systex | 22c457c91746aee814843f2c750a834edb530158bd74b66f8f68b67cb3ca29e3

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260629-2ev64agx6x
SHA256 22c457c91746aee814843f2c750a834edb530158bd74b66f8f68b67cb3ca29e3
MD5 4f0dcb7e771b969b6d261e0ceef328ae
SHA1 2053e6b57905b6d65337aabc900aae0f23744faa
SHA512 61f74b51dfb53408600be699c009b13ac4f91aa9f7311cfa941dff99bff3226e1b107196dcb45a658b7841ea7de13ec666418ae1a90f36ff8ccb925a1db96ddf
SSDEEP 6144:UflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:UflfAsiVGjSGecvX
TLSH
T1A7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
964	dyvqnigdyvqnlfdy.exe
3404	dyvqnigdyvqnlfdy.sys
3616	CreateProcess.exe
908	fdxvtnlfdv.exe
4480	CreateProcess.exe
5680	CreateProcess.exe
5748	i_fdxvtnlfdv.exe
4936	xvsnlfdaus.sys
5076	CreateProcess.exe
5200	vpnifaxspn.exe
5364	CreateProcess.exe
4872	CreateProcess.exe
3628	i_vpnifaxspn.exe
5760	smkfcxvpnh.sys
5972	CreateProcess.exe
3744	pnhfzxspkh.exe
3060	CreateProcess.exe
5456	CreateProcess.exe
3024	i_pnhfzxspkh.exe
4268	pkicamkhcz.sys
2944	CreateProcess.exe
4744	hecarpmhfz.exe
5248	CreateProcess.exe
4948	CreateProcess.exe
5232	i_hecarpmhfz.exe
3124	mkecwupmhf.sys
3836	CreateProcess.exe
2248	hczusezwrp.exe
4788	CreateProcess.exe
2952	CreateProcess.exe
4764	i_hczusezwrp.exe
4416	urmjebztrp.sys
5596	CreateProcess.exe
5296	tromgezwuo.exe
4800	CreateProcess.exe
5132	CreateProcess.exe
2480	i_tromgezwuo.exe
5168	tromgebwto.sys
2604	CreateProcess.exe
2444	wqojgeywqo.exe
2960	CreateProcess.exe
4852	CreateProcess.exe
5344	i_wqojgeywqo.exe
4628	bwtolgdbwl.sys
1244	CreateProcess.exe
5780	tnlgdbvtqo.exe
1056	CreateProcess.exe
6000	CreateProcess.exe
2372	i_tnlgdbvtqo.exe
3164	tqligdbvtn.sys
300	CreateProcess.exe
5508	lgayvqnlvt.exe
4448	CreateProcess.exe
5648	CreateProcess.exe
2120	i_lgayvqnlvt.exe
3360	davsnlidav.sys
4784	CreateProcess.exe
3236	axvqnifavs.exe
3688	CreateProcess.exe
5760	CreateProcess.exe
2040	i_axvqnifavs.exe
1912	caxspnkfca.sys
5352	CreateProcess.exe
5744	causmkicau.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5000_1508627603\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5000_1508627603\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5000_910761774\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5000_919799995\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5000_371425064\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5000_1508627603\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5000_919799995\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5000_371425064\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5000_1508627603\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczusezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqojgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaywtrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoigbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifaxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaywtrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hecarpmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqojgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axvqnifavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifaxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkhfaxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axvqnifavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnifaxspn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczusezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tromgezwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgayvqnlvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqnigdyvqnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlgdbvtqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhecwurmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhecwurmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoigbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqlidavsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvtnlfdv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhcaurmkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvtnlfdv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnifaxspn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hecarpmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tromgezwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlgdbvtqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgayvqnlvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhcaurmkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqlidavsqk.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4556	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3824	ipconfig.exe
3148	ipconfig.exe
2724	ipconfig.exe
2244	ipconfig.exe
5828	ipconfig.exe
4996	ipconfig.exe
5636	ipconfig.exe
4148	ipconfig.exe
5828	ipconfig.exe
3668	ipconfig.exe
6124	ipconfig.exe
5916	ipconfig.exe
1540	ipconfig.exe
2660	ipconfig.exe
800	ipconfig.exe
4276	ipconfig.exe
2012	ipconfig.exe
4956	ipconfig.exe
