systex | c3f4dc28afcb0b543c7273a9670d0c8be2f30230d42f4d386cdb4e67e4fa6dcd

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 01:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260820-bg3qvaxdkh
SHA256 c3f4dc28afcb0b543c7273a9670d0c8be2f30230d42f4d386cdb4e67e4fa6dcd
MD5 8c388aff033d8fa8274cb0f8e3f6554c
SHA1 1a8ebf205aeb84c16cef20a865972b157225411c
SHA512 7e77200882f1f0c4ff3349e3decee02af28dc7bd36462e66bc04db37bbb948a76d00e86baecf00c27b91493a127dc295cffe3c9508c76e85e5b5f39b3d0e4dfc
SSDEEP 6144:yflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:yflfAsiVGjSGecvX
TLSH
T1C6747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5900	kecxupnhfzxrpkhc.exe
1028	kecxupnhfzxrpkhc.sys
4312	CreateProcess.exe
4424	nkfcxvmkfc.exe
4900	CreateProcess.exe
3580	CreateProcess.exe
2728	i_nkfcxvmkfc.exe
2084	xrpmhfzxrp.sys
1552	CreateProcess.exe
5948	omhezxrpjh.exe
5392	CreateProcess.exe
1304	CreateProcess.exe
4272	i_omhezxrpjh.exe
5636	jgezwuomke.sys
2468	CreateProcess.exe
5992	geczurpjge.exe
5640	CreateProcess.exe
796	CreateProcess.exe
3528	i_geczurpjge.exe
2692	ebwuomgezw.sys
1836	CreateProcess.exe
1188	trljdbzuom.exe
6068	CreateProcess.exe
4428	CreateProcess.exe
2496	i_trljdbzuom.exe
4880	tomjdbwtol.sys
1648	CreateProcess.exe
3392	ljdbvtqojg.exe
3892	CreateProcess.exe
1548	CreateProcess.exe
3112	i_ljdbvtqojg.exe
4408	gdywqolgdy.sys
2704	CreateProcess.exe
1292	dbvtnlfdyv.exe
1824	CreateProcess.exe
4552	CreateProcess.exe
3012	i_dbvtnlfdyv.exe
5332	vtnlfdyvqn.sys
2012	CreateProcess.exe
3960	qnlfdxvsqk.exe
5024	CreateProcess.exe
4400	CreateProcess.exe
4540	i_qnlfdxvsqk.exe
2388	caysqnlfdx.sys
3320	CreateProcess.exe
880	xvsnkfdxvp.exe
236	CreateProcess.exe
5400	CreateProcess.exe
3124	i_xvsnkfdxvp.exe
5924	icauspkica.sys
2688	CreateProcess.exe
4248	zxspkfcxup.exe
4752	CreateProcess.exe
4196	CreateProcess.exe
1488	i_zxspkfcxup.exe
2820	ausmkecxup.sys
2000	CreateProcess.exe
5284	smjhfzxupm.exe
2868	CreateProcess.exe
5404	CreateProcess.exe
3536	i_smjhfzxupm.exe
616	wuomhezxrp.sys
2776	CreateProcess.exe
1820	wuomhezxrp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecxupnhfzxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfcxvmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlfdxvsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomgeywqom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkigdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkigdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvsnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tomgeywqom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkicavsnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbzurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbzuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbzuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxspkfcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czurpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smjhfzxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbzurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlfdxvsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxspkfcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkicavsnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfcxvmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geczurpjge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smjhfzxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqcausnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geczurpjge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvsnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqcausnkfc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1212	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3216	ipconfig.exe
2824	ipconfig.exe
1940	ipconfig.exe
4288	ipconfig.exe
5748	ipconfig.exe
4280	ipconfig.exe
4800	ipconfig.exe
992	ipconfig.exe
3620	ipconfig.exe
1092	ipconfig.exe
964	ipconfig.exe
992	ipconfig.exe
1072	ipconfig.exe
6024	ipconfig.exe
3344	ipconfig.exe
1172	ipconfig.exe
5320	ipconfig.exe
3616	ipconfig.exe
5136	ipconfig.exe
1092	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316616802254640"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{071EA58E-9CB7-49F6-9450-87F89C485353}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	kecxupnhfzxrpkhc.exe
5900	kecxupnhfzxrpkhc.exe
5900	kecxupnhfzxrpkhc.exe
5900	kecxupnhfzxrpkhc.exe
5900	kecxupnhfzxrpkhc.exe
5900	kecxupnhfzxrpkhc.exe
5900	kecxupnhfzxrpkhc.exe
5900	kecxupnhfzxrpkhc.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5692	msedge.exe
5692	msedge.exe
5692	msedge.exe
5692	msedge.exe
5692	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2728	i_nkfcxvmkfc.exe
Token: SeDebugPrivilege	4272	i_omhezxrpjh.exe
Token: SeDebugPrivilege	3528	i_geczurpjge.exe
Token: SeDebugPrivilege	2496	i_trljdbzuom.exe
Token: SeDebugPrivilege	3112	i_ljdbvtqojg.exe
Token: SeDebugPrivilege	3012	i_dbvtnlfdyv.exe
Token: SeDebugPrivilege	4540	i_qnlfdxvsqk.exe
Token: SeDebugPrivilege	3124	i_xvsnkfdxvp.exe
Token: SeDebugPrivilege	1488	i_zxspkfcxup.exe
Token: SeDebugPrivilege	3536	i_smjhfzxupm.exe
Token: SeDebugPrivilege	3124	i_wuomhezxrp.exe
Token: SeDebugPrivilege	3272	i_rljhbztrlj.exe
Token: SeDebugPrivilege	4324	i_tomgeywqom.exe
Token: SeDebugPrivilege	3236	i_oigdbvtolg.exe
Token: SeDebugPrivilege	1640	i_qkigdbvtnl.exe
Token: SeDebugPrivilege	4952	i_sqcausnkfc.exe
Token: SeDebugPrivilege	3520	i_nkicavsnkf.exe
Token: SeDebugPrivilege	4688	i_czurpkhcau.exe
Token: SeDebugPrivilege	5944	i_rpjhbzurmk.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5692	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 5900	4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4596 wrote to memory of 944	4596	2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 944 wrote to memory of 5692	944	iexplore.exe	91
PID 5692 wrote to memory of 5904	5692	msedge.exe	92
PID 5692 wrote to memory of 1896	5692	msedge.exe	93
PID 5692 wrote to memory of 1212	5692	msedge.exe	95
PID 5692 wrote to memory of 1896	5692	msedge.exe	93
PID 5692 wrote to memory of 1896	5692	msedge.exe	93
PID 5692 wrote to memory of 1124	5692	msedge.exe	96
PID 5692 wrote to memory of 1124	5692	msedge.exe	96
PID 5692 wrote to memory of 2952	5692	msedge.exe	98
PID 5692 wrote to memory of 2952	5692	msedge.exe	98
PID 5692 wrote to memory of 2952	5692	msedge.exe	98
PID 5692 wrote to memory of 2728	5692	msedge.exe	120
PID 5692 wrote to memory of 2728	5692	msedge.exe	120
PID 5692 wrote to memory of 2728	5692	msedge.exe	120
PID 5692 wrote to memory of 1428	5692	msedge.exe	99
PID 5692 wrote to memory of 4280	5692	msedge.exe	100
PID 5692 wrote to memory of 1428	5692	msedge.exe	99
PID 5692 wrote to memory of 1428	5692	msedge.exe	99
PID 5692 wrote to memory of 4280	5692	msedge.exe	100
PID 5692 wrote to memory of 4280	5692	msedge.exe	100
PID 5692 wrote to memory of 5824	5692	msedge.exe	101
PID 5692 wrote to memory of 5824	5692	msedge.exe	101
PID 5692 wrote to memory of 1420	5692	msedge.exe	105
PID 5692 wrote to memory of 1420	5692	msedge.exe	105
PID 5692 wrote to memory of 3364	5692	msedge.exe	106
PID 5692 wrote to memory of 3364	5692	msedge.exe	106
PID 5692 wrote to memory of 3728	5692	msedge.exe	108
PID 5900 wrote to memory of 4312	5900	kecxupnhfzxrpkhc.exe	109
PID 4424 wrote to memory of 4900	4424	nkfcxvmkfc.exe	114
PID 5692 wrote to memory of 4288	5692	msedge.exe	117
PID 5692 wrote to memory of 4288	5692	msedge.exe	117
PID 5692 wrote to memory of 1580	5692	msedge.exe	118
PID 5692 wrote to memory of 1580	5692	msedge.exe	118
PID 5900 wrote to memory of 3580	5900	kecxupnhfzxrpkhc.exe	119
