b8bdac381608cd68b4d279a9a9a992cfdc389a4
MD5 5f8c3e39cb34aa2b38522cf556231e65
SHA1 8b78954a08708e8927ed84ab7b4f15cc8fd4378d
SHA512 d8e1e59115ffb31d24840d4a90996e18af219c4a441f715ddf5f7171a170b898fe4b8b0712aeaa39c83cdf3db658567ddcd1256995f9282c35b3bbd5bf7d5f30
SSDEEP 6144:tflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:tflfAsiVGjSGecvX
TLSH
T167747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

roigebwtoj.exe

Path C:\Temp\roigebwtoj.exe
Size 361KB
SHA256 64abd8c5bbb32b77ed2ded6b3f064c6597aaec80cffb96b52a6c6e6ec0a5d55f
MD5 2ae4055f624050aecdf1842a2a7de2ac
SHA1 485c40f23f4f9c64cec94e747eb84b107c984bfc
SHA512 6ae318b682fb938420c98948c3f52b2619f26c681aff120662e3451f8e01d6b103de4df80a25fc86a8fbad1370cfb4bbb323e44fbd383a5f644bbff72e6ceae0
SSDEEP 6144:nflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:nflfAsiVGjSGecvX
TLSH
T151747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdyvqni.exe

Path C:\Temp\tnlfdyvqni.exe
Size 361KB
SHA256 987a96416c27161382f7f4c32056176161db63d8969e5f535c7a573170c2ba12
MD5 1a326b0b497438e827435ef83642b113
SHA1 ca1703a6b3ee70a689ec19423e6f1690de4e2011
SHA512 6033855a97867b4c2fce304a80d00d236efff57ea778660a290076a3d219311d27ba8612bf7ee564a52e6a4fc477b6cce47d69ba71b34273fc88fcae11a0812d
SSDEEP 6144:5flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:5flfAsiVGjSGecvX
TLSH
T10C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbvtnl.sys

Path C:\Temp\trljdbvtnl.sys
Size 293KB
SHA256 6ac057d3cf8721fc8bfbee5b801b825703acb84b3220d2a94f3c3d60fc57d32e
MD5 bd578362c66ee5e0d7c7c9297b0ceba4
SHA1 6b1fd3daf12108cc5ae9d279e9f1d1c5954c05c0
SHA512 be7735b3c74c8b6da7f68003e4afbcec459b9ef3c986f38144dc37d9fe1adc222cfcc16fb49eb1d2b797a4b2be3f0e8b9f95fca2f9f40cd43c1027912f91548a
SSDEEP 3072:ztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:zIJjiJcbI03GBc3ucY5DCSj
TLSH
T111545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xupmhfzxrp.exe

Path C:\Temp\xupmhfzxrp.exe
Size 361KB
SHA256 e14c8fba6ca016fa99af28108357e0d2025ab29f8e63bba58b13c0c334d8534f
MD5 ee42a1f8c1b5af217b03c06473d6e9fb
SHA1 e7c6f84c9a129b4bb9fdb0fd3b71e1c474d5ced8
SHA512 059033fdd3f56bb5b1543249a3a330da667372ab3be08789a30137de014c557f81c520b116332ec9d7463c4fba8121a8fef93155b5cab38f7f3c16789ce623af
SSDEEP 6144:1flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:1flfAsiVGjSGecvX
TLSH
T1B4747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxupmkhfzx.sys