4996	ipconfig.exe
3700	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{B7C272CF-1BEA-4D16-BF7B-8FEBF9BE747A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
964	dyvqnigdyvqnlfdy.exe
964	dyvqnigdyvqnlfdy.exe
964	dyvqnigdyvqnlfdy.exe
964	dyvqnigdyvqnlfdy.exe
964	dyvqnigdyvqnlfdy.exe
964	dyvqnigdyvqnlfdy.exe
964	dyvqnigdyvqnlfdy.exe
964	dyvqnigdyvqnlfdy.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5748	i_fdxvtnlfdv.exe
Token: SeDebugPrivilege	3628	i_vpnifaxspn.exe
Token: SeDebugPrivilege	3024	i_pnhfzxspkh.exe
Token: SeDebugPrivilege	5232	i_hecarpmhfz.exe
Token: SeDebugPrivilege	4764	i_hczusezwrp.exe
Token: SeDebugPrivilege	2480	i_tromgezwuo.exe
Token: SeDebugPrivilege	5344	i_wqojgeywqo.exe
Token: SeDebugPrivilege	2372	i_tnlgdbvtqo.exe
Token: SeDebugPrivilege	2120	i_lgayvqnlvt.exe
Token: SeDebugPrivilege	2040	i_axvqnifavs.exe
Token: SeDebugPrivilege	800	i_causmkicau.exe
Token: SeDebugPrivilege	2724	i_hczusmkecw.exe
Token: SeDebugPrivilege	6072	i_mkhcaurmkh.exe
Token: SeDebugPrivilege	3092	i_jhecwurmje.exe
Token: SeDebugPrivilege	5852	i_jhbztrljdb.exe
Token: SeDebugPrivilege	2332	i_oigaywtrlj.exe
Token: SeDebugPrivilege	5844	i_ywqoigbvtn.exe
Token: SeDebugPrivilege	900	i_tqlidavsqk.exe
Token: SeDebugPrivilege	5344	i_kifaxvpnhf.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5000	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 964	3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 3852 wrote to memory of 5392	3852	2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 5392 wrote to memory of 5000	5392	iexplore.exe	89
PID 5000 wrote to memory of 1652	5000	msedge.exe	90
PID 5000 wrote to memory of 4824	5000	msedge.exe	92
PID 5000 wrote to memory of 4556	5000	msedge.exe	91
PID 5000 wrote to memory of 4824	5000	msedge.exe	92
PID 5000 wrote to memory of 4824	5000	msedge.exe	92
PID 5000 wrote to memory of 4840	5000	msedge.exe	93
PID 5000 wrote to memory of 4840	5000	msedge.exe	93
PID 5000 wrote to memory of 5108	5000	msedge.exe	94
PID 5000 wrote to memory of 5108	5000	msedge.exe	94
PID 5000 wrote to memory of 5108	5000	msedge.exe	94
PID 5000 wrote to memory of 4228	5000	msedge.exe	95
PID 5000 wrote to memory of 4228	5000	msedge.exe	95
PID 5000 wrote to memory of 4228	5000	msedge.exe	95
PID 5000 wrote to memory of 1440	5000	msedge.exe	96
PID 5000 wrote to memory of 1440	5000	msedge.exe	96
PID 5000 wrote to memory of 1440	5000	msedge.exe	96
PID 5000 wrote to memory of 3820	5000	msedge.exe	97
PID 5000 wrote to memory of 3820	5000	msedge.exe	97
PID 5000 wrote to memory of 3820	5000	msedge.exe	97
PID 5000 wrote to memory of 4500	5000	msedge.exe	100
PID 5000 wrote to memory of 4500	5000	msedge.exe	100
PID 5000 wrote to memory of 3700	5000	msedge.exe	103
PID 5000 wrote to memory of 4084	5000	msedge.exe	104
PID 5000 wrote to memory of 3700	5000	msedge.exe	103
PID 5000 wrote to memory of 4084	5000	msedge.exe	104
PID 964 wrote to memory of 3616	964	dyvqnigdyvqnlfdy.exe	105
PID 5000 wrote to memory of 5764	5000	msedge.exe	108
PID 908 wrote to memory of 4480	908	fdxvtnlfdv.exe	110
PID 5000 wrote to memory of 5240	5000	msedge.exe	115
PID 5000 wrote to memory of 5240	5000	msedge.exe	115
PID 5000 wrote to memory of 3728	5000	msedge.exe	116
PID 5000 wrote to memory of 3728	5000	msedge.exe	116
PID 964 wrote to memory of 5680	964	dyvqnigdyvqnlfdy.exe	117
PID 964 wrote to memory of 5076	964	dyvqnigdyvqnlfdy.exe	121
PID 5200 wrote to memory of 5364	5200	vpnifaxspn.exe	123
PID 964 wrote to memory of 4872	964	dyvqnigdyvqnlfdy.exe	126
PID 964 wrote to memory of 5972	964	dyvqnigdyvqnlfdy.exe	130
PID 3744 wrote to memory of 3060	3744	pnhfzxspkh.exe	132
PID 964 wrote to memory of 5456	964	dyvqnigdyvqnlfdy.exe	135
PID 964 wrote to memory of 2944	964	dyvqnigdyvqnlfdy.exe	139
PID 4744 wrote to memory of 5248	4744	hecarpmhfz.exe	141
PID 964 wrote to memory of 4948	964	dyvqnigdyvqnlfdy.exe	144
PID 5000 wrote to memory of 3680	5000	msedge.exe	146
PID 5000 wrote to memory of 760	5000	msedge.exe	147
PID 5000 wrote to memory of 5080	5000	msedge.exe	148
PID 964 wrote to memory of 3836	964	dyvqnigdyvqnlfdy.exe	151
PID 2248 wrote to memory of 4788	2248	hczusezwrp.exe	153
PID 964 wrote to memory of 2952	964	dyvqnigdyvqnlfdy.exe	156
PID 964 wrote to memory of 5596	964	dyvqnigdyvqnlfdy.exe	160
PID 5296 wrote to memory of 4800	5296	tromgezwuo.exe	162
PID 964 wrote to memory of 5132	964	dyvqnigdyvqnlfdy.exe	165
PID 964 wrote to memory of 2604	964	dyvqnigdyvqnlfdy.exe	169
PID 2444 wrote to memory of 2960	2444	wqojgeywqo.exe	171
PID 964 wrote to memory of 4852	964	dyvqnigdyvqnlfdy.exe	174
PID 964 wrote to memory of 1244	964	dyvqnigdyvqnlfdy.exe	178
PID 5780 wrote to memory of 1056	5780	tnlgdbvtqo.exe	180
PID 964 wrote to memory of 6000	964	dyvqnigdyvqnlfdy.exe	183
PID 5000 wrote to memory of 5488	5000	msedge.exe	185
PID 5000 wrote to memory of 5488	5000	msedge.exe	185
PID 964 wrote to memory of 300	964	dyvqnigdyvqnlfdy.exe	191
PID 5508 wrote to memory of 4448	5508	lgayvqnlvt.exe	193

