systex | 5ea26f202f1225c6c91d1c59827fae26df6cb4dc8898dbccb949a85d4c872690

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260820-cdgvmsxhpg
SHA256 5ea26f202f1225c6c91d1c59827fae26df6cb4dc8898dbccb949a85d4c872690
MD5 19e3d13a26f1e438dc6770a491773058
SHA1 925a6343632f6d51b146756263c55014da762da0
SHA512 4c4a7b2700b54ce11a0eb80cefeea2d80904ed664e0ed9a25dd8a4470151f93d2616fb19c97d98f972907a430a7e0d4e0f1f82135be33a18e6c66e4338792432
SSDEEP 6144:bflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:bflfAsiVGjSGecvX
TLSH
T1FD747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5824	tolgdywqoigbywqo.exe
3236	tolgdywqoigbywqo.sys
4760	CreateProcess.exe
4456	bywigbytqi.exe
124	CreateProcess.exe
596	CreateProcess.exe
5792	i_bywigbytqi.exe
6036	yvtnlfdyvq.sys
4680	CreateProcess.exe
2176	qoigaysqli.exe
2208	CreateProcess.exe
5668	CreateProcess.exe
5516	i_qoigaysqli.exe
5084	fdxvtnlfda.sys
1472	CreateProcess.exe
248	xvsnlfdxvq.exe
5264	CreateProcess.exe
4612	CreateProcess.exe
1964	i_xvsnlfdxvq.exe
4208	usqkhfdxvp.sys
2140	CreateProcess.exe
1032	xspnhfaxsp.exe
2372	CreateProcess.exe
5512	CreateProcess.exe
5580	i_xspnhfaxsp.exe
5508	xusnkfcxvs.sys
5348	CreateProcess.exe
464	nhfzxupnhf.exe
4328	CreateProcess.exe
3044	CreateProcess.exe
5920	i_nhfzxupnhf.exe
4720	xrpjhfzxrp.sys
3868	CreateProcess.exe
1816	rpjhczusmk.exe
4208	CreateProcess.exe
3948	CreateProcess.exe
2108	i_rpjhczusmk.exe
2448	mjecwuomge.sys
3208	CreateProcess.exe
1824	mhezwrpjhb.exe
1672	CreateProcess.exe
6000	CreateProcess.exe
4364	i_mhezwrpjhb.exe
4780	ebwuomjhbz.sys
1284	CreateProcess.exe
3128	jdbwtomgey.exe
2856	CreateProcess.exe
4652	CreateProcess.exe
5344	i_jdbwtomgey.exe
252	mjebwtomge.sys
5192	CreateProcess.exe
4272	vtqoigbytr.exe
1260	CreateProcess.exe
2064	CreateProcess.exe
2216	i_vtqoigbytr.exe
5244	vtolgdyvqo.sys
5700	CreateProcess.exe
1900	tnljdbvtnl.exe
4220	CreateProcess.exe
1932	CreateProcess.exe
5888	i_tnljdbvtnl.exe
4672	kigdyvqoig.sys
768	CreateProcess.exe
4176	davtnlfdxv.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3976_1876835846\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3976_871898606\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3976_812833047\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3976_445648487\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3976_445648487\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3976_871898606\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3976_812833047\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3976_445648487\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3976_445648487\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspnhfaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywigbytqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqoigbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqnhfaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqnhfaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtolgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvsnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoigbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoigbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtolgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnlfaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvsnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspnhfaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqoigbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljhbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnlfaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywigbytqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljhbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tolgdywqoigbywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaysqli.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1956	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1188	ipconfig.exe
3720	ipconfig.exe
2696	ipconfig.exe
2708	ipconfig.exe
260	ipconfig.exe
5252	ipconfig.exe
5816	ipconfig.exe
3720	ipconfig.exe
5880	ipconfig.exe
1572	ipconfig.exe
1532	ipconfig.exe
2128	ipconfig.exe
1772	ipconfig.exe
3104	ipconfig.exe
1252	ipconfig.exe
6096	ipconfig.exe
5996	ipconfig.exe
5580	ipconfig.exe
252	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316646582608514"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{A801DBB8-A104-4D24-84DC-17257CA32FEA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5824	tolgdywqoigbywqo.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5824	tolgdywqoigbywqo.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5824	tolgdywqoigbywqo.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5824	tolgdywqoigbywqo.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5824	tolgdywqoigbywqo.exe
5824	tolgdywqoigbywqo.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5824	tolgdywqoigbywqo.exe
5824	tolgdywqoigbywqo.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5824	tolgdywqoigbywqo.exe