PID 5900 wrote to memory of 1552	5900	kecxupnhfzxrpkhc.exe	123
PID 5948 wrote to memory of 5392	5948	omhezxrpjh.exe	125
PID 5900 wrote to memory of 1304	5900	kecxupnhfzxrpkhc.exe	128
PID 5900 wrote to memory of 2468	5900	kecxupnhfzxrpkhc.exe	132
PID 5992 wrote to memory of 5640	5992	geczurpjge.exe	134
PID 5900 wrote to memory of 796	5900	kecxupnhfzxrpkhc.exe	137
PID 5900 wrote to memory of 1836	5900	kecxupnhfzxrpkhc.exe	142
PID 1188 wrote to memory of 6068	1188	trljdbzuom.exe	144
PID 5900 wrote to memory of 4428	5900	kecxupnhfzxrpkhc.exe	147
PID 5692 wrote to memory of 5328	5692	msedge.exe	149
PID 5692 wrote to memory of 5400	5692	msedge.exe	150
PID 5692 wrote to memory of 2424	5692	msedge.exe	151
PID 5900 wrote to memory of 1648	5900	kecxupnhfzxrpkhc.exe	154
PID 3392 wrote to memory of 3892	3392	ljdbvtqojg.exe	156
PID 5900 wrote to memory of 1548	5900	kecxupnhfzxrpkhc.exe	159
PID 5900 wrote to memory of 2704	5900	kecxupnhfzxrpkhc.exe	163
PID 1292 wrote to memory of 1824	1292	dbvtnlfdyv.exe	165
PID 5900 wrote to memory of 4552	5900	kecxupnhfzxrpkhc.exe	168
PID 5900 wrote to memory of 2012	5900	kecxupnhfzxrpkhc.exe	172
PID 3960 wrote to memory of 5024	3960	qnlfdxvsqk.exe	174
PID 5900 wrote to memory of 4400	5900	kecxupnhfzxrpkhc.exe	177
PID 5900 wrote to memory of 3320	5900	kecxupnhfzxrpkhc.exe	181
PID 880 wrote to memory of 236	880	xvsnkfdxvp.exe	183
PID 5900 wrote to memory of 5400	5900	kecxupnhfzxrpkhc.exe	186
PID 5692 wrote to memory of 5712	5692	msedge.exe	188
PID 5692 wrote to memory of 5712	5692	msedge.exe	188
PID 5900 wrote to memory of 2688	5900	kecxupnhfzxrpkhc.exe	194
PID 4248 wrote to memory of 4752	4248	zxspkfcxup.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_8c388aff033d8fa8274cb0f8e3f6554c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Temp\kecxupnhfzxrpkhc.exe
  C:\Temp\kecxupnhfzxrpkhc.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkfcxvmkfc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4312
  - - C:\Temp\nkfcxvmkfc.exe
      C:\Temp\nkfcxvmkfc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4424
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4900
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkfcxvmkfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3580
  - - C:\Temp\i_nkfcxvmkfc.exe
      C:\Temp\i_nkfcxvmkfc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omhezxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1552
  - - C:\Temp\omhezxrpjh.exe
      C:\Temp\omhezxrpjh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5948
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5392
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omhezxrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1304
  - - C:\Temp\i_omhezxrpjh.exe
      C:\Temp\i_omhezxrpjh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geczurpjge.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2468
  - - C:\Temp\geczurpjge.exe
      C:\Temp\geczurpjge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5992
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5640
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geczurpjge.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:796
  - - C:\Temp\i_geczurpjge.exe
      C:\Temp\i_geczurpjge.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljdbzuom.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1836
  - - C:\Temp\trljdbzuom.exe
      C:\Temp\trljdbzuom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1188
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljdbzuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4428
  - - C:\Temp\i_trljdbzuom.exe
      C:\Temp\i_trljdbzuom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbvtqojg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1648
  - - C:\Temp\ljdbvtqojg.exe
      C:\Temp\ljdbvtqojg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3392
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbvtqojg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1548
  - - C:\Temp\i_ljdbvtqojg.exe
      C:\Temp\i_ljdbvtqojg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtnlfdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2704
  - - C:\Temp\dbvtnlfdyv.exe
      C:\Temp\dbvtnlfdyv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1292
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1824
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtnlfdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4552
  - - C:\Temp\i_dbvtnlfdyv.exe
      C:\Temp\i_dbvtnlfdyv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3012
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnlfdxvsqk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2012
  - - C:\Temp\qnlfdxvsqk.exe
      C:\Temp\qnlfdxvsqk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5024
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnlfdxvsqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4400
  - - C:\Temp\i_qnlfdxvsqk.exe
      C:\Temp\i_qnlfdxvsqk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvsnkfdxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3320
  - - C:\Temp\xvsnkfdxvp.exe
      C:\Temp\xvsnkfdxvp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:880
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:236
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvsnkfdxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5400
  - - C:\Temp\i_xvsnkfdxvp.exe
      C:\Temp\i_xvsnkfdxvp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxspkfcxup.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2688
  - - C:\Temp\zxspkfcxup.exe
      C:\Temp\zxspkfcxup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4752
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxspkfcxup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4196
  - - C:\Temp\i_zxspkfcxup.exe
      C:\Temp\i_zxspkfcxup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smjhfzxupm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2000
  - - C:\Temp\smjhfzxupm.exe
      C:\Temp\smjhfzxupm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5284
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2868
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smjhfzxupm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5404
  - - C:\Temp\i_smjhfzxupm.exe
      C:\Temp\i_smjhfzxupm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomhezxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2776
  - - C:\Temp\wuomhezxrp.exe
      C:\Temp\wuomhezxrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1820
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1804
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomhezxrp.exe ups_ins
    3⤵
    PID:3860
  - - C:\Temp\i_wuomhezxrp.exe
      C:\Temp\i_wuomhezxrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljhbztrlj.exe ups_run
    3⤵
    PID:4408
  - - C:\Temp\rljhbztrlj.exe
      C:\Temp\rljhbztrlj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4592
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljhbztrlj.exe ups_ins
    3⤵
    PID:4276
  - - C:\Temp\i_rljhbztrlj.exe
      C:\Temp\i_rljhbztrlj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tomgeywqom.exe ups_run
    3⤵
    PID:5036
  - - C:\Temp\tomgeywqom.exe
      C:\Temp\tomgeywqom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5332
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5804
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tomgeywqom.exe ups_ins
    3⤵
    PID:4232
  - - C:\Temp\i_tomgeywqom.exe