C:\Users\Admin\AppData\Local\Temp\2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-25_4f0dcb7e771b969b6d261e0ceef328ae_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Temp\dyvqnigdyvqnlfdy.exe
  C:\Temp\dyvqnigdyvqnlfdy.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvtnlfdv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3616
  - - C:\Temp\fdxvtnlfdv.exe
      C:\Temp\fdxvtnlfdv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:908
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4480
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxvtnlfdv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5680
  - - C:\Temp\i_fdxvtnlfdv.exe
      C:\Temp\i_fdxvtnlfdv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnifaxspn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5076
  - - C:\Temp\vpnifaxspn.exe
      C:\Temp\vpnifaxspn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5200
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5364
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnifaxspn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4872
  - - C:\Temp\i_vpnifaxspn.exe
      C:\Temp\i_vpnifaxspn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfzxspkh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5972
  - - C:\Temp\pnhfzxspkh.exe
      C:\Temp\pnhfzxspkh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3744
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3060
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfzxspkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5456
  - - C:\Temp\i_pnhfzxspkh.exe
      C:\Temp\i_pnhfzxspkh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hecarpmhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2944
  - - C:\Temp\hecarpmhfz.exe
      C:\Temp\hecarpmhfz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4744
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5248
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hecarpmhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4948
  - - C:\Temp\i_hecarpmhfz.exe
      C:\Temp\i_hecarpmhfz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczusezwrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3836
  - - C:\Temp\hczusezwrp.exe
      C:\Temp\hczusezwrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4788
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczusezwrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2952
  - - C:\Temp\i_hczusezwrp.exe
      C:\Temp\i_hczusezwrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tromgezwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5596
  - - C:\Temp\tromgezwuo.exe
      C:\Temp\tromgezwuo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5296
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4800
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tromgezwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5132
  - - C:\Temp\i_tromgezwuo.exe
      C:\Temp\i_tromgezwuo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqojgeywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2604
  - - C:\Temp\wqojgeywqo.exe
      C:\Temp\wqojgeywqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2444
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2960
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2012
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqojgeywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4852
  - - C:\Temp\i_wqojgeywqo.exe
      C:\Temp\i_wqojgeywqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnlgdbvtqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1244
  - - C:\Temp\tnlgdbvtqo.exe
      C:\Temp\tnlgdbvtqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5780
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1056
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnlgdbvtqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6000
  - - C:\Temp\i_tnlgdbvtqo.exe
      C:\Temp\i_tnlgdbvtqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgayvqnlvt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:300
  - - C:\Temp\lgayvqnlvt.exe
      C:\Temp\lgayvqnlvt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5508
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgayvqnlvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5648
  - - C:\Temp\i_lgayvqnlvt.exe
      C:\Temp\i_lgayvqnlvt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axvqnifavs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4784
  - - C:\Temp\axvqnifavs.exe
      C:\Temp\axvqnifavs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3236
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3688
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axvqnifavs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5760
  - - C:\Temp\i_axvqnifavs.exe
      C:\Temp\i_axvqnifavs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causmkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5352
  - - C:\Temp\causmkicau.exe
      C:\Temp\causmkicau.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5744
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:204
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causmkicau.exe ups_ins
    3⤵
    PID:1068
  - - C:\Temp\i_causmkicau.exe
      C:\Temp\i_causmkicau.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczusmkecw.exe ups_run
    3⤵
    PID:6088
  - - C:\Temp\hczusmkecw.exe
      C:\Temp\hczusmkecw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4068
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3416
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczusmkecw.exe ups_ins
    3⤵
    PID:2184
  - - C:\Temp\i_hczusmkecw.exe
      C:\Temp\i_hczusmkecw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkhcaurmkh.exe ups_run
    3⤵
    PID:5292
  - - C:\Temp\mkhcaurmkh.exe
      C:\Temp\mkhcaurmkh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4320
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkhcaurmkh.exe ups_ins
    3⤵
    PID:1396
  - - C:\Temp\i_mkhcaurmkh.exe
      C:\Temp\i_mkhcaurmkh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhecwurmje.exe ups_run
    3⤵
    PID:2532
  - - C:\Temp\jhecwurmje.exe
      C:\Temp\jhecwurmje.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1460
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3056
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhecwurmje.exe ups_ins
    3⤵
    PID:4940
  - - C:\Temp\i_jhecwurmje.exe
      C:\Temp\i_jhecwurmje.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbztrljdb.exe ups_run
    3⤵
    PID:4624
  - - C:\Temp\jhbztrljdb.exe
      C:\Temp\jhbztrljdb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3724
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3596
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbztrljdb.exe ups_ins
    3⤵
    PID:2268
  - - C:\Temp\i_jhbztrljdb.exe
      C:\Temp\i_jhbztrljdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigaywtrlj.exe ups_run
    3⤵
    PID:5036
  - - C:\Temp\oigaywtrlj.exe
      C:\Temp\oigaywtrlj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5792
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1856
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigaywtrlj.exe ups_ins
    3⤵
    PID:3284
  - - C:\Temp\i_oigaywtrlj.exe
      C:\Temp\i_oigaywtrlj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqoigbvtn.exe ups_run
    3⤵
    PID:4856
  - - C:\Temp\ywqoigbvtn.exe
      C:\Temp\ywqoigbvtn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2452
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3496
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5636
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqoigbvtn.exe ups_ins
    3⤵
    PID:2372
  - - C:\Temp\i_ywqoigbvtn.exe
      C:\Temp\i_ywqoigbvtn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqlidavsqk.exe ups_run
    3⤵
    PID:1240
  - - C:\Temp\tqlidavsqk.exe
      C:\Temp\tqlidavsqk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4216
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4720
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqlidavsqk.exe ups_ins
    3⤵
    PID:5868
  - - C:\Temp\i_tqlidavsqk.exe
      C:\Temp\i_tqlidavsqk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kifaxvpnhf.exe ups_run
    3⤵
    PID:5996
  - - C:\Temp\kifaxvpnhf.exe
      C:\Temp\kifaxvpnhf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6044
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kifaxvpnhf.exe ups_ins
    3⤵
    PID:3120
  - - C:\Temp\i_kifaxvpnhf.exe
      C:\Temp\i_kifaxvpnhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkhfaxspk.exe ups_run
    3⤵
    PID:5340
  - - C:\Temp\spkhfaxspk.exe
      C:\Temp\spkhfaxspk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:476
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3300
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:800
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffba56fc188,0x7ffba56fc194,0x7ffba56fc1a0
      4⤵
      PID:1652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,15063562362280789449,12340368634323628831,524288 --field-trial-handle=2552,i,9798052549983969843,7423758882009530195,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:11
      4⤵
      System Time Discovery
      PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,9533712424840679031,3592794636466680830,262144 --field-trial-handle=2552,i,9798052549983969843,7423758882009530195,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:2
      4⤵
      PID:4824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2196,i,12318239021198345261,2259182600057404687,524288 --field-trial-handle=2552,i,9798052549983969843,7423758882009530195,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:13
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,7380826575090622851,586505572152977384,2097152 --field-trial-handle=2552,i,9798052549983969843,7423758882009530195,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:5108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,12327253447534663865,5068582634290535392,2097152 --field-trial-handle=2552,i,9798052549983969843,7423758882009530195,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:4228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,14025964571849787592,10413343496100210535,2097152 --field-trial-handle=2552,i,9798052549983969843,7423758882009530195,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
      4⤵
      PID:1440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,3977013624496103768,11936299771170399128,2097152 --field-trial-handle=2552,i,9798052549983969843,7423758882009530195,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:9
      4⤵
      PID:3820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,12340463167962904379,17860004259189421567,524288 --field-trial-handle=2552,i,9798052549983969843,7423758882009530195,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
      4⤵
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,12672540265100148933,1206823513056490280,524288 --field-trial-handle=2552,i,9798052549983969843,7423758882009530195,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
      4⤵
      PID:3700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,9505399786218390793,18315581950276894467,524288 --field-trial-handle=2552,i,9798052549983969843,7423758882009530195,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
      4⤵
      PID:4084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,15399562956711345307,7474617890632459021,524288 --field-trial-handle=2552,i,9798052549983969843,7423758882009530195,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
      4⤵
      PID:2912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,15399562956711345307,7474617890632459021,524288 --field-trial-handle=2552,i,9798052549983969843,7423758882009530195,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,4611273176868309606,6247558419027985098,524288 --field-trial-handle=2552,i,9798052549983969843,7423758882009530195,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:5240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,5572863143558155155,14092530662828328577,524288 --field-trial-handle=2552,i,9798052549983969843,7423758882009530195,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
      4⤵
      PID:3728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,13788109661071907164,1685014514252626405,524288 --field-trial-handle=2552,i,9798052549983969843,7423758882009530195,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
      4⤵
      PID:3680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,9813474907582056749,12560977067490704605,524288 --field-trial-handle=2552,i,9798052549983969843,7423758882009530195,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
      4⤵
      PID:760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,16591200397276307488,12039903039753488733,524288 --field-trial-handle=2552,i,9798052549983969843,7423758882009530195,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
      4⤵
      PID:5080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4116,i,1242082223625697755,10896075281790375338,524288 --field-trial-handle=2552,i,9798052549983969843,7423758882009530195,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:14
      4⤵
      PID:5488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,1762768903789075575,3776953649472473862,524288 --field-trial-handle=2552,i,9798052549983969843,7423758882009530195,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
      4⤵
      PID:2896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,15331954570590679508,16974080765406075752,524288 --field-trial-handle=2552,i,9798052549983969843,7423758882009530195,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
      4⤵
      PID:5036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,1961032263256694650,4903883603372139504,524288 --field-trial-handle=2552,i,9798052549983969843,7423758882009530195,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
      4⤵
      PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5664,i,6699523670042193138,8011737177378845299,262144 --field-trial-handle=2552,i,9798052549983969843,7423758882009530195,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:10
      4⤵
      PID:6136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,4488861675546433176,12664391148503507397,524288 --field-trial-handle=2552,i,9798052549983969843,7423758882009530195,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
      4⤵
      PID:1912