5824	tolgdywqoigbywqo.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5824	tolgdywqoigbywqo.exe
5824	tolgdywqoigbywqo.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5824	tolgdywqoigbywqo.exe
5824	tolgdywqoigbywqo.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5792	i_bywigbytqi.exe
Token: SeDebugPrivilege	5516	i_qoigaysqli.exe
Token: SeDebugPrivilege	1964	i_xvsnlfdxvq.exe
Token: SeDebugPrivilege	5580	i_xspnhfaxsp.exe
Token: SeDebugPrivilege	5920	i_nhfzxupnhf.exe
Token: SeDebugPrivilege	2108	i_rpjhczusmk.exe
Token: SeDebugPrivilege	4364	i_mhezwrpjhb.exe
Token: SeDebugPrivilege	5344	i_jdbwtomgey.exe
Token: SeDebugPrivilege	2216	i_vtqoigbytr.exe
Token: SeDebugPrivilege	5888	i_tnljdbvtnl.exe
Token: SeDebugPrivilege	3268	i_davtnlfdxv.exe
Token: SeDebugPrivilege	4584	i_sqnhfaxsqk.exe
Token: SeDebugPrivilege	2260	i_hfzxrpkica.exe
Token: SeDebugPrivilege	5708	i_smkecxupmh.exe
Token: SeDebugPrivilege	5560	i_rpmhfzxrpj.exe
Token: SeDebugPrivilege	2660	i_ljhbztrmje.exe
Token: SeDebugPrivilege	1328	i_ywqoigbytr.exe
Token: SeDebugPrivilege	3628	i_wtolgdywqo.exe
Token: SeDebugPrivilege	2108	i_vqnlfaysqk.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3976	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 5824	4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 4108 wrote to memory of 296	4108	2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	91
PID 296 wrote to memory of 3976	296	iexplore.exe	92
PID 3976 wrote to memory of 4648	3976	msedge.exe	93
PID 3976 wrote to memory of 1756	3976	msedge.exe	95
PID 3976 wrote to memory of 1956	3976	msedge.exe	94
PID 3976 wrote to memory of 1756	3976	msedge.exe	95
PID 3976 wrote to memory of 1756	3976	msedge.exe	95
PID 3976 wrote to memory of 4076	3976	msedge.exe	96
PID 3976 wrote to memory of 4076	3976	msedge.exe	96
PID 3976 wrote to memory of 3720	3976	msedge.exe	98
PID 3976 wrote to memory of 3720	3976	msedge.exe	98
PID 3976 wrote to memory of 3720	3976	msedge.exe	98
PID 3976 wrote to memory of 3808	3976	msedge.exe	99
PID 3976 wrote to memory of 3808	3976	msedge.exe	99
PID 3976 wrote to memory of 3808	3976	msedge.exe	99
PID 3976 wrote to memory of 4868	3976	msedge.exe	100
PID 3976 wrote to memory of 4176	3976	msedge.exe	101
PID 3976 wrote to memory of 4868	3976	msedge.exe	100
PID 3976 wrote to memory of 4868	3976	msedge.exe	100
PID 3976 wrote to memory of 4176	3976	msedge.exe	101
PID 3976 wrote to memory of 4176	3976	msedge.exe	101
PID 3976 wrote to memory of 1316	3976	msedge.exe	102
PID 3976 wrote to memory of 1316	3976	msedge.exe	102
PID 3976 wrote to memory of 2304	3976	msedge.exe	106
PID 3976 wrote to memory of 2528	3976	msedge.exe	107
PID 3976 wrote to memory of 2304	3976	msedge.exe	106
PID 3976 wrote to memory of 2528	3976	msedge.exe	107
PID 3976 wrote to memory of 1356	3976	msedge.exe	109
PID 3976 wrote to memory of 5632	3976	msedge.exe	110
PID 3976 wrote to memory of 5632	3976	msedge.exe	110
PID 5824 wrote to memory of 4760	5824	tolgdywqoigbywqo.exe	111
PID 4456 wrote to memory of 124	4456	bywigbytqi.exe	115
PID 3976 wrote to memory of 2896	3976	msedge.exe	119
PID 3976 wrote to memory of 2896	3976	msedge.exe	119
PID 5824 wrote to memory of 596	5824	tolgdywqoigbywqo.exe	120
PID 5824 wrote to memory of 4680	5824	tolgdywqoigbywqo.exe	124
PID 2176 wrote to memory of 2208	2176	qoigaysqli.exe	126
PID 5824 wrote to memory of 5668	5824	tolgdywqoigbywqo.exe	129
PID 5824 wrote to memory of 1472	5824	tolgdywqoigbywqo.exe	133
PID 248 wrote to memory of 5264	248	xvsnlfdxvq.exe	135
PID 5824 wrote to memory of 4612	5824	tolgdywqoigbywqo.exe	138
PID 5824 wrote to memory of 2140	5824	tolgdywqoigbywqo.exe	143
PID 1032 wrote to memory of 2372	1032	xspnhfaxsp.exe	145
PID 5824 wrote to memory of 5512	5824	tolgdywqoigbywqo.exe	148
PID 3976 wrote to memory of 5144	3976	msedge.exe	150
PID 3976 wrote to memory of 4164	3976	msedge.exe	151
PID 3976 wrote to memory of 1320	3976	msedge.exe	152
PID 5824 wrote to memory of 5348	5824	tolgdywqoigbywqo.exe	155
PID 464 wrote to memory of 4328	464	nhfzxupnhf.exe	157
PID 5824 wrote to memory of 3044	5824	tolgdywqoigbywqo.exe	160
PID 5824 wrote to memory of 3868	5824	tolgdywqoigbywqo.exe	164
PID 1816 wrote to memory of 4208	1816	rpjhczusmk.exe	166
PID 5824 wrote to memory of 3948	5824	tolgdywqoigbywqo.exe	169
PID 5824 wrote to memory of 3208	5824	tolgdywqoigbywqo.exe	173
PID 1824 wrote to memory of 1672	1824	mhezwrpjhb.exe	175
PID 5824 wrote to memory of 6000	5824	tolgdywqoigbywqo.exe	178
PID 5824 wrote to memory of 1284	5824	tolgdywqoigbywqo.exe	182
PID 3128 wrote to memory of 2856	3128	jdbwtomgey.exe	184
PID 5824 wrote to memory of 4652	5824	tolgdywqoigbywqo.exe	187
PID 3976 wrote to memory of 2604	3976	msedge.exe	189
PID 3976 wrote to memory of 2604	3976	msedge.exe	189
PID 5824 wrote to memory of 5192	5824	tolgdywqoigbywqo.exe	195
PID 4272 wrote to memory of 1260	4272	vtqoigbytr.exe	197