      C:\Temp\i_tomgeywqom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigdbvtolg.exe ups_run
    3⤵
    PID:3684
  - - C:\Temp\oigdbvtolg.exe
      C:\Temp\oigdbvtolg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2636
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:928
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigdbvtolg.exe ups_ins
    3⤵
    PID:2112
  - - C:\Temp\i_oigdbvtolg.exe
      C:\Temp\i_oigdbvtolg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkigdbvtnl.exe ups_run
    3⤵
    PID:3532
  - - C:\Temp\qkigdbvtnl.exe
      C:\Temp\qkigdbvtnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2336
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5760
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkigdbvtnl.exe ups_ins
    3⤵
    PID:2080
  - - C:\Temp\i_qkigdbvtnl.exe
      C:\Temp\i_qkigdbvtnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqcausnkfc.exe ups_run
    3⤵
    PID:5208
  - - C:\Temp\sqcausnkfc.exe
      C:\Temp\sqcausnkfc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3012
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqcausnkfc.exe ups_ins
    3⤵
    PID:2616
  - - C:\Temp\i_sqcausnkfc.exe
      C:\Temp\i_sqcausnkfc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkicavsnkf.exe ups_run
    3⤵
    PID:1312
  - - C:\Temp\nkicavsnkf.exe
      C:\Temp\nkicavsnkf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5180
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1520
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkicavsnkf.exe ups_ins
    3⤵
    PID:5164
  - - C:\Temp\i_nkicavsnkf.exe
      C:\Temp\i_nkicavsnkf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czurpkhcau.exe ups_run
    3⤵
    PID:1364
  - - C:\Temp\czurpkhcau.exe
      C:\Temp\czurpkhcau.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1084
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5788
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czurpkhcau.exe ups_ins
    3⤵
    PID:5684
  - - C:\Temp\i_czurpkhcau.exe
      C:\Temp\i_czurpkhcau.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhbzurmk.exe ups_run
    3⤵
    PID:1200
  - - C:\Temp\rpjhbzurmk.exe
      C:\Temp\rpjhbzurmk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2724
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhbzurmk.exe ups_ins
    3⤵
    PID:3524
  - - C:\Temp\i_rpjhbzurmk.exe
      C:\Temp\i_rpjhbzurmk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjwuomgeyw.exe ups_run
    3⤵
    PID:2040
  - - C:\Temp\mjwuomgeyw.exe
      C:\Temp\mjwuomgeyw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6112
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2824
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ff8a152c188,0x7ff8a152c194,0x7ff8a152c1a0
      4⤵
      PID:5904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,15451969995335408585,17945199575459130227,262144 --field-trial-handle=2416,i,17180647168303655239,13985508502120750723,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:2
      4⤵
      PID:1896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,3051496064607608050,12265168647546572279,524288 --field-trial-handle=2416,i,17180647168303655239,13985508502120750723,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:11
      4⤵
      System Time Discovery
      PID:1212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,13269926366444126839,296870499785011847,524288 --field-trial-handle=2416,i,17180647168303655239,13985508502120750723,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:13
      4⤵
      PID:1124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,1338349370832183692,2261833005475286780,2097152 --field-trial-handle=2416,i,17180647168303655239,13985508502120750723,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:2728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,10757800519922392187,1425268738826225087,2097152 --field-trial-handle=2416,i,17180647168303655239,13985508502120750723,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:2952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,16863876881757599365,3141556438246615282,2097152 --field-trial-handle=2416,i,17180647168303655239,13985508502120750723,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
      4⤵
      PID:1428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,13189753195348929387,11669199172838726306,2097152 --field-trial-handle=2416,i,17180647168303655239,13985508502120750723,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:9
      4⤵
      PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3848,i,2167110114757699799,9257160699463826064,524288 --field-trial-handle=2416,i,17180647168303655239,13985508502120750723,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:14
      4⤵
      PID:5824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,13308527816952030773,6777558999687539339,524288 --field-trial-handle=2416,i,17180647168303655239,13985508502120750723,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
      4⤵
      PID:1420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,11398325081762048405,17991375342487444214,524288 --field-trial-handle=2416,i,17180647168303655239,13985508502120750723,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
      4⤵
      PID:3364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,529929148531523537,1815586995968987405,524288 --field-trial-handle=2416,i,17180647168303655239,13985508502120750723,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
      4⤵
      PID:4876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,529929148531523537,1815586995968987405,524288 --field-trial-handle=2416,i,17180647168303655239,13985508502120750723,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
      4⤵
      PID:3728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,16185246469355172121,13427038117459933531,524288 --field-trial-handle=2416,i,17180647168303655239,13985508502120750723,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
      4⤵
      PID:4288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,13121167684246776376,12348882680917588112,524288 --field-trial-handle=2416,i,17180647168303655239,13985508502120750723,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
      4⤵
      PID:1580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,5083202823884029283,1987779470084732867,524288 --field-trial-handle=2416,i,17180647168303655239,13985508502120750723,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
      4⤵
      PID:5328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,2151729816903278164,9611514875113792426,524288 --field-trial-handle=2416,i,17180647168303655239,13985508502120750723,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
      4⤵
      PID:5400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,8613884935651708515,2398837979623671366,524288 --field-trial-handle=2416,i,17180647168303655239,13985508502120750723,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
      4⤵
      PID:2424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,7217872641668478150,5868978796892637024,524288 --field-trial-handle=2416,i,17180647168303655239,13985508502120750723,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:14
      4⤵
      PID:5712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6204,i,15861962738982019016,3517708803358849701,262144 --field-trial-handle=2416,i,17180647168303655239,13985508502120750723,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:10
      4⤵
      PID:1748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1328