Path C:\Temp\zxupmkhfzx.sys
Size 293KB
SHA256 caf695506f8271970a59126b5fdca37056dcd794818682080d27608f22b55f1c
MD5 4fd9f6a3c39edd32810a36dfdcf86063
SHA1 e9bddcb02a6cc4eec3c2fafe6fedbcd2fd1cfddc
SHA512 6412a73c1d8eda5bccb93decf5c3285d06abf41efdb52a9b8064c6e844df9e929a20b04d8e19ec0d7efe25475b14eec4481f46ca370be81dc057a8a47bc85f5d
SSDEEP 3072:0tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:0IJjiJcbI03GBc3ucY5DCSj
TLSH
T179545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a9696bf68cbbc4feb15b67641e972cb665762993a95f590e0e4cf851b16c07a8
MD5 bba69b76d22463a4c669d2bf90a68a51
SHA1 4e92ae1b106dbd1b4268daccf17747d7c1e64b72
SHA512 6b1e9c7e8cf6c3eee6d90fdb779b0039c3cab21acda2308345d50334131c4d77d6f97a3e2cc5c1331c22469ea4d8c223ff915b5437ac0571e7903369ab9e2e8a
TLSH
T12B5151612B2D29E3D7B641B370E5195A36FFC44942AF1E20A0D45D745D22F0F9CE3867
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b462.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b462.TMP
Size 2KB
SHA256 b65c99327c24286dbed9851ca3fefbfb8f6bc3715d8033eb782c13a9330562dd
MD5 b6e0b967052b01b4f97815ce12d628d7
SHA1 6f0db8dc3fa724596b5b2e95be3109120fa619f2
SHA512 89bc26f083892fb12fefc3fd443a882e0bfcec13d88f180c7134527078bd891def90cc21ecf86f0ed3fd5e31322897a028883f4c72a2e00130efe2c143ac5129
TLSH
T1CA5162612B2D29E3D7B6407370E5195936FFC44942AF1E20A0D45D745E22F0FACE3867
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 06c73a2d598ea2fbb1817d411f62260fd9cdab1e15124142a64783208afd8530
MD5 5d3cbc4c328f86fb122d64e659ac20c6
SHA1 3059f552ee577b0658d82c0abe3afbee92c5965f
SHA512 05847119717164b6964adb3a34920ea9f9688f4c093438ca809830a0c576df125bf0af7be484a2a01ff1c1d292b71edce168238316ca7ca1d0a2db47c0629fc9
TLSH
T179417FF383F4956EC90156F0AB146E2FCE2D0515432C7D5AC9E4AE2793E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7a58b1edb4a1832b1a6b1af7a6c3aaa60b78399f9e2af7ac235bd040eada7a0e
MD5 742cb9d3a8784537b7703d888e527f54
SHA1 3f1d9606b655af0ce0c6810d0697d5a4bf5fa36f
SHA512 d7d61dcfb8692e90bff75e3620f996ab68f029739ff709e5f46c6ef0b0c1c35ba7ab956185090b3f77e29e64233059708eb50f333c6fdee5c72bc3eb7efed289
SSDEEP 192:sxRkRJCu/f4sN5Tb61DZmzoA8p9Vy/g6+WNCVIC/YoduCYUGnIgVPJ:sxRk2u/f4sN5Tb61tbry/56t/Ho/
TLSH
T11D42C7156E28A93B5CC7E21DFB25BF53D6F96036A1D12E48BBFC861C04E66DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 571ed2cb09b1b518eda0ae1b1d0dd01480e8fb634fd72f5176a3cb6625ad3713
MD5 7eb18aa69d03295912c0dbe927e62616
SHA1 7426530461a63be06795258d4b30dbc7a84549eb
SHA512 9b65d81841e0f0a5c57229601325bc787de818bbd7eeb72d3c6e9ec09578f09e49d7fd83a94314c99763b63c3365d47750463a7591c3135eba4e905f081c2163
SSDEEP 192:sxRfRJCu/f4sX5Tb61DZmzoA8p9Vy/g6+WNCVIC/YoduCYUGnIgDmPJ:sxRf2u/f4sX5Tb61tbry/56t/Hoi
TLSH
T11E42C6156E28A93B5CC7E21DFB65BF53D7F96032A1D12E48ABFC861C04E66CD221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c8cd012c1884c35c555e9fcd8d2954c17503ed32522ed2f2bf0068740f930294
MD5 c47ad335d6e063da73653cac30a23529
SHA1 1b8c14b668825801db44d890b6a8e861940e34f9
SHA512 39d048d41fb53071ab26af71db57fcf0a173eb9dd5d8011269a838d9a76a426498cee4807c90cc8449c8c1dbf0ecf7e6812ec361e98a3271432c31a48cdbe778
SSDEEP 192:sxRfRJCu/f4sX5TbP1DZmzoA8p9Vy/g6+WNCVIC/YoiZYCYUGnIgDcPJ:sxRf2u/f4sX5TbP1tbry/56t/iRoI
TLSH
T12A42B615AE28A93B5CD7F219FB557F53E7F96032A1912E48ABFC861C00E76CD221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 4c0781cdd2d4fb69ccae57c2a7419c0f10b8aeb428709b1fb4009f06d612552c
MD5 3e128c04b7f4345862bbe15c6b5761be
SHA1 00e1af4c28029964f45634b9fb3fbc70a74d4519
SHA512 2b13536da4997bfd96910164ef98499ed0d20e195b1f71e6f56eeecb6b2b976659dc108c33d3f97afd8c929ab53234dde38e642ec595213095a78d66cbd0b8ca
SSDEEP 768:j26Hpo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVKcBVuwero95e0N:j26HpUE7MRWgs2f02u1jaRcB4w1Yq
TLSH
T124D2DB7B740DCABE4F804ADDEC197E9F6D6802CB9698CD8447FE841C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f0f4c54f-54c2-4a0c-ab7b-54491c61f2fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f0f4c54f-54c2-4a0c-ab7b-54491c61f2fd.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1e7e2755b2ec6cddd6979726bd61262d1d3a97c80b462920b7595ce2b0401af6
MD5 33a2a3991aa03065a08066458b24a7b4
SHA1 052aab495f17a873a10b51888a88d7e7ae870aab