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4788

C:\Temp\dyvqnigdyvqnlfdy.sys
C:\Temp\dyvqnigdyvqnlfdy.sys
1⤵
- Executes dropped EXE
PID:3404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6028

C:\Temp\xvsnlfdaus.sys
C:\Temp\xvsnlfdaus.sys
1⤵
- Executes dropped EXE
PID:4936

C:\Temp\smkfcxvpnh.sys
C:\Temp\smkfcxvpnh.sys
1⤵
- Executes dropped EXE
PID:5760

C:\Temp\pkicamkhcz.sys
C:\Temp\pkicamkhcz.sys
1⤵
- Executes dropped EXE
PID:4268

C:\Temp\mkecwupmhf.sys
C:\Temp\mkecwupmhf.sys
1⤵
- Executes dropped EXE
PID:3124

C:\Temp\urmjebztrp.sys
C:\Temp\urmjebztrp.sys
1⤵
- Executes dropped EXE
PID:4416

C:\Temp\tromgebwto.sys
C:\Temp\tromgebwto.sys
1⤵
- Executes dropped EXE
PID:5168

C:\Temp\bwtolgdbwl.sys
C:\Temp\bwtolgdbwl.sys
1⤵
- Executes dropped EXE
PID:4628

C:\Temp\tqligdbvtn.sys
C:\Temp\tqligdbvtn.sys
1⤵
- Executes dropped EXE
PID:3164

C:\Temp\davsnlidav.sys
C:\Temp\davsnlidav.sys
1⤵
- Executes dropped EXE
PID:3360

C:\Temp\caxspnkfca.sys
C:\Temp\caxspnkfca.sys
1⤵
- Executes dropped EXE
PID:1912

C:\Temp\qkhfzxspki.sys
C:\Temp\qkhfzxspki.sys
1⤵
PID:3300

C:\Temp\pjhczxrpjh.sys
C:\Temp\pjhczxrpjh.sys
1⤵
PID:4716

C:\Temp\kebzwrpjhe.sys
C:\Temp\kebzwrpjhe.sys
1⤵
PID:4628

C:\Temp\rojhbztrmj.sys
C:\Temp\rojhbztrmj.sys
1⤵
PID:5232

C:\Temp\wqojgebwto.sys
C:\Temp\wqojgebwto.sys
1⤵
PID:2648

C:\Temp\vtqligbytq.sys
C:\Temp\vtqligbytq.sys
1⤵
PID:1152

C:\Temp\qnlfdxvqni.sys
C:\Temp\qnlfdxvqni.sys
1⤵
PID:5108

C:\Temp\nkifaxvpni.sys
C:\Temp\nkifaxvpni.sys
1⤵
PID:1416

C:\Temp\causnkfdxv.sys
C:\Temp\causnkfdxv.sys
1⤵
PID:1268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dyvqnigdyvqnlfdy.exe