C:\Temp\kecxupnhfzxrpkhc.sys
C:\Temp\kecxupnhfzxrpkhc.sys
1⤵
- Executes dropped EXE
PID:1028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2068

C:\Temp\xrpmhfzxrp.sys
C:\Temp\xrpmhfzxrp.sys
1⤵
- Executes dropped EXE
PID:2084

C:\Temp\jgezwuomke.sys
C:\Temp\jgezwuomke.sys
1⤵
- Executes dropped EXE
PID:5636

C:\Temp\ebwuomgezw.sys
C:\Temp\ebwuomgezw.sys
1⤵
- Executes dropped EXE
PID:2692

C:\Temp\tomjdbwtol.sys
C:\Temp\tomjdbwtol.sys
1⤵
- Executes dropped EXE
PID:4880

C:\Temp\gdywqolgdy.sys
C:\Temp\gdywqolgdy.sys
1⤵
- Executes dropped EXE
PID:4408

C:\Temp\vtnlfdyvqn.sys
C:\Temp\vtnlfdyvqn.sys
1⤵
- Executes dropped EXE
PID:5332

C:\Temp\caysqnlfdx.sys
C:\Temp\caysqnlfdx.sys
1⤵
- Executes dropped EXE
PID:2388

C:\Temp\icauspkica.sys
C:\Temp\icauspkica.sys
1⤵
- Executes dropped EXE
PID:5924

C:\Temp\ausmkecxup.sys
C:\Temp\ausmkecxup.sys
1⤵
- Executes dropped EXE
PID:2820

C:\Temp\wuomhezxrp.sys
C:\Temp\wuomhezxrp.sys
1⤵
- Executes dropped EXE
PID:616

C:\Temp\bzurmjhbzw.sys
C:\Temp\bzurmjhbzw.sys
1⤵
PID:5844

C:\Temp\tqomgebwuo.sys
C:\Temp\tqomgebwuo.sys
1⤵
PID:4844

C:\Temp\tqljdbvtnl.sys
C:\Temp\tqljdbvtnl.sys
1⤵
PID:1076

C:\Temp\yoigdbvtnl.sys
C:\Temp\yoigdbvtnl.sys
1⤵
PID:3336

C:\Temp\ysqkidavsn.sys
C:\Temp\ysqkidavsn.sys
1⤵
PID:2040

C:\Temp\qkifdxvsnk.sys
C:\Temp\qkifdxvsnk.sys
1⤵
PID:3100

C:\Temp\hcausmkecx.sys
C:\Temp\hcausmkecx.sys
1⤵
PID:1652

C:\Temp\fzxjhfcxuo.sys
C:\Temp\fzxjhfcxuo.sys
1⤵
PID:3436

C:\Temp\pmhecwupmh.sys
C:\Temp\pmhecwupmh.sys
1⤵
PID:2820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dbvtnlfdyv.exe