C:\Users\Admin\AppData\Local\Temp\2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_19e3d13a26f1e438dc6770a491773058_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Temp\tolgdywqoigbywqo.exe
  C:\Temp\tolgdywqoigbywqo.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywigbytqi.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4760
  - - C:\Temp\bywigbytqi.exe
      C:\Temp\bywigbytqi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4456
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bywigbytqi.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:596
  - - C:\Temp\i_bywigbytqi.exe
      C:\Temp\i_bywigbytqi.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigaysqli.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4680
  - - C:\Temp\qoigaysqli.exe
      C:\Temp\qoigaysqli.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2176
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2208
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigaysqli.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5668
  - - C:\Temp\i_qoigaysqli.exe
      C:\Temp\i_qoigaysqli.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvsnlfdxvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1472
  - - C:\Temp\xvsnlfdxvq.exe
      C:\Temp\xvsnlfdxvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5264
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvsnlfdxvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4612
  - - C:\Temp\i_xvsnlfdxvq.exe
      C:\Temp\i_xvsnlfdxvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xspnhfaxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2140
  - - C:\Temp\xspnhfaxsp.exe
      C:\Temp\xspnhfaxsp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1032
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2372
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xspnhfaxsp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5512
  - - C:\Temp\i_xspnhfaxsp.exe
      C:\Temp\i_xspnhfaxsp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfzxupnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5348
  - - C:\Temp\nhfzxupnhf.exe
      C:\Temp\nhfzxupnhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4328
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfzxupnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3044
  - - C:\Temp\i_nhfzxupnhf.exe
      C:\Temp\i_nhfzxupnhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhczusmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3868
  - - C:\Temp\rpjhczusmk.exe
      C:\Temp\rpjhczusmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1816
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4208
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhczusmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3948
  - - C:\Temp\i_rpjhczusmk.exe
      C:\Temp\i_rpjhczusmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhezwrpjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3208
  - - C:\Temp\mhezwrpjhb.exe
      C:\Temp\mhezwrpjhb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1824
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1672
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhezwrpjhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6000
  - - C:\Temp\i_mhezwrpjhb.exe
      C:\Temp\i_mhezwrpjhb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbwtomgey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1284
  - - C:\Temp\jdbwtomgey.exe
      C:\Temp\jdbwtomgey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3128
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2856
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbwtomgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4652
  - - C:\Temp\i_jdbwtomgey.exe
      C:\Temp\i_jdbwtomgey.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtqoigbytr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5192
  - - C:\Temp\vtqoigbytr.exe
      C:\Temp\vtqoigbytr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4272
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1260
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1188
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtqoigbytr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2064
  - - C:\Temp\i_vtqoigbytr.exe
      C:\Temp\i_vtqoigbytr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnljdbvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5700
  - - C:\Temp\tnljdbvtnl.exe
      C:\Temp\tnljdbvtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1900
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4220
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnljdbvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1932
  - - C:\Temp\i_tnljdbvtnl.exe
      C:\Temp\i_tnljdbvtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\davtnlfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:768
  - - C:\Temp\davtnlfdxv.exe
      C:\Temp\davtnlfdxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4176
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_davtnlfdxv.exe ups_ins
    3⤵
    PID:5532
  - - C:\Temp\i_davtnlfdxv.exe
      C:\Temp\i_davtnlfdxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqnhfaxsqk.exe ups_run
    3⤵
    PID:5844
  - - C:\Temp\sqnhfaxsqk.exe
      C:\Temp\sqnhfaxsqk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4112
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4964
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqnhfaxsqk.exe ups_ins
    3⤵
    PID:2424
  - - C:\Temp\i_sqnhfaxsqk.exe
      C:\Temp\i_sqnhfaxsqk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzxrpkica.exe ups_run
    3⤵
    PID:5096
  - - C:\Temp\hfzxrpkica.exe
      C:\Temp\hfzxrpkica.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5600
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4164
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfzxrpkica.exe ups_ins
    3⤵
    PID:4404
  - - C:\Temp\i_hfzxrpkica.exe
      C:\Temp\i_hfzxrpkica.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkecxupmh.exe ups_run
    3⤵
    PID:5696
  - - C:\Temp\smkecxupmh.exe
      C:\Temp\smkecxupmh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4436
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkecxupmh.exe ups_ins
    3⤵
    PID:4564
  - - C:\Temp\i_smkecxupmh.exe
      C:\Temp\i_smkecxupmh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpmhfzxrpj.exe ups_run
    3⤵
    PID:4716
  - - C:\Temp\rpmhfzxrpj.exe
      C:\Temp\rpmhfzxrpj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1576
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1140
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpmhfzxrpj.exe ups_ins
    3⤵
    PID:4336
  - - C:\Temp\i_rpmhfzxrpj.exe
      C:\Temp\i_rpmhfzxrpj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljhbztrmje.exe ups_run
    3⤵
    PID:3064
  - - C:\Temp\ljhbztrmje.exe
      C:\Temp\ljhbztrmje.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2836
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3344
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljhbztrmje.exe ups_ins
    3⤵
    PID:696
  - - C:\Temp\i_ljhbztrmje.exe
      C:\Temp\i_ljhbztrmje.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqoigbytr.exe ups_run
    3⤵
    PID:436
  - - C:\Temp\ywqoigbytr.exe
      C:\Temp\ywqoigbytr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4600
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1496
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqoigbytr.exe ups_ins
    3⤵
    PID:2092
  - - C:\Temp\i_ywqoigbytr.exe
      C:\Temp\i_ywqoigbytr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtolgdywqo.exe ups_run
    3⤵
    PID:4912
  - - C:\Temp\wtolgdywqo.exe
      C:\Temp\wtolgdywqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2632
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:900
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtolgdywqo.exe ups_ins
    3⤵
    PID:4720
  - - C:\Temp\i_wtolgdywqo.exe
      C:\Temp\i_wtolgdywqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vqnlfaysqk.exe ups_run
    3⤵
    PID:5832
  - - C:\Temp\vqnlfaysqk.exe
      C:\Temp\vqnlfaysqk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5468
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4080
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vqnlfaysqk.exe ups_ins
    3⤵
    PID:2264
  - - C:\Temp\i_vqnlfaysqk.exe
      C:\Temp\i_vqnlfaysqk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2108
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x39c,0x7ffa4631c188,0x7ffa4631c194,0x7ffa4631c1a0
      4⤵
      PID:4648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,13376205021199982638,11858319228837462181,524288 --field-trial-handle=2120,i,8936857134143334629,12577221918837889061,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
      4⤵
      System Time Discovery
      PID:1956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,7649460131833272823,530132167265682327,262144 --field-trial-handle=2120,i,8936857134143334629,12577221918837889061,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:2
      4⤵
      PID:1756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,6959796525301338749,7478318380941625773,524288 --field-trial-handle=2120,i,8936857134143334629,12577221918837889061,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:13
      4⤵
      PID:4076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,16804638853254207510,15332202827600475393,2097152 --field-trial-handle=2120,i,8936857134143334629,12577221918837889061,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:3720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,7856983920355970488,9496651323743194878,2097152 --field-trial-handle=2120,i,8936857134143334629,12577221918837889061,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      PID:3808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,12271476410303096850,16263389209305178329,2097152 --field-trial-handle=2120,i,8936857134143334629,12577221918837889061,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
      4⤵
      PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,7246193852478415358,10460280943909110127,2097152 --field-trial-handle=2120,i,8936857134143334629,12577221918837889061,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:9
      4⤵
      PID:4176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,6969788752938749325,4811635519349703696,524288 --field-trial-handle=2120,i,8936857134143334629,12577221918837889061,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
      4⤵
      PID:1316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,11556139734584816762,14530565970188738910,524288 --field-trial-handle=2120,i,8936857134143334629,12577221918837889061,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:14
      4⤵
      PID:2304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,18270376858969876409,16330756087302168416,524288 --field-trial-handle=2120,i,8936857134143334629,12577221918837889061,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
      4⤵
      PID:2528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,6971910996901057830,8949608456272967466,524288 --field-trial-handle=2120,i,8936857134143334629,12577221918837889061,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,6971910996901057830,8949608456272967466,524288 --field-trial-handle=2120,i,8936857134143334629,12577221918837889061,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:1356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,3091957336054914643,5480242484327663864,524288 --field-trial-handle=2120,i,8936857134143334629,12577221918837889061,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
      4⤵
      PID:5632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,4941599344712405484,15566695245789414832,524288 --field-trial-handle=2120,i,8936857134143334629,12577221918837889061,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:2896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,5181221664507075700,13779299911353474437,524288 --field-trial-handle=2120,i,8936857134143334629,12577221918837889061,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
      4⤵
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,9421550572252724248,6394933481753980808,524288 --field-trial-handle=2120,i,8936857134143334629,12577221918837889061,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
      4⤵
      PID:4164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,9607708799056757865,10451026300614930327,524288 --field-trial-handle=2120,i,8936857134143334629,12577221918837889061,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
      4⤵
      PID:1320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,1704550661262800123,7277629589543957043,524288 --field-trial-handle=2120,i,8936857134143334629,12577221918837889061,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:14
      4⤵
      PID:2604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3468,i,11082734411313677176,3719796275638869293,524288 --field-trial-handle=2120,i,8936857134143334629,12577221918837889061,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:14
      4⤵
      PID:4116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,630673089873871033,9664326000245783196,524288 --field-trial-handle=2120,i,8936857134143334629,12577221918837889061,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:14
      4⤵
      PID:6064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7104,i,7039625465902907891,3693303192789652355,524288 --field-trial-handle=2120,i,8936857134143334629,12577221918837889061,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:14
      4⤵
      PID:4484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6956,i,14032202807235113542,332873285658672478,262144 --field-trial-handle=2120,i,8936857134143334629,12577221918837889061,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:10
      4⤵
      PID:1564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,12249797871129868207,16389788317119496194,524288 --field-trial-handle=2120,i,8936857134143334629,12577221918837889061,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:14
      4⤵
      PID:5628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1816