Path C:\Temp\dyvqnigdyvqnlfdy.exe
Size 361KB
SHA256 08f5b28f7068cab229ba0040da9eb8926fb80940b7046825924db3e8eab575e4
MD5 4f6c7bd3e99ebb5b08d3c1f9ec61fab9
SHA1 f5fb188ddf0ccaf1ae18721fb16fa48d7453434b
SHA512 6e66f1a56b77e575ded61592db2eec8da3ce0a48b582f0b5e6edda12a8894dc4995a6a54339855300c37ae5c9ca33561e56b588fd8308eec9a011b29bfb068d2
SSDEEP 6144:WflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:WflfAsiVGjSGecvX
TLSH
T104747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvqnigdyvqnlfdy.sys

Path C:\Temp\dyvqnigdyvqnlfdy.sys
Size 293KB
SHA256 4da8bb9b989409c232d8e48f06689f2cae526d56269b027720ad6639fd625423
MD5 bba0e6a6891ea079a9e01e608bb0c2b7
SHA1 0b1c7b3ea9fed2d2307444530c1a7a2e65bf2bc5
SHA512 494cc7e0b86339b12cae9af704fab46aa6001fc47ed55834513b28c912c8eb6c750cc57440e5637bbf4cbc469eac050f439dbc9b9cc5e041f5b2d30546f2d0d9
SSDEEP 3072:+tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:+IJjiJcbI03GBc3ucY5DCSj
TLSH
T1F3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvtnlfdv.exe

Path C:\Temp\fdxvtnlfdv.exe
Size 361KB
SHA256 b0317c81e92c98ef25b4fb624285b5a3cf15853420103485e9eac5df8867e7ab
MD5 c2765452c85947be97e02ce110dd7072
SHA1 2fbe581418fe642679144cf648b4f1bfe8ea9a86
SHA512 c795443ada5b0d83943358d103a1206796d7082c814c30847508fe22758e4bdbcb64d4897e743fc9282fff9b8e4aee21784397f145addc3aece75e732b30c938
SSDEEP 6144:ZflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:ZflfAsiVGjSGecvX
TLSH
T1E0747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczusezwrp.exe

Path C:\Temp\hczusezwrp.exe
Size 361KB
SHA256 8d1c9e45358d339f66b01a403470d4d413fc086cfdf793726b96017ee8b9a63c
MD5 b4c85cc827e3ad9299268ca6b17e4286
SHA1 471c991a73bdb80dc9b38b1ee04155b267e8c9c8
SHA512 fe091e5a8bdd417a023aa3127e53bc16b20bc23f5bd7e004daef0db7798cffbac7bf8a11fee6fa000749eea504ef353a2ce7a24b07a1cdf4cba33ea0ec1f0a84
SSDEEP 6144:bflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:bflfAsiVGjSGecvX
TLSH
T132747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hecarpmhfz.exe

Path C:\Temp\hecarpmhfz.exe
Size 361KB
SHA256 b9ed9e266503b7b902dd2af0912abec5e34a4ea8a52f60817829d5fd7c14e355
MD5 b1c1c8f1aebc92f624b6f2e9678b28d0
SHA1 a4a619211c9319e1465f178d7aac41890c7df07e
SHA512 bc736178e97030e4500efe50429373eb1d7bd79ff148e6ea45460ae14399274668758b0ca18022d20556e9b4997dc931f9ced68d0d61b2b06c20afdae167ef4d
SSDEEP 6144:2flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:2flfAsiVGjSGecvX
TLSH
T1FA747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxvtnlfdv.exe

Path C:\Temp\i_fdxvtnlfdv.exe
Size 361KB
SHA256 6a367b9aec8d0707ff3927a1fb049c3d1c2604cc209ebea377548b7f9bf9cdb0
MD5 52b112a12d1c747e9ab61d5514ae62df
SHA1 b6afcdbe6b11cc359b50d6b93b31e91bf29cea09
SHA512 e2ef6a93d899a51e67d6c4cfba9bca7f00cc428ffc582255eeec1c7e1ab56c92b7d50c38a3945dfe4439846a1b24880f045d7ff0ea78f02b43a528e1970bb603
SSDEEP 6144:fflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:fflfAsiVGjSGecvX
TLSH
T1BB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hczusezwrp.exe

Path C:\Temp\i_hczusezwrp.exe
Size 361KB
SHA256 d15df1de1d0dea2a7f1818c42f3bf904644dd736cb873471ef48ad8d2512fc88
MD5 99be710b253b0bf3655f9a3ee8bce69b
SHA1 7e18a62f078722ee3b04182f09569614bb34ecfa
SHA512 7412982db5cd1fe37f6ddbe11d89babebf49567813a8514708fbb03547de8ea084aa71dfed6a6d22dc978b01495f4e86d30cee697e850a25d7f7500c4b2f9214
SSDEEP 6144:5flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:5flfAsiVGjSGecvX
TLSH
T1D5747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hecarpmhfz.exe