Path C:\Temp\dbvtnlfdyv.exe
Size 361KB
SHA256 23fb9d0af73bf2a175ecca12642451f41000aa3a7dc34220a0e7c246b76bf904
MD5 b771529295554f71b7593f22176192bd
SHA1 e875db5c462cd00def313b9dbfd7cb3c7f10e002
SHA512 3c66f0c7e00d5df5fd8ddc3963e41bf4b4871c5e81554fc66ba89a4e68eef71c4446a475c4ddfc91f7fa2c72476c3ea142c41564a58ec512a8219f9b2f62026d
SSDEEP 6144:vflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:vflfAsiVGjSGecvX
TLSH
T1D3747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwuomgezw.sys

Path C:\Temp\ebwuomgezw.sys
Size 293KB
SHA256 3d1deb0e3917731231cd8dc1589ddc304511e41abca293fb4d0a20bfa19d4b54
MD5 718f40cbd18f2f396a6e5e34feeb4b27
SHA1 4bdbd9047a170e27daf15cdfb1550c69167afe3c
SHA512 4266f4619e0c2120906130dc4b6fdf0ed5613158429c130c86fd3f0ed5c2649b3bc716d5f5b67a8b86fbb86de42b210e6bedf21b4ccc0cd1682da7b6be86d232
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdB:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdywqolgdy.sys

Path C:\Temp\gdywqolgdy.sys
Size 293KB
SHA256 5a334ca7bff065fbd5064bd62c6a3a33804ead8124efef181afc3e1c50a4514a
MD5 27cb6548cd1146f51b94751a0fc4c9ec
SHA1 8c9613dabc0fd5786fdaf279b42beffdc95ad94e
SHA512 65f7a37e97ba76bded8e8e33d69d6bf5ad93e3523b3210eb21d8414473e75346e8f89a0cf7da3d411fc2d3084f40d03e5489fd60b4400c67222f162855f3791e
SSDEEP 3072:ttKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:tIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geczurpjge.exe

Path C:\Temp\geczurpjge.exe
Size 361KB
SHA256 620c6f6ea19b4eb243545f5b72185d70f42118fa1e9b54214ffcc6fdf6de2a21
MD5 db73077e1cfa0391a8a897dc3fa182ea
SHA1 45bae2adf471ac3a864fdb9c22ce59734474a0a3
SHA512 b8aae5c6ee4696dade1851017964de9ce7ab66dae4675165f8662c9a81c4617455741a95a778a41eec0fb62dde8ebe99efb9e5c5113780551dc94bb343671dae
SSDEEP 6144:CflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:CflfAsiVGjSGecvX
TLSH
T1BC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geczurpjge.exe

Path C:\Temp\i_geczurpjge.exe
Size 361KB
SHA256 697dcdb740c9468348b3c49c17b85f21fc784a58135943ee3440889ae2bb3b5f
MD5 695fcccb444c7a4825a364c05a0e689a
SHA1 dfa3439c5c770e5253203f5b9341ced62aa588be
SHA512 6fc06062bcf81bb15bad0d022cfdb2953d764d17d8ca588f2e85c092631fd02de6288b5995b67d376bccc3288d3622ecc238ac5dece797531e2940238a30591b
SSDEEP 6144:6flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:6flfAsiVGjSGecvX
TLSH
T126747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljdbvtqojg.exe

Path C:\Temp\i_ljdbvtqojg.exe
Size 361KB
SHA256 35df5d5f70ba0505fee9f6f60d2d4eb668b3edfae5839639ba0de6540c2658d7
MD5 a184ec50ad4b097e0984581de71d8008
SHA1 e4721787b547c7da32a8901658ed605086a49d23
SHA512 e36c5e04875badc42474bf0a7f8e14aa3427f59b2dfc5e83f745753fd39339369f7969574dc9aabc06f817df3801b34479d35659929daf4ea09cd070236d66d2
SSDEEP 6144:8flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:8flfAsiVGjSGecvX
TLSH
T1E7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nkfcxvmkfc.exe

Path C:\Temp\i_nkfcxvmkfc.exe
Size 361KB
SHA256 90394d714561805546d1f6395122a377adafd2212de8c064bb0b71cc694132d6
MD5 0bcb20c0fc1c5807328943ee4a7b4d14
SHA1 ff7402f886d20a4b2ca969b6a0c53ca87b17dd20
SHA512 f774e4f2433f5934b8ecc247e9636b635677cb50f717508dd941d434569f7d287b885b207fbb556fa8272519735ba1763880ee378885701f28a9bf9189bf2b14
SSDEEP 6144:2flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:2flfAsiVGjSGecvX
TLSH
T1DD747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omhezxrpjh.exe

Path C:\Temp\i_omhezxrpjh.exe
Size 361KB
SHA256 6511e25e750b2ef154812177d96e3191f76c741bf687b833ebb4eef95672d8db
MD5 2658a5d25f8de4c1ffa1605346787210
SHA1 33098ee88fe810ddbd971b825e43c7a98c860c0a
SHA512 87df11a7446f7d3a57b1625fe766c1c94f8d2efcaf7b774110edf99226fe6307208665cab9b8d92799d99b8bf4abb9705c1ee96ce387cd19f0e6a9e70620b33d
SSDEEP 6144:bflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:bflfAsiVGjSGecvX
TLSH
T192747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trljdbzuom.exe