C:\Temp\tolgdywqoigbywqo.sys
C:\Temp\tolgdywqoigbywqo.sys
1⤵
- Executes dropped EXE
PID:3236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:800

C:\Temp\yvtnlfdyvq.sys
C:\Temp\yvtnlfdyvq.sys
1⤵
- Executes dropped EXE
PID:6036

C:\Temp\fdxvtnlfda.sys
C:\Temp\fdxvtnlfda.sys
1⤵
- Executes dropped EXE
PID:5084

C:\Temp\usqkhfdxvp.sys
C:\Temp\usqkhfdxvp.sys
1⤵
- Executes dropped EXE
PID:4208

C:\Temp\xusnkfcxvs.sys
C:\Temp\xusnkfcxvs.sys
1⤵
- Executes dropped EXE
PID:5508

C:\Temp\xrpjhfzxrp.sys
C:\Temp\xrpjhfzxrp.sys
1⤵
- Executes dropped EXE
PID:4720

C:\Temp\mjecwuomge.sys
C:\Temp\mjecwuomge.sys
1⤵
- Executes dropped EXE
PID:2448

C:\Temp\ebwuomjhbz.sys
C:\Temp\ebwuomjhbz.sys
1⤵
- Executes dropped EXE
PID:4780

C:\Temp\mjebwtomge.sys
C:\Temp\mjebwtomge.sys
1⤵
- Executes dropped EXE
PID:252

C:\Temp\vtolgdyvqo.sys
C:\Temp\vtolgdyvqo.sys
1⤵
- Executes dropped EXE
PID:5244

C:\Temp\kigdyvqoig.sys
C:\Temp\kigdyvqoig.sys
1⤵
- Executes dropped EXE
PID:4672

C:\Temp\sqkicayspn.sys
C:\Temp\sqkicayspn.sys
1⤵
PID:3480

C:\Temp\xvsnkfcxvp.sys
C:\Temp\xvsnkfcxvp.sys
1⤵
PID:4292

C:\Temp\smkhfzxusm.sys
C:\Temp\smkhfzxusm.sys
1⤵
PID:3408

C:\Temp\urmkecwuom.sys
C:\Temp\urmkecwuom.sys
1⤵
PID:2876

C:\Temp\rmjebwuomj.sys
C:\Temp\rmjebwuomj.sys
1⤵
PID:1312

C:\Temp\mgeywtomge.sys
C:\Temp\mgeywtomge.sys
1⤵
PID:5836

C:\Temp\vtrljdbytr.sys
C:\Temp\vtrljdbytr.sys
1⤵
PID:5080

C:\Temp\tqoigdbytq.sys
C:\Temp\tqoigdbytq.sys
1⤵
PID:720

C:\Temp\nlfdxvpnif.sys
C:\Temp\nlfdxvpnif.sys
1⤵
PID:3636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bywigbytqi.exe