Path C:\Temp\i_hecarpmhfz.exe
Size 361KB
SHA256 f1133b0b94a9df6fad23d3269057d60f3a2172b432f0814671fe46ab899d7e14
MD5 609381264a2775252fd78baf3ecf301e
SHA1 d5a262b748445355ceef52893ff209530157b9e6
SHA512 c46dd2357a75030c7f0b83d9241063828e1988a92c4b055ed1f53e14cd0b2949213acc763435d1248369a007e5d301d52904570ba2720c7bbddfb6bbdcc3773a
SSDEEP 6144:CflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:CflfAsiVGjSGecvX
TLSH
T1D8747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnhfzxspkh.exe

Path C:\Temp\i_pnhfzxspkh.exe
Size 361KB
SHA256 9862983ab584704103b69e111f41bdcdc9c2c6d56781ae9ffbbf1cd02aa23186
MD5 d00c5153c24bc8b608bb40743305073e
SHA1 cad86f67b2e9f3b7b949749bdd89f11faaa4ddf0
SHA512 244e8695f269dde689af6816a6b11927ba859d05f41025da228d1cab3ea6b53caae3f0b725840ac08d66a4e4dacf71ce8cf9a6477d1a0a92168c030326a1cdba
SSDEEP 6144:7flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:7flfAsiVGjSGecvX
TLSH
T119747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vpnifaxspn.exe

Path C:\Temp\i_vpnifaxspn.exe
Size 361KB
SHA256 156c656bd96169ae2dd4122e7b692f4f8d1320ab0e61f103d64c3d1fbf991885
MD5 3d79a33bbb847e13b323b2d334872ce3
SHA1 952e0e98ed917caa6373e4d79ad2335d4abb3a07
SHA512 42cbf72ce478b9038f4193ccfff71e8d0f5788dfcf8eb7fa2d0cc8739e542e89e4beee2696ed19d24280057efe050f4af9bc46c30c75b85a3d04a6085103a413
SSDEEP 6144:pflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:pflfAsiVGjSGecvX
TLSH
T12D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecwupmhf.sys

Path C:\Temp\mkecwupmhf.sys
Size 293KB
SHA256 9378199f67f716d44f45d0c3b626e626de752ba9798c7ae8bb7b83d86e001bb7
MD5 a54d36542b808aaa03252e04d4a27604
SHA1 6e2c8cb7e1bfd6a56f34429dcb5d43e72b5d2869
SHA512 5c51dddbe3ba461bbdfa75aaac5c6a6bf42fcd3bfcb04dc66a20a3cc0122bc0d367953bef05f0f98148de09d00cffdd523be888fcf1b64477bc088d55c4d276f
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T191545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkicamkhcz.sys

Path C:\Temp\pkicamkhcz.sys
Size 293KB
SHA256 b3f47667a90d6786cf3b7e6d93cb763bf5650b48658eb138adf145f6e7c9b45f
MD5 8c20a7fae3999b3d1e5b1f4acd4befe8
SHA1 53964c086cc6451c7ef3a933046ecacc3f80355c
SHA512 7676d61451fb50625e7b060fe74aeef706e46d25631a3d195cc37b4c5c150984930dffd4cd8aaa4b888a78366184092fe808ca54849d7c71fd5b55cc2db63f5f
SSDEEP 3072:6tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:6IJjiJcbI03GBc3ucY5DCSj
TLSH
T14B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfzxspkh.exe

Path C:\Temp\pnhfzxspkh.exe
Size 361KB
SHA256 59fc65325d44635ebe8eb4d794271fcb6ff62aea9fc28e53d0abe5871b1e1e04
MD5 784939c596635073176f84ff6413456f
SHA1 4209338686df7032182e01f5e0408b8573251c82
SHA512 a10ee6b552c10053d8936823c72d6e79254f2c03886a7ad626808ca3abea35469cfef81a00352516ccdac05f794e54a30d40296f8a38dad3df57988dac5fb6f1
SSDEEP 6144:ZflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:ZflfAsiVGjSGecvX
TLSH
T1ED747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkfcxvpnh.sys

Path C:\Temp\smkfcxvpnh.sys
Size 293KB
SHA256 0dd388ddbba4fbbe1b75c4389a27cd1b7cc4df480a2cf668741e581936e5fbd6
MD5 4fd8b10d64bd9f9f63b704dc37fcd899
SHA1 00304cbd3430a82b3644f17b5bb14c23def5cc82
SHA512 141f167898cc14c65b8651b0633cc31af1e7d5c6b95fe3c43d7b82d524024e784822342cb1b87739178e50fdaa297f25d69322d21f9779f7b38f5f34793f97b4
SSDEEP 3072:jtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:jIJjiJcbI03GBc3ucY5DCSj
TLSH
T144545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tromgezwuo.exe

Path C:\Temp\tromgezwuo.exe
Size 361KB
SHA256 3cee840ad24bd59f53688328aa96a63537f75866aecad4c7d5eb0cbc2ad78327
MD5 7466038dc8692590270f78dc1015cf4f
SHA1 c9b40eab122aeaf6424b2670b0eef554d91052d9
SHA512 a0e8303897b954eb83f9a7f8f8184f95c7880a0ceb1dee63688534b4346bda2316a4f228d3c1fb258970213804c31f3d96b2f542763af23974782438c6c2aeeb
SSDEEP 6144:cflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:cflfAsiVGjSGecvX
TLSH
T134747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmjebztrp.sys

Path C:\Temp\urmjebztrp.sys
Size 293KB
SHA256 c562df1df266a74405cf028337f70faca6b57c1f3e9c9493037cda40b361656e
MD5 076b22ae97ff9e06ba8a1df97495e413
SHA1 af250b2981cb6f530b015d698e8d2330bb4aadb0
SHA512 e41acb6cb93bb698e5974be1c591419f290392cac026d654a83532c88e0ef79ea9b1c0429d4c9a899f495826560326d6b1256f9580183199f78d3dc15928995f
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T178545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnifaxspn.exe