Path C:\Temp\i_trljdbzuom.exe
Size 361KB
SHA256 0e9c6129a92aae0afe7e2a96ddb60a980b1539f58a7814e343e62fc600adae91
MD5 81d8fc4bab2e39e93a11f8e921c5212c
SHA1 3f73fde9c31023a4c08f460c4fdfd133d0c92310
SHA512 54b42a35ddd56e5fa7aa5c88ed2448e329c81dba2aedf3a9e23c5452c6959c8d338e2768b4b955ef157723a89847a71e0a492ec75eefe1b1197b43a3d6a6568b
SSDEEP 6144:fflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:fflfAsiVGjSGecvX
TLSH
T19E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgezwuomke.sys

Path C:\Temp\jgezwuomke.sys
Size 293KB
SHA256 3feb6eb7790397e47d2307b567c4ff538e68806655f9bbaddbb4479bc0fbe354
MD5 31f0e41bb242ffc892e2730be9703aec
SHA1 b43035a52739412207c285883049bc9e95f4173d
SHA512 a626380d48d6e8df298a1601a107974deae6178bf41f9b09c9ee3255b059ce24a0e50d3d869171faca2766e4839e095f6f755e59213a964be3369bdc10926697
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecxupnhfzxrpkhc.exe

Path C:\Temp\kecxupnhfzxrpkhc.exe
Size 361KB
SHA256 e4aeee3b145a71397c75c61470579e0a54d361254bf4328b49b01c0d9719c32d
MD5 338a1f733ba515c5faf1af73c382be25
SHA1 85400f1225313b7d69dfd72686da851d26c7b374
SHA512 3f97cad04431c4b1882c66f4e6923376874dc634e2b270e45d90b94494abf236b41286ed3c86923eae336eb9a69d17871605539d31e19e43d28241441ce987a7
SSDEEP 6144:yflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:yflfAsiVGjSGecvX
TLSH
T1DC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecxupnhfzxrpkhc.sys

Path C:\Temp\kecxupnhfzxrpkhc.sys
Size 293KB
SHA256 d9844b2b2e6e6de19d1e28f4346f21e8a68c89c4f8999b2be15f089831e2b1af
MD5 30e9341bec5572b3697fc56b17c1d530
SHA1 3bf41d44d97e7e03116dd9e34d98e419a40ecd5f
SHA512 0a28842270f5f41d1a1f7e2d62bd8829c5021c87d06304610d74566f158f3bced51fe747f3d5eeb711692a681886cf8bcca1ae448d338137a106d8313710547d
SSDEEP 3072:2tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:2IJjiJcbI03GBc3ucY5DCSj
TLSH
T188545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbvtqojg.exe

Path C:\Temp\ljdbvtqojg.exe
Size 361KB
SHA256 dad7eb67db7239c69b5c464f34580da9d260073cafecefc9218119d21629e040
MD5 a1a61a3d3582f7f16a2ea14205b4278b
SHA1 403f3f1ac86139bae1b4d5c47a6ae0af4f183d97
SHA512 4522b4271da20cc6d75d0803aea915fdc16f0eb14041e1b48a68ac92854b88674cecc33bb1e0fb4e9b80070a5ca54a149577ab8b5e297f74ab265c80bdd43e44
SSDEEP 6144:gflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:gflfAsiVGjSGecvX
TLSH
T1BC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfcxvmkfc.exe

Path C:\Temp\nkfcxvmkfc.exe
Size 361KB
SHA256 a8719b97565f90e43d609e95409d2634449acf2693da841e1c1fd60a8ff961db
MD5 000d553fc798330f756e53d92cf1044f
SHA1 88db902cd1eebd42edc8c25c125c0e9ef53e5418
SHA512 f0f9cab0dabf9b6c0bd5a6a449297171ae373db4bb3d84ac361dc2df41ca21bda2596fdf523bfb68a021694051ee74773971d8e19d103501fe20b9a0b065ad57
SSDEEP 6144:SflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:SflfAsiVGjSGecvX
TLSH
T160747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omhezxrpjh.exe

Path C:\Temp\omhezxrpjh.exe
Size 361KB
SHA256 784c23e286d937ca9fcaa760c0f82c726ef91ed6b2f576ea403df65837831e1d
MD5 937c268096af97c2725c64d838f08aae
SHA1 6936946ffcc281971cdf12f42cc4419263cffe42
SHA512 ab50652dc2656eb7f134d8f8105a24e9e405ca25bd21f8ecf6a151601ad1d8bfcb94f558076a4c2b884f818048f7253ea21e91d482bac3ebfda554721b232711
SSDEEP 6144:WflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:WflfAsiVGjSGecvX
TLSH
T150747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomjdbwtol.sys

Path C:\Temp\tomjdbwtol.sys
Size 293KB
SHA256 118bd9b3864fb6edcb599bd1d0dbd00d0b79e5eceee706c8202959d600b7da9c
MD5 a8e8ccfba11ad9815e54d77ea5bc47b6
SHA1 961144b832dab792a5a959a54d9208061c2c9a6a
SHA512 1f714b42461d07ec372703ebc5f575b999a60e42c88a63637a71970c1d8adf3a47185250c48459998c47384f6200eef2de1c337974c4d790bd3ebc0242ff0cf1
SSDEEP 3072:4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:4IJjiJcbI03GBc3ucY5DCSj
TLSH
T145545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbzuom.exe

Path C:\Temp\trljdbzuom.exe
Size 361KB
SHA256 8cb5545a9f2d8286ed4906d5a68fa88a50dbe682024856f44ef4996959cd25af
MD5 644dc09dd6ca71a9cad82a5cda634674
SHA1 d92deeed6eb9178f25f9992107ae4dbb06e3a96a
SHA512 4f996595dd44e26f5678560a3f251ddbb9dd336395bd0409d36dfa9671e229c9b959b3a4ec04910a4ee4e6ce773b7c3690cd5eb72943b48519eaf6c5f178960a
SSDEEP 6144:gflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:gflfAsiVGjSGecvX
TLSH
T1D9747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpmhfzxrp.sys