Path C:\Temp\bywigbytqi.exe
Size 361KB
SHA256 56c3f91104cdb512cc2c0cbb0c4043d63877faed5c9f160a864d22069ab19c55
MD5 43dbef90af5b21cf7e532583baed2a5e
SHA1 ef6e9db3bd8153138d10f0651844121fa4802b86
SHA512 fd84f6d0a83b587b4f0be2f4e03ed30f7dee8973881d107d5e10c4d6d31569c707850a0d73594782433344e0ee5c8048f8931dd8ca2f7c6248ad6e2dacc8abbb
SSDEEP 6144:/flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:/flfAsiVGjSGecvX
TLSH
T1D3747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvtnlfda.sys

Path C:\Temp\fdxvtnlfda.sys
Size 293KB
SHA256 044332f3b353b7ea4fad16cfb6df3b0882a9ab2770c215bc950f6f6d55e3b93c
MD5 a2cc06f7522082463efc7208ccca16d3
SHA1 28e0edc2cfa17cce41c96cbc3feb67943068a2f3
SHA512 35c51ac5120ff6cb3610412b207b69dbf8c05dde61f85cc14cd97cd4ad2f63320e39f73574f6f6be1b4dda807b2a9d7bf5a84f443a1d762e21665d175904bbb3
SSDEEP 3072:stKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:sIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bywigbytqi.exe

Path C:\Temp\i_bywigbytqi.exe
Size 361KB
SHA256 cbff75462babed5495b860dd9e6e98a83fa6c761e234e41daa940c3525b5b9a6
MD5 3d57fd26449d4e9154b8940fe5e005da
SHA1 e6f8058e7d2914f9f090e7f70540c02edb73d47e
SHA512 3375319a5a459d7fffd03dfdbc09397a82e55662b80235931116dc23f40e6a0289a44255a0b59c84258e4dae96683a240907c5357c0c75602c11881a0d5f4a8c
SSDEEP 6144:fflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:fflfAsiVGjSGecvX
TLSH
T133747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nhfzxupnhf.exe

Path C:\Temp\i_nhfzxupnhf.exe
Size 361KB
SHA256 51bfcc984d3a069069b200c3669061525ce1614f62480cef3d776861ca23bef7
MD5 481dd7ad28a9f8f295547ead4d703988
SHA1 45896fc1e12825924b32ffce78113b57632a4301
SHA512 fa7d802cc0289418fb5aa725f65b88535f026583d74747ab36252e470455f092f5f49fce36627b00c75021b7a9e014de7ad0b0aa10c56b8963dc6c1cbe358b60
SSDEEP 6144:QflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:QflfAsiVGjSGecvX
TLSH
T162747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoigaysqli.exe

Path C:\Temp\i_qoigaysqli.exe
Size 361KB
SHA256 f25e290f3894e15dda743257a215fcdae8dee33f457ceea7dd9fc9ae6592ec93
MD5 2e2fd19e8e24952ad6bd1fbd726a0f23
SHA1 6598c993568153244a23796644f7abbbac4988c0
SHA512 2280a06027e887e79c9ee320b5490d99f5fc11ea1f05990173a24d5338af5dbf13be271cda3a7627871d1a75b5c5a9baaac5fd881612e74d03deb01085a077da
SSDEEP 6144:IflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:IflfAsiVGjSGecvX
TLSH
T1F5747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xspnhfaxsp.exe

Path C:\Temp\i_xspnhfaxsp.exe
Size 361KB
SHA256 bb62a9114e636d5a6537f4226fd1b53bf95eeeb10bf9890368611164fe9bd8f7
MD5 1346238ff8ea60e08df8039c7f9bb039
SHA1 1f67a16b24ea02e4f1ed730bb46f56a9e9658871
SHA512 63f857db1ee7d2308cd9a7caf652f232cdc64c179141f1e600936f97a561f0b9a882a8e77b3b882ced4cc2b5872486fb9e978c1a9560de6dd1fc777c2cdcd78e
SSDEEP 6144:HflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:HflfAsiVGjSGecvX
TLSH
T129747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvsnlfdxvq.exe

Path C:\Temp\i_xvsnlfdxvq.exe
Size 361KB
SHA256 91902a9e1d34bc62b98eed157664ddac84eea554b02ea5d52adeb3e0453ce60e
MD5 d2ca24ca7b72700ee1ffe59fd87563c9
SHA1 eaf7aad9c239f8689a0ee3b3b5e1d1dda8232c8e
SHA512 c5df2dca710ae99a81010b3d955439796d8b8f09ab79dd7ef8a8e27d83c78209f9980bec39190044fc6266755462965242d698ce556128bc7e6c67f57aeb4f8a
SSDEEP 6144:9flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:9flfAsiVGjSGecvX
TLSH
T176747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfzxupnhf.exe

Path C:\Temp\nhfzxupnhf.exe
Size 361KB
SHA256 d818469c5a99090e188421bc7d3f9ebb4b67d1962817b5958a9c91ff07592ac5
MD5 def5dd9907ed3c815c1fdff5673b711e
SHA1 d09d1c06ba8804e93807ecfabe3186601fca0ede
SHA512 e959ab312abd5ca37a2fa2b3b2c80dcea96ae5fe90164dee425a085d6cb0eaae5a237032fb536f6724bfeaf5230afb2f0b70af62ecea0ea6db19e97ba8bea976
SSDEEP 6144:6flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:6flfAsiVGjSGecvX
TLSH
T16E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigaysqli.exe

Path C:\Temp\qoigaysqli.exe
Size 361KB
SHA256 91716f1f72d8ec480285a7439ef671a07c3806c02c3c7c2c1dbd99943a73b781
MD5 0925b004fcd63dd78509cfdd8a0f54dd
SHA1 a9d8b58f10fe2bae500013116d412c1e259b21a0
SHA512 efc4956a22474f749ab250a3948679c8eca9dfab8fa1685d28aa68055279f96d0a180aeeac1f95374829a1c07c0620daf3f3cdb3b16742b8a8187210a605248c
SSDEEP 6144:sflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:sflfAsiVGjSGecvX
TLSH
T137747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhczusmk.exe