Path C:\Temp\vpnifaxspn.exe
Size 361KB
SHA256 6d7a2a4e8100d76116bd6b6d0e755a8117e48beae5a799340b2a85d2fc53dca2
MD5 38b42754049782e0c3bea357978fecfa
SHA1 f9441c81dcb30ce4e734b9dd794a67990b0e2cc9
SHA512 ca51491455f03f5c0b4127997b17f3c154e36adee013d8d24ce3cc4474b9f612c5cbd9dd9a25ddc3552f8c11276a19b6c7998862290f437d63f5af57b407f87d
SSDEEP 6144:wflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:wflfAsiVGjSGecvX
TLSH
T1CD747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvsnlfdaus.sys

Path C:\Temp\xvsnlfdaus.sys
Size 293KB
SHA256 adaf600ee1071a9a769039903b798603fc0659e0eb8e1a78bb5e2dda2bd5ffed
MD5 339f1716a864252f22d940087551acbd
SHA1 a9f9424c7af527d0302ebdc4d1e3f13678d3231a
SHA512 5475113ff321c2f13bf378f6ea3285a73b7e8e69233c3cb8863f59ecbd80e4db69a0556d22507c86c4aafb5371d1d298115ec794555593737f553afbfec95f6b
SSDEEP 3072:YtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:YIJjiJcbI03GBc3ucY5DCSj
TLSH
T178545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e1a5fea1006889b9c3bcf0a470a6a4256d5300a4b7036038ddce5fd042c424c
MD5 e9af81b8f1175d007e2c699939cb3df6
SHA1 696178bffe86e4e363a26747d6a5cb80e28621ce
SHA512 38174d529846c50b0af9a056e65ca491645c3cbf1fb867ef22a3b7c7ee4287ba29c3a28d736bc2e9c562faa24bb671db3b9cc40507a467140e47eaa4aeae6d51
TLSH
T145D0C0343E38F408C540207AE4514310E3138131302B8242B010F03DEC581810BDE0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 674d24008448b140a9b320032b4ed333cf5a592b073bf375c453c816d33c703b
MD5 b989ec4e221bd567659492bc1ad7ab3b
SHA1 372670805b3060960e77e6ba32a3b9edd0241cf0
SHA512 f6934e6a831bcac97110107a79389dae0e669b743e0d62e5b411c19471bf237f4d61c7cee27d9fcacbd7045cbe27e78b4e6c38f6e76ca789a7760295558b0bb3
TLSH
T1CBD0C0383E28F508C5402076E4504310E3238131742B8242B010F02DEC581810BDF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c550e04344b0fcb346096d72925b728987cfa2006f148de78f59867696feee94
MD5 816ef2a5b4ff156e10a8c3ea8a4a7378
SHA1 539611d10092fa55168b3bf7c9b9c084827833b8
SHA512 0e3a46fc22118bb3adbee99a8dad4b88e1daf4b4b3b1797525ffcb1effed1e61ea8638d9ed6f02e1c15cd6ba6bb16649dfdf83f8b568fbcf1fc774c8f7831137
TLSH
T19561930AE8C30981D72702F427E201E43738EA9E69C31D27044CE57DB6E57D6AE52839
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590093.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590093.TMP
Size 3KB
SHA256 e140496619c89f1ceb4d0ff617a3946799ae8a19abf30aeba9dbf1360296b839
MD5 9f35b41551102653a96e315748211852
SHA1 ce1698ef958a2c9b75f8099b3d395dd87cdb8d61
SHA512 ef44029c10a719fba953c6cc15c575f5960ee6eb204841cca8ccc4303ed457fb2151e5d91d79ded51fb35d6e41c670ae65177423e147c144b42be3f640a38c98
TLSH
T13961930AE9C30981C72702F027E201E43738EB9E69C31D27004CE57DB6E67D6AE52839
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a9cd83641bf0dd0b96d4eefac598efb26a02fd285b6834cd0b7068cc6ffa9217
MD5 5bcce6afb39ccbb3e922741acc841e77
SHA1 fa5aa5fd0c0b608ad0d47eb21712710f40791116
SHA512 6e5eb2ffc53c9d7011177dd305b660f12f116544ebdb2333f6fd7751a317874203d7bc7066004a89b666c7bd71310647d5514f126b0dc4dfed197c124ccad3b7
TLSH
T1BF51BBF7C3E4866EC91196F0AA187E2FCE1D0911832C3D5AC9E4AF1B93E2471E141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 524945d18510c52231fd66dbb48a04915e864d9cf199d711a9ea965a9aae75cb
MD5 3062ccf4906bb0c34bcbcbc1bd3d14a4
SHA1 abd13ac3300339a32aca8ce842899baadd5fecb8
SHA512 2f0064d7e3e83fce8367988bbf5bfdfe7b916fe59eb156b97e0f4e66d23f30582598dd30ba8b9840bc8d527f4338da08abfb9826226dc0b21ed014516d9e2e8e
SSDEEP 192:sxRrREyM/jK1Ml8wcY/f4eJs+mEZ12+qzoA8p9z/g6+WNCPs/Y+SuF7G0mIgDHJ:sxRr2CY/f4eJs+m61Bn9/5d/dFAt
TLSH
T18462F916AA34597B8CDBD209FA557F53D2F91073E2901E48AEFC8A1C05E76DC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 cc6c92826ea16c27171ad125bc0adb7cc4c97500acb413be81eede471f5c672c
MD5 12d69c209f261fce78c46bc7d42511cf
SHA1 be710b7f69a1139ce2b6f0226ccf1ed19d84a113
SHA512 ffe304fe67dd7a16e37fce98af675e048277590808ea1183a6b3227b0c2b6309651fc4120884eb24e453aebe430f77943a644c52852eed3dd7c72aa375383b15
SSDEEP 192:sxRrREyM/jK1Ml8UQpcY/f4eJs+mEZ12+qzoA8prz/g6+WNCPs/Y+auF7G0mIgDp:sxRr2q+Y/f4eJs+m61Bnn/5d/ZFAt
TLSH
T10A62FA16AA34997B8CDBD209FA557F53D2F91472D2940E48BEFC8A1C01E76DC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 00e320de557d64f05162da72f98c5749da33a1dc351aa8205c63739b21d737fb
MD5 b4975ea7fe7100359f96a3e706070dec
SHA1 b0cd2ebf7af1634bb35650de43f553522db70cd0
SHA512 61b030eb1cbd738c7a161ef0228638e469b311cae23f0140dc46cd882631ae08570f288b8e8c5ced4fa26cfe2cf74df707a13b01b1f76264264b1e030aa2ffb2
SSDEEP 192:sxR0REyM/jK1Ml8wcY/f4eJsLmEZ12+qzoA8p9z/g6+WNCPs/Y+SuF7G0mIgtJ:sxR02CY/f4eJsLm61Bn9/5d/dFA3
TLSH