Path C:\Temp\xrpmhfzxrp.sys
Size 293KB
SHA256 6c431bae71febf1be4da3193fb5669d30adcdd4b0e234a32fd3d53e73c308415
MD5 613473e8304212a5ad56c3bfe4dbac2d
SHA1 b67dcb699261b8863b18aa9563fbf6f95bb6f088
SHA512 8d936da5a076ac4954c87d3021df50e46b0b7f736354043b7175c72d164dd2bd95d9e2534271f9c2d2fd205f8b39a25dae152e8221bd3fd8e0436077c944af99
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T151545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b98d688be0f1323b8c02c6c09702362414e28b14b8083b7967f621b6bafca065
MD5 8f7be7db219b1b10ebd7ad7984c681b6
SHA1 dfad5266518ec0e315de9a2742ebb975956d70a4
SHA512 f2ce8e5c23cd0e472587ed4b0afd2f28028e62ac9806641bee9216274eff0b003a819ad0df206e9c2dbdc8fe4ca57ed12719d2e630dd1c50b4b80416c7838ee3
TLSH
T12A615E94872DCFD2EB6444B160D487E93A39B6A109C7FA10F2F9EE7368DAF090105F18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5947bd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5947bd.TMP
Size 3KB
SHA256 99a0c33a409e5162be5871b81138925ffef59f36823839c0350033d1b4422fdc
MD5 0254318b04f5eb4dcc67e139bb5cc865
SHA1 7f52eafb3c044a63f14edf5d70ec571cdb594217
SHA512 0db2cf553a1b631ffe89a4f947549acf344928d60a854b098575a9e1117e7eb4eeac171963656128c6c75c1d819bea3c0769fcd9b9f1c11c0c180c42ac938979
TLSH
T1F6615094872DCFD2EB6444B160D487E93938B6A109C7FA10F2F9DE7368D6E081145F1C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1c4d687b-0b1c-42e1-9917-d0a11133f166.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1c4d687b-0b1c-42e1-9917-d0a11133f166.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f8ed9e47bd71deea978f88e07abf2ad9753b9ef53f925daf66146f87bf3611d1
MD5 26d0b01c140e622c89762335064092c3
SHA1 52a32a5ac562eb3566197b54c5ebbf67fe79f602
SHA512 7f585bc8fba7a7bd7e131c50577a66e0dab5003a58c110ae634bc9819f2333ca83286c651413373e04e760a3e44444d02f57972fe4e7998fbf60fa27419f515b
TLSH
T1F631C2F7C3E8856E890195F0A6146E1BCE1D0955832C7D5AC9D4EF2B93E3471E10195F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 fc01408e5f18c70dbb724a9eedb2667091876c856c0e4b3b3ab5fe01ac99e1d2
MD5 ac21b97ecc47575a0642c39668212f4a
SHA1 234d586f4de036a7534854dfe4c19bd12002a913
SHA512 815d44adfe73c73dd799da22a71bc2408a35c5ee360662ddc87679ae5300350196b117b8fb44eb47c8ccb961455b1d1c1c8137052535b6eaa9e3dc561e2d62d5
SSDEEP 192:sxRcROCU/f1s8cdhZYVRuzoA8p9u/g6+WNCF5/Yxwl/JAGJIgVOJ:sxRczU/f1s8cdvYL0/5O/3ZE
TLSH
T14342C81A6D38A93B9CC7E259FB557F53E7F95032A0D01E48AAFC8A1C04E66CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 cf4677310f204dfca12822535cd4bd9f877c80eb3a2a54e117e2dc4e5aa80712
MD5 49645c268ba1ba253c40330605a7b11f
SHA1 fab067756ebc7b0e4a8c9718a917fe8442f27917
SHA512 c61d6f81dd874229cc19a5cdfeacfdbb7ec8c3e6e645e671192c283ee9b9df61660d6a556fe1ef3f81890a8186d3c03b430fb0fcb6b67eca55a29cfa4bba9c33
SSDEEP 192:sxRLROCU/f1sfcdhZYVRuzoA8p9u/g6+WNCF5/Yxwl/JAGJIgD1OJ:sxRLzU/f1sfcdvYL0/5O/3ZY
TLSH
T13E42C81A6D38A93B9CC7E259FB557F53E7F95032A0D11E48AAFC8A1C04E66CD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6e034ae3662007d2b1b3ca8f2620ec11408603c6dbee6d03849e6e62e95e20be
MD5 e6ef90b752b803848c36e26d006d30cd
SHA1 adcc9ee5a63dca93f18f37459f4dfcdd779ea49e
SHA512 148c8742a2c5e539d295a5167194544b20e641fd263ae2066b7b00920e08ad20f747104965d3e9239d459d01d858877f25a2a5feeccc5c282bc818df88b21981
SSDEEP 192:sxRLROCU/f1sfedhZYVRuzoA8p9u/g6+WNCF5/YxKlpJAGJIgDPOJ:sxRLzU/f1sfedvYL0/5O/jZW
TLSH
T1A842B91A6D28A93B9CC7E259FB557F53E3F95032A0D11E44AAFC8A1C05E76CE620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 da4655864639b71f9896661b1c97430ceb0ff9c4afca0a462f422d085c52686e
MD5 1b890d2ba0a793e8dcc9ffa57e81e4b7
SHA1 b01757f35d73672a3890c643b3ea3175a1e66171
SHA512 cbf42145562e5d26df7930636a4dae722705fef383a9a05efc016d4bc3467ef4beb0167bd52cd70d97119dea54cdc370f4e8e70ee41af22b0e046f243ebd4752
SSDEEP 768:0YEygs7pLuL7+jWgbrfp18F1+UoAYDCx9Tuqh0VfUC9xbog/OV0U/rVatroHEg3:0YEygQE7+jWgbrfp1u1janU/paGHH3
TLSH
T1D5D2D97B740CCB7F4F804ADDAC197A9E7DA802CB96D8C94047FA981C03C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