Path C:\Temp\rpjhczusmk.exe
Size 361KB
SHA256 bb590381c2c24b1d2799a7ad3103b0985ed0e81c5f73a39b715a4e60d4abc78d
MD5 cc565da274d3af509040487fcf0a05ca
SHA1 66dd6a6d343af1f26ccf830c2ade9a5881ca9de4
SHA512 eb8f5be186d7e1a4b5e34393c2c7cbcda722ea83feff670b8aea70ad0e1d2b1a2d81339a43aa8dc3a8123d9ebf85a18d29c65140381e5b04416b0ab30bae96f1
SSDEEP 6144:+flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:+flfAsiVGjSGecvX
TLSH
T13E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tolgdywqoigbywqo.exe

Path C:\Temp\tolgdywqoigbywqo.exe
Size 361KB
SHA256 0c1933090ba2b6e70a4a5e3dfe5edb37de44babc13c36894a097fcaf75812f52
MD5 45b6bb357c9389f732bbbfde393e9349
SHA1 f1dc763d4e62db5c182b97e209abe56298fa4974
SHA512 728e72963d0bdfa034fc27f78eb18a0bbd3a2a24cad136e42c00c02626cccbe6de7402f9599e39a9fbbeb5cb4314c2b975969b8272a36df2f0408a88fec3a717
SSDEEP 6144:jflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:jflfAsiVGjSGecvX
TLSH
T13D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tolgdywqoigbywqo.sys

Path C:\Temp\tolgdywqoigbywqo.sys
Size 293KB
SHA256 c2c46354b3f049eb41a954a244e1c1405f1fc101e597f0806ec6b6e9664f1f0e
MD5 a4f9628fb1bb9455c2672502e76dbae6
SHA1 cf7cb77d777d745fd1d6a83643eb4a1771101a2d
SHA512 5dfcab4ce74a82b055fdeca6062475169300aebd2c885929475dfca46b6f3749e1a2378f4bd862bdd6bdddaf651523f610d8b71fb82fa25ccac0247da24f1ca4
SSDEEP 3072:vtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:vIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usqkhfdxvp.sys

Path C:\Temp\usqkhfdxvp.sys
Size 293KB
SHA256 9ce6bd901d32814f188e6ce2badd886ddbc121d7c1b00d288e36aec97a6ced64
MD5 0027d09e617a9e887061c5173b4a57e0
SHA1 8adc7174114475716adb3cf0e3509035e5b67b85
SHA512 477b266bf2aa5cb48a69b4770c3d66c49b5fb26f7dd811ff44cff67556ab71c396a250faa998b9b65e2bed8ad4e65263084e8901e6ff7ef84a414556949f11c2
SSDEEP 3072:4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:4IJjiJcbI03GBc3ucY5DCSj
TLSH
T1BA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpjhfzxrp.sys

Path C:\Temp\xrpjhfzxrp.sys
Size 293KB
SHA256 3309bc156fd02f886abce4d0df56ea444b65b5ccce4a8b108760f4d32983e4d2
MD5 a4efe88edd4d61975f21b61b51432d50
SHA1 d089d4ae3a2b438db45b66d60defb0ae2e99ce8f
SHA512 212d529815aad906ddec202199f7beff2b61a686cf728ed28ea018eda3af1faf10685048ac60604a577a1ee6abbf1df1e034d3af8760b50657ba18521272b198
SSDEEP 3072:ZtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:ZIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspnhfaxsp.exe

Path C:\Temp\xspnhfaxsp.exe
Size 361KB
SHA256 5750c157bfa2222e08875030917cfb0fcd3d421843c29cf78f970353c74affab
MD5 65426547a7586ee1e12871a6a7247a16
SHA1 71fbb55e1890f8f9467ba619a7253cfb05126bf0
SHA512 376dfc519797a47b61f1c6e14edb7195d7a463275026a39fd1a2606bd483615eceb3f1dbd052bf831de1fb2a59b22459b62f654cdd0ecbe5afd4842d74885e1f
SSDEEP 6144:IflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:IflfAsiVGjSGecvX
TLSH
T174747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xusnkfcxvs.sys

Path C:\Temp\xusnkfcxvs.sys
Size 293KB
SHA256 2647b7b04d1b0c3fd2ec5a42da84dd9ca81ecbd436fe986f8a5c641b4a799591
MD5 54f0bc56f26d508969dd732e0a734168
SHA1 c2744123131d125f6981ec9821e06f9c7dc85198
SHA512 bbcf03eb9c9fd879cf62d409894884f1258b799e1f9ec6a63501cdb82b0f45964c047acb4f9d50a36eb076f8078f2363ed1b6921edd27430db96290817a98ad1
SSDEEP 3072:StKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:SIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F0545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvsnlfdxvq.exe

Path C:\Temp\xvsnlfdxvq.exe
Size 361KB
SHA256 4eb400a5d7f94c8123ae6a36a7719fc77f2b8e7d27359be5f41cd1dd49cf2eea
MD5 275d2cb5f4ea5f9e83aa0dcd9ed89e1f
SHA1 47312b451ffce8788f493f648e83fe37fed8b48e
SHA512 e7a918929878c91f5ce597965f86609f7755366cc9807351c4446a6c8f33b27015869100ace165068f18c95f70bebd886b3687636510dbe32c26ad2c5cf5215f
SSDEEP 6144:LflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:LflfAsiVGjSGecvX
TLSH
T1DC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvtnlfdyvq.sys