T17E62FA15AA34593B8CDBD209FA557F53D2F91573E2901E48AEFC8A1C05E76DC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 660331823b1bbb741d3ae8b689f80b06cdc4f4e793e99ee3a9bf9f5e5672de1c
MD5 ffcd0d315af7d6b9cb6258659a453d5e
SHA1 354165dc8c1f551bfea74b53413b4c2043912891
SHA512 f2b1620aa5acb6fa9ba6aa4d56776621389da658e641c7977f982b8fa366bc15cf95e8c1c716dc4b79774f497644aeaffdaeed157b0b8982bccf63a92452aeb3
SSDEEP 768:7dUhBR7pLuL7tgWgEyf3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OVowGe0GJroddlp:7dUhBHE7tgWgEyf3wu1jaHwGRGidTp
TLSH
T179E2EB3B680CCB7F4F404ADCE829BD9AADA901CF9698CD5447EA840C03C67EF551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe599d01.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599d01.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 aeea00773a38f749086a3d4ba3d41c588ae76cc7052c6786ca4b470038c7d29a
MD5 8148745e19b18b7226b8afedd1102e9d
SHA1 0c0e9f9f277ec280ab16233be08a5063d9b3bf57
SHA512 5b33bc0eec2d2e74d1e9a082ee0aca20774d24eed6d213688dbe0ad9261fda03ea9864d390d7326af47434d7c6a13bbe5db1269cceb7189654d1ffcc1b0e13c7
SSDEEP 768:Crv+4UNbdQ3m15ztfMcvnWgWWR+2SrXH78tRMZa:CbsbS3UJPWg1bSroka
TLSH
T12603CF31B8649D738CF2E285B106B793BEF41093C5C95F88D4DA5B4D428B9DE2B0BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b1104923d6b1462b66976a8b094bb4d70e322ffda446b2e0dc8eeca68c3487b8
MD5 8e674f483fbbb74417661520bb3da867
SHA1 75bf245aa9a9a05b0b6a1526aa1c388e5e020c85
SHA512 fb95e4fcb934a7e148fd227120ff087b886a887124815eae57f68b816080d09af07c2425a84b5a5acc48927083cf37288d6ec6422031aecb6f2a8e77f30d0190
SSDEEP 768:fj+9O3T15ztBMcvnWgWWR+2SrXH78tRMZzn12bfJuK:S9O3XJPWg1bSrokByJuK
TLSH
T16FF2BE32AC655D738CE2D285B2067393BEE401E3C5CD2E58C4D94B4E429B6DD2B0BD3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 7776e1162242156485a63e58fd0051502e5642e859006d04b68c7587af48780c
MD5 3571883a26315c4dd687a05d6c323309
SHA1 66841cca0d92e319e48fdd4d398c76976f1189b3
SHA512 a6a9327513c61f09af796d968e7ce4a55b6441dbf45e8efd679b192cbd99919bd21d74ba47725964087127318930cca32c1f11862ff3acfab4a844fceed340e1
SSDEEP 768:oF1j+9O3zwgs3PtfMcvnWgWWR+2SrXH78tRMZzn12bfJuK:F9O34JPWg1bSrokByJuK
TLSH
T1701317F698D78932D8AE8787A33D6E42ADBCC093B5885984B7C44D4DCC871BFD606825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 370b0da7c5bb46b692dc23cee0c35321ebaa2bcc007d3e6f03ed5eca2ad0caa8
MD5 8da5dcd0b0943ce07411cc9b374f4b6f
SHA1 de384c47cca79df481ce0e2fdbfbae6d287b35e6
SHA512 104ab05d0b93e029e62ffc83cc80ed49f4ae5ea931f3bfa5717953d98ccc87b81b27209e07f55f9713b98d7b925275ec41fde0409bbb519bc5ba88d4b879830f
SSDEEP 768:Orv+4UNbdp3yj5ztwMcvnWgWWR+2SrXH78tRkyY+8rr6F:Obsb/3jJPWg1bSropYDr6
TLSH
T12C03BF32A8689D73DCF2D685720A76437FF44183D6C91B88C4D91B4E429F9DE270BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5000_1114629213\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 d18cd601b62ff7c54b049da143218c3cb1bf18c250b59412a73aad91d1157180
MD5 bdc096232ae4720d4f1a668ff7bb7ea1
SHA1 2cca03dc97105e8c2c3ed776659b54c4b2e80742
SHA512 d8fec7b834e67b87a14610ad4909bde0ca249cd263a79b64028be57c4df9a8bc2e4f3a916f23761603babeade8a5286acf4d9afeb2f7d3a3e6757b7096acdf45
TLSH
T1F171238366B9C6B2C5DE5BF103839244F2FB2338076330200B955586AB30B3A64F8F48
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1152-459-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1268-508-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1416-491-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1912-378-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2648-454-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3124-286-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3164-345-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3300-398-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3360-349-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3404-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4268-274-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4268-292-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4416-301-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4628-422-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4628-330-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4628-443-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4716-418-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4936-199-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5108-479-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5168-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5232-442-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5760-246-0x0000000000010000-0x00000000000AB000-memory.dmp

Download