290d0a92-f5a9-4a7d-a97d-867d725ae1a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\290d0a92-f5a9-4a7d-a97d-867d725ae1a1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 ffc468776cbe84e57462705be4d9875d0a2d3d6ca256a1ab64f4960774c88d84
MD5 66ba71454c005fc126de03ed92e52bc9
SHA1 a553869d2b7361efa62e872206c947d357b38205
SHA512 6f5e784baa9bb1d5127dbd64647ae4c7a243e106b381860b2a24e485a4b83d4e3202a9d50a461b1288907782f1d3e93c891be07e2ab1980594cfd7a9c489ad73
SSDEEP 768:0m3CHYkKL2D4l+jF669yrqUjWiIwwxMtBfRu:0m3Cvk0jF66INWZTM/fRu
TLSH
T12FF2BFB0AC659DB389F6E385B21233C3BFB0506396C80F98D9DD9B1D05476DA274783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 773ffe62a0943e8e0e78227d200cd13a34c269e7faa117b086ab0c878ce0c312
MD5 ecd77a6e5cebfa3372143d5f66d5c71f
SHA1 cee1864626c768b629653f9045822d583f3522fd
SHA512 23149f4b2799bf888884a00c678d8c43a060419c7a912f65bf1da9c63656eb6c39309b34bb25b44da9555e9b6e8d34c41a5fd3976e1ba210e119730ba8b681f6
SSDEEP 768:arv+4UNbdl3YPkKL2D4vjF669yrqUjWiIwwxMReUiler:absbX3/kvjF66INWZTM4UsQ
TLSH
T17303CE34AC589AB7CCF2D28672433783BFB4115396C50B98CADD270D469B0DD2347A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 14d42a62d8ef05067350c139dd29491bde9c0f98cd0b60d69713d42178a8be69
MD5 83a1b9c31f80df08ac0f7d1ae6519b15
SHA1 2e35de406f7e5b974a289e1d7b45e5a54ee4fea5
SHA512 acded59fcbf9ee683fce4a8672e439fda1e8aaab53c27f5aab11ee65ebe0c18a1e29a2f30dce15b5c3106e1196d29d556512f544e7c36988c4b2533df4b8cc26
SSDEEP 768:Yrv+4UNbdt3xEYkKL2D4l1jF669yrqUjWiIwwxMtBy3TK:Ybsb73xckbjF66INWZTM/YK
TLSH
T1A703BE70AC68AA73C9F6E785B1523783BFB0109396C50F98DADD5B0C054B1DE274B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 f4c9556a611912ed1920b961131c35cf9ee0833730b2b811ae9753f0350f6de3
MD5 a32d563dee33312781095e636ba460a5
SHA1 b665156003dae14f6bc76bd244a472c8da1e57ff
SHA512 765537665dafb3e50fc5b54249975a8bae70f4c491d3ae56af4430438b3f099c589c244aed926200187cfb4e2cc0f5eecb5d1b4af5f742750f21a6a2c28e1bec
SSDEEP 768:am3XHYkKL2D4l+jF669yrqUjWiIwwxMtBfRu:am3Xvk0jF66INWZTM/fRu
TLSH
T176F2BFB0AC659DB389F6E385721233C2BFB0506396C80F98D9DD9B1D05476DA274783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 e7913d3a04b8238fa129d4814de51e81838672b4673de675b2c4a97d4b280412
MD5 aa7f221b655f1efada6a624ef2d4345d
SHA1 50fd3fa9ab12c35747392020703faf5df2bcba96
SHA512 a9c74b52081e0bd967f19770e5b32e543f35400fa2eaacd21e8f821fdb2d5e794102517cb6e704b1cd7251b3ed062744d6e364193012a3ed0de21ac8adbc6023
SSDEEP 768:+FQd3Qwg85F54lxnF669yrqUjWiIwwxMtBfRu:Vd3ZSbnF66INWZTM/fRu
TLSH
T1811328F498D78977D8AE9787633D2E829EBCC063B5884994B7C85D0CCC461BFD306825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 b3e9449c23d8dd95b5f22f8c549e62978c0f9893ee4a7b05b919b16649a2c412
MD5 bd4251b664ebc367a98a134db5327b4e
SHA1 f492798507401bbabd4217abb2a303b652c37050
SHA512 b1f6ed180829296df656c93de4080959d13c0b36c47c4be7829c44c01f4ea1ffce2b62d216d5bf786008dbd209e49b952d106bb6b4e8f29a09479340faa5c152
SSDEEP 768:krv+4UNbdl3HikKL2D4lWjF669yrqUjWiIwwxMABUiler:kbsbX3JkQjF66INWZTMwUsQ
TLSH
T14603BE34AC589A73CDF2E285725377C3BFB4209396C50F98CAD9670D068B1CA274792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96952493-5b1f-412b-b957-f2c89e6639df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\96952493-5b1f-412b-b957-f2c89e6639df.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5692_1926175981\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 7320a6f216c7ac06152d409fa67fe9da59b3b46320687f315c2bd43a43462447
MD5 8a4534f04c3f0fc86d99fc376380155d
SHA1 c34d3bbfb48dabcb9e4f7cd02c98631e0f6d920b
SHA512 ab15641341f0b517145c6eadc1cda2e948ff3aed4234a9575c51774dc4ecdfc32e719c53474ba6cb19a7cad0be301f4d73611a33f33ec41738274f2e2e5bbf34
TLSH
T19171238357BDD9B3C5DA5FF002835608F1FB2238073330218B51594AAB30A3A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/616-355-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1028-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1076-384-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1652-405-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2040-392-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2084-182-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2388-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2692-257-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2820-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2820-330-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3100-397-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3336-388-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3436-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4408-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4844-371-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4880-269-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5332-307-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5636-229-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5844-380-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5924-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download