Path C:\Temp\yvtnlfdyvq.sys
Size 293KB
SHA256 dc202339e232815a0da247ec1b0bea98d273467660d8e56557629377eb30b2e9
MD5 f8673252fd2fea246cadedba468b8ee6
SHA1 6a1058b73b50d03ed5eee03af0e7d0060536432d
SHA512 2b0504f5319a4c80cfffe2c66e7d55f951e6710f204f4863e012020a0735429b3607202c8a2311f77953c1f2ebffae41cb8954f8000f14a5c8180bf277a6c356
SSDEEP 3072:3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:3IJjiJcbI03GBc3ucY5DCSj
TLSH
T153545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 cb18b389a47938428b96a050dfd9418dec0d4154ea4ed0fe7240c531e977bfca
MD5 31d2cbe05413fc5a8b7dfa9c9f22c6f0
SHA1 8024d814cd91b043811d621ae8a8b48dc88fea21
SHA512 fb51d4ab20bb2090aa046ddf1eae0d6eb264c8c2c9d33cd4c59746c8b517d5371eb021c44535c181c2dd9cd227fe4cee571f18ade011b00a3ca6702db9a48f2f
TLSH
T12C4173125BB2CAD6DBA644F697D367A9F2F5C4090E17AE31C25CAD306582FE771C001B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ab47129360c96c787c5fa7442b7ad2e3850bd82b9b5e439889b9f68e35926ec0
MD5 e3b3578e4dc8f677bd003242a47d5d74
SHA1 31fb835f0c4388e6f4c8eccde73dd79502ffbd95
SHA512 d25bebe48cfa5f015711b3c386421ad93711adff77630fbc408a410749bba95f63a0c1ef20df3a39f7f5f27e8c5d3383ddbbf20171c94e152afdfff17735350f
TLSH
T10D418DF783F4856E8D0156F0AA146E1FCE2D0511832C7D6A89E4AE2B93E34B1E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4aef268af8f6e528ff9b0475eac933f2ba87c5a75ec159868d61063d9664c964
MD5 dc3c03b9c390708aa07291b9b38adb98
SHA1 ebe3210428bc23d2a7844a7ecb09ede7cde7560f
SHA512 afb7538e0d35d34e21bcb24cc4a2c5a0a74669a5cc1c1a0af6cde9428b2adcc21a0c2201f4cd2b114aabbe1aaa9ee5e098d5f8d9b284474555f541230f43d189
SSDEEP 192:sxRElbR2C8lP/fMl1sPaTl0ZKRlMzoA8p9J/g6+WNC+N/Yo5VDYIGoIgVgOJ:sxRSbHKP/fa1sPglKy9n/51/TDKa
TLSH
T15C42DA256D28A97B9CCBE21DBA15BF53D2F91032A0D41F08F6FC8A1C15E76DD620B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 22f3a02f90eadb5d8c6478bc2b78f32190adee33b7f9098be44109f94905a37c
MD5 77f77ef0b417d17b9be83f8999ec8556
SHA1 68754262dd52f220212c0fe22fba11a5dcc54c58
SHA512 6b64a1658c2c5e479c45a329bbdb2cb499dfbe0489eebc670565367b03cfb4bcdf3af05b54df4b72b683355ea77034015c515c06c98e3ef11a045523a5c715dc
SSDEEP 192:sxRTlbR2C8lP/fMl1spaTl0ZKRlMzoA8p9J/g6+WNC+N/Yo5VDYIGoIgD2gOJ:sxRJbHKP/fa1spglKy9n/51/TDja
TLSH
T15542DA256D28A97B9CCBE219FA55BF53D3F91032A0D02F08B6FC8A1C15D76DD620B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 eee9c5f10c084a1399f3bac2c8dc60ff7dab56c5e31ff8255d044c335ae8012d
MD5 4509aac43b68291fb12c313a068e4a3f
SHA1 7f03eb0d92241785bfc573160192ab24c5f16d84
SHA512 8074b64f7a4b98a3e36a53f554c2f173bf600ad6c9f3ac2a15e781545ba8561f9a9b85c8ed413b8c1fbf08d58593f102ac456611ab3968252cb4ef2e1847e7d5
SSDEEP 192:sxRTlbR2C8lP/fMl1spaTZ0ZKRlMzoA8p9J/g6+WNC+N/YooRDYIGoIgDsgOJ:sxRJbHKP/fa1spgZKy9n/51/KDNa
TLSH
T11342EA256D28A97B9CCBE219BA15BF53D3F9103290D02F08B6FC8A1C15E76DD620B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 d9d768516088f95b3d7502e3a8977f70e2b8fc2ba3d7e53da3791d048804637b
MD5 b8df5ca94b779d657ef96e5569ea509f
SHA1 2bc4eb88acf80f9955c7540728e8e0d9155ec4cf
SHA512 984c2bf24dca0a0ea3c61f46553bd7cd71b2153ec9a75a63e27513b2a292138abd39c1bdf5b96555a4ba1c73441d78700a98432b204c4b766b26d08255b0c4eb
SSDEEP 768:j26Hlo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVnzBVuwFro9ie0M:j26HlUE7MRWgs2f02u1jaQzB4w+JX
TLSH
T1A4D2DB7B640DCABF4F804ADDEC197E9F6D6802CB9698CD8047FD941C02C6BEA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 37ca649762f7c97aa7191f69c2ef13f711a06e297a5516bf9fb7d5adb0d86434
MD5 4797d95669d7902b627008b012c4d043
SHA1 bdfb40b319a3d02f96b5216d6da0be59f4441e13
SHA512 27b473bac57d1d2dee2a95ef583abd743ba5e7ca13ed477aeac9707f3506657f7979cc8030cc37c4cc2563560d8aa88debace6af5d9c7c9b95a4638caa338268
SSDEEP 96:KREEEFEwE0EOEyE2EUWESE/EfgE8EUK4ERgE2EUcE0E0E/EuEUEJHGbqGAoouWYX:C3gFB31lERe1JDggH2vHG5FaHGbqGAoB
TLSH
T12B915300B17E46C03D7E665DC4B4986BA6D174933409A92B37E812A90F6FE129DFCDCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a667c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a667c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 01ee13b04b2a98e4e66cd568fdbd9130975e5410613277502da0898c2d04c306
MD5 714101ce4f454b9e7dd04ed5711cdeba
SHA1 58710a8279ab626f9e3ef60986f1af2a92e98e38
SHA512 324ab6a8fe2924e98c10f616b2d2c27c95749d1a4a2d76ab1db1883a6455483c657516b474b03c1397a30f7a95b50ebaa053a94f753b412afd726deb66bf3885
SSDEEP 768:Jm37fe/TBOWCuttqONXyer1IRCzni9ifeu:Jm36eSIqndfeu
TLSH
T1F2F2AE74D8A59D234CE5E3C6B2466383BFB82063D9C84B50EDDA5F1E0587A5E130F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 cae58f9d863da8508e8bd053c0011bc2e67ca007f051fbcbc0508592531f1a43
MD5 32a83955318b91e21bae76340bda675b
SHA1 da518ca99938683626f446fc28f266e5882377d4
SHA512 e004e408c40845824f61d6726aced075266f8d229564066d5dda0a05ab207e388caaf34cb79bcdf3c18984b182e69dee9523ce98737d3b84e2bc164e1d41e934
SSDEEP 768:fm3afe/TBOWCuttqONXyer1IRCzni9ifeu:fm3xeSIqndfeu
TLSH
T1B7F2AE74D8659D234CE5F3C6B2466383BFB82067D5C84A50EDDA5F1E0587A5E130F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 7ac55eca52fd736cf34a62d434f23e2c20455daea9ec6a4a44ab740fcbd3e9b7
MD5 245979418be6828e415e41e642347094
SHA1 8423fb312a2e1fd7f1120eb2019449c9c742e168
SHA512 38be9aaa830bd4ca3ffbbf76e2b2499a659b4658964ee1aad387b0d03e8008bfcf18b9ae4dcfd724d721aec95607d0d68d543c73385ebf7d1b95f6af41531d6a
SSDEEP 768:Prv+4UNbdR3+ne/TBOWCuttqONXyer1IRCzni9ifO:Pbsb73/eSIqndfO
TLSH
T17403BE30E468EE238DE5A2C6B14B73937FB8206784C90B64EDDA5F5D058B59E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 bd1c4f87c74a8444faf3fff24e79c047e51645cf2489524468d0b1e42cddffb6
MD5 ad468937f1bb9ba7faeb3089b028b512
SHA1 98da87d9dd9c6e342941414c1ffbcee2786673b4
SHA512 ea0364fed4d13824936131c58fc27b544af9beee3dbaa96e5db7bc910f8010a06c18b849ab631d87e76aea5f58386e09ef90f15a5c1bca758c1b0219a108b301
SSDEEP 768:lm37fe/TBOWCuttqONXyer1IRCzni9ifeu:lm36eSIqndfeu
TLSH
T186F2AE74D8A59D234CE9F3C6B2466383BFB82063D9C84A50EDDA5F1E0587A5E130F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 1ac8ffb78c30cea14fbd34f3eca876e0346c0101ce961b239e66fe13640a0f56
MD5 4419a3ec508eb714f49d398626f50e1e
SHA1 85f6e91be0d2da706eaf573c1a25ad7f5c3b67ea
SHA512 0296eb12eccd8cfb7943258feac4f9597d6b2b83d95684273f84c41b76a735551f311203ae9c30d78c15dcb6dd4624b3215ded67ffa615569ffbbba2a15227d3
SSDEEP 768:9rv+4UNbdz3Xo/TBOWCuttYONXyer1IRCzniwieVH1SK7:9bsbV3YESIqneEH1l
TLSH
T10B03BF3194A9DE338DE6B396B14773437FB8206789840B90EDDA1F4E0A9759E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 da23655ddd4645c2ed6633738c7a679f34ee0bc58388f1b14169d481a108ee6a
MD5 fe6e7010f8efcab54ade0fa4afdf7bf9
SHA1 cb93b4999349dc55bc1d15eb6a3d5891db5f8923
SHA512 e973b610fae68c373ef82d5f0c63e1f9aec4e061c3e5d94b75bc5b6e027d35cbd5e8c81c0a782d6936c4968c3db80784252b6af3d4e645262f14bcd71a6dcc21
SSDEEP 768:QFQU3AwgNAdpsOWCutthONXyer1IRCzni9ifeu:DU3TASIqndfeu
TLSH
T1AF133AF584D38937D8AD9387A33D6E469EBCD063B4888590BBC55E1DCC865BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