SHA512 e00ec39d47bd0348e2d53989e7e03162efc5140d6f3f28ee0488e046ec79f89194e1c11e2770c765792c0871d1281e54fc90f381662ee6aae8525883da6c3dcb
SSDEEP 768:oAe3a0fz/TBOWT1a5sONXyer1IRCzni9jPi9PKA:oAe3xrj6sSIqnIP6
TLSH
T1BAF2BE30E5A9DE235CE6F3C6F5462383AEF82067E5C44A94E9E99F0E05D355E130B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 33829e8a294fee9679654416a3cbcb1fd604b7d32bc3a8df66601e7507f0a18a
MD5 cde4e006b9f1004ea0d029063deeccfe
SHA1 b7fc1030fcdcb28d2110c619dfd22b324b76ea83
SHA512 5df0d04933bc66a0ae24c1d38433a434557a07712fe014ee07a923c02b1380f2162c55c67945f6e50169e701e79a45597db7402ab68cabc94aba6e67c6b1e086
SSDEEP 768:VaFQG3iwgy0JExsOWT1a5WONXyer1IRCzni9jPi9PKA:VBG3Cya6WSIqnIP6
TLSH
T1B91328F594D78A37D8AE9783A37D2E469EBCD063B4845594BBD94E0DCC8217FC30A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 abe3850155369a61b8b48ba6a64216d917eeac4ac9cce217c9b0740b534bcc7b
MD5 61aa0fdb880f04547592be1402da2f64
SHA1 b2e45a518db780e7a0a2e422d595b009384f231f
SHA512 de015f38ac0256a2d8e45a551e95d365138e888509ab7428fdb5f29a5d358dd04ec33a20081a99d1efa57ace3d2dd75ac5023f1f9ce5c808f03f26bd4729786e
SSDEEP 768:hrv+4UNbdz3gt/TBOWT1jONXyer1IRCzniB+eVH1SK7:hbsbV3KjjSIqnVEH1l
TLSH
T1A803BF36A4A89E338CE2A3C5B04776437FB86057D6840790EDDE2F4E06AB59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 37a370959bf7a86db03b7177d142c9892f00e8a4a87808e72a3160fdadcb544d
MD5 fbde69bc69fcc521043ea31cff454f03
SHA1 ed5fed10cff8005f7d16af15f43f1c125a828584
SHA512 6ea102c8aef4b981da81acad8de34d1762ffa5b97c97a45d7038ac2e30894ff3ed5f11da2df306d81cc700b57a42c03103760b9aeccbd7665304b4c9ca8189f7
SSDEEP 768:tAe3/0Iz/TBOWT1a5sONXyer1IRCzni9jPi9PKA:tAe3skj6sSIqnIP6
TLSH
T1D9F2BE70E569DE235CE6F3C6F1462383AFF82067E5C40A94E9E99F0E059355E130B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 2255e8f6365ecd032187d0fceba460aad707dd39b99ddf5991b1ddc14306876c
MD5 96f99b66d335fbb873a294acc8f58854
SHA1 79152e157caefbc894948b5a08df550036cd0e62
SHA512 6d9eae73a955273837cf2c417ec85d16943a2f7ff6cfcf7cdbea6c6386af263a3534c33187c1ae80865b0ce61fb9f1809784d1f7e193cbda2ac5319d48c185fd
SSDEEP 768:aGrv+4UNbdz31yB/TBOWT1a5zONXyer1IRCzniwjeVH1SK7:aGbsbV31Ij6zSIqnfEH1l
TLSH
T13D03BF31E568DE334DE6A3D5B04762877FB8206BC9810B90E9DA1F8E059759E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

473b3244-67f6-4e14-9989-5ff0c0b06bdf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\473b3244-67f6-4e14-9989-5ff0c0b06bdf.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3360_345786137\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 20a51afd463483aa40b1a8f10fca4b373e0aa046f4668bcefd5eb9f22be9f85d
MD5 16860877a151efd4655658f03dd95c4a
SHA1 1724785b728a482bdf8ed117ad2282d752745543
SHA512 c3dcbf6faf54bad57ea424f6386cf37a4b6b81213166a224fe476a9c3dee115fea5f8e87c2740771988a3113aeaf2f2273e51739739bc6399ca0c60bc1a2df5a
TLSH
T1C071008356A9D5B3C1DA5BF102835644F6BB22380B2370240BA15946AB30A7A64B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/256-337-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1268-422-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1932-458-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2040-288-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2040-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2320-313-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2340-366-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2520-398-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2544-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2556-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3676-438-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4760-479-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4948-276-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5100-264-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5328-410-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5332-236-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5448-386-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5448-462-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5744-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6004-189-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6096-433-0x0000000000010000-0x00000000000AB000-memory.dmp

Download