d3bcdb53-2779-4f11-8324-3defcb0b39bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d3bcdb53-2779-4f11-8324-3defcb0b39bb.tmp
Size 38KB
SHA256 e7526093fd6a321e52cc704cb466de78f7501b655f0f4bd2b95efabc43f47e85
MD5 33d594f668717c5970bbd9051e0680d2
SHA1 64455e8aa0c10110c56bc84c4a97b7a08ea74c9b
SHA512 6484840296fa520d9f97e0409c3313ad7e22e216bb8c7e7bba5bb29b5a43ba07a8d1df2ba152f4f43c7da0aafba1d8b4696cf79e40a77c6234d2bc341772a078
SSDEEP 768:hrv+4UNbdz32z/TBOWCutsONXyer1IRCzniBOeVH1SK7:hbsbV3yySIqnBEH1l
TLSH
T11203CF36A4A89E338DE2A3C6B14773037FB86057C6840790EDDA1F4E069B99D130F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3976_182267770\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 8326bc510f2127a833b9d42b23fb30be0e4dc9ec301cec253f0845836382e2ce
MD5 8fc3578c9a80df773fdf9bf7b43b4180
SHA1 46a7f1df3db86e5b1de65b96185588b19dd62e8d
SHA512 9d075b0f52aaf17d81d2f830202b499f963f247855f6cb92f8abf250ed5692d2fc62cb769508adb6af4bfd20e27e1eb72b86033a03bb3d49cc1ca12de7561459
TLSH
T1427123C356BDC5B3C1DA9BF012835248F5FB227C076370240BA15946AB30A3A68BCF04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/252-336-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/720-489-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1312-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2448-317-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2876-434-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3236-218-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3236-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3408-414-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3480-389-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3636-493-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4208-260-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4292-410-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4672-390-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4672-369-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4720-293-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4780-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5080-471-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5084-233-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5244-340-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5508-280-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5836-466-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5836-473-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6036-185-0x0000000000010000-0x00000000000AB000-memory.dmp

Download