systex | f20e9fcb60b72cdf8a124922227640c7a9ef7f2ff59b51384b7cd8f2d3985f0a

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260629-e9xbbads5y
SHA256 f20e9fcb60b72cdf8a124922227640c7a9ef7f2ff59b51384b7cd8f2d3985f0a
MD5 9ca6add0a724064c8c2559487cbdfa3a
SHA1 1e603cf00f013d06cc00b80314d0169d250775e2
SHA512 4573caba797d39f8886445c1f5a65ef34569c1cd64f2f6d171ee6c25503c72d71e07ed14b9579b3649839dd7e5b2f0acfb63e94ee417fc47af5dc99da38c500d
SSDEEP 6144:1flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:1flfAsiVGjSGecvX
TLSH
T166747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5548	wuomgeywrojhbztr.exe
3304	wuomgeywrojhbztr.sys
4728	CreateProcess.exe
1720	bwtrmjeywu.exe
4160	CreateProcess.exe
1344	CreateProcess.exe
2356	i_bwtrmjeywu.exe
5900	eywrojgbzt.sys
3304	CreateProcess.exe
3028	zwroigbywq.exe
2176	CreateProcess.exe
2028	CreateProcess.exe
1380	i_zwroigbywq.exe
5752	qljdbztqol.sys
4132	CreateProcess.exe
612	dbytqljdbv.exe
560	CreateProcess.exe
5312	CreateProcess.exe
5352	i_dbytqljdbv.exe
2524	vqolgdyvqo.sys
3092	CreateProcess.exe
4140	tnlgdbvtnl.exe
2600	CreateProcess.exe
4704	CreateProcess.exe
5008	i_tnlgdbvtnl.exe
2000	lfdavtnlfd.sys
3744	CreateProcess.exe
6012	yvqnifdxvs.exe
1444	CreateProcess.exe
5768	CreateProcess.exe
3832	i_yvqnifdxvs.exe
2836	mkifdxvpnh.sys
4564	CreateProcess.exe
960	pnhfaxsqni.exe
3860	CreateProcess.exe
5016	CreateProcess.exe
5140	i_pnhfaxsqni.exe
4320	cxvpnhfzxs.sys
1388	CreateProcess.exe
2324	smkfcwupmh.exe
5948	CreateProcess.exe
3524	CreateProcess.exe
2140	i_smkfcwupmh.exe
5988	usmkecwusm.sys
3148	CreateProcess.exe
2628	xrpjhczxrp.exe
3316	CreateProcess.exe
616	CreateProcess.exe
1424	i_xrpjhczxrp.exe
2160	zwromhecwu.sys
2836	CreateProcess.exe
3596	wuomhecwuo.exe
5216	CreateProcess.exe
5732	CreateProcess.exe
4560	i_wuomhecwuo.exe
5832	ljgeywuolj.sys
5820	CreateProcess.exe
1436	omjebztrom.exe
4864	CreateProcess.exe
1608	CreateProcess.exe
2140	i_omjebztrom.exe
5420	ywqomjebwt.sys
3380	CreateProcess.exe
2580	tqljdbytql.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1100_2097364292\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1100_90455948\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1100_1498650949\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1100_1498650949\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1100_1498650949\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1100_200625711\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1100_2097364292\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1100_90455948\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1100_1498650949\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqnifdxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqligaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtrmjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqligaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdyvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlgdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczxrpnhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtrmjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwroigbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqnifdxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkfcwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhczxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqomgdbvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhczxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqljdbytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axspnlfcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtrmjeywu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwroigbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfaxsqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomhecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjebztrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjebztrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqljdbytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgeywrojhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomhecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdyvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axvpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczxrpnhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxuomkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfaxsqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkfcwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axspnlfcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axvpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxuomkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqomgdbvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtrmjeywu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlgdbvtnl.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5828	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5496	ipconfig.exe
4896	ipconfig.exe
1484	ipconfig.exe
4512	ipconfig.exe
1116	ipconfig.exe
3804	ipconfig.exe
5944	ipconfig.exe
5580	ipconfig.exe
5932	ipconfig.exe
6032	ipconfig.exe
4864	ipconfig.exe
1748	ipconfig.exe
5208	ipconfig.exe
3512	ipconfig.exe
3844	ipconfig.exe
2484	ipconfig.exe
1152	ipconfig.exe
2468	ipconfig.exe
3832	ipconfig.exe
756	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271815499611777"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-28459746-3881314244-166055492-1000\{45886F82-7DBF-4C59-ACCD-92A0302CF68E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5548	wuomgeywrojhbztr.exe
5548	wuomgeywrojhbztr.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5548	wuomgeywrojhbztr.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5548	wuomgeywrojhbztr.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5548	wuomgeywrojhbztr.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5548	wuomgeywrojhbztr.exe
5548	wuomgeywrojhbztr.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5548	wuomgeywrojhbztr.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5548	wuomgeywrojhbztr.exe
5548	wuomgeywrojhbztr.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5548	wuomgeywrojhbztr.exe
5548	wuomgeywrojhbztr.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5548	wuomgeywrojhbztr.exe
5548	wuomgeywrojhbztr.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2356	i_bwtrmjeywu.exe
Token: SeDebugPrivilege	1380	i_zwroigbywq.exe
Token: SeDebugPrivilege	5352	i_dbytqljdbv.exe
Token: SeDebugPrivilege	5008	i_tnlgdbvtnl.exe
Token: SeDebugPrivilege	3832	i_yvqnifdxvs.exe
Token: SeDebugPrivilege	5140	i_pnhfaxsqni.exe
Token: SeDebugPrivilege	2140	i_smkfcwupmh.exe
Token: SeDebugPrivilege	1424	i_xrpjhczxrp.exe
Token: SeDebugPrivilege	4560	i_wuomhecwuo.exe
Token: SeDebugPrivilege	2140	i_omjebztrom.exe
Token: SeDebugPrivilege	2780	i_tqljdbytql.exe
Token: SeDebugPrivilege	2804	i_tqligaytql.exe
Token: SeDebugPrivilege	4304	i_nlfdyvqnig.exe
Token: SeDebugPrivilege	5044	i_axspnlfcau.exe
Token: SeDebugPrivilege	5300	i_axvpnhfzxs.exe
Token: SeDebugPrivilege	5560	i_hczxrpnhfc.exe
Token: SeDebugPrivilege	4296	i_zxuomkecwu.exe
Token: SeDebugPrivilege	1128	i_bwtrmjecwu.exe
Token: SeDebugPrivilege	1544	i_wqomgdbvtq.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 5548	2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 2892 wrote to memory of 4240	2892	2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 4240 wrote to memory of 1100	4240	iexplore.exe	91
PID 1100 wrote to memory of 5748	1100	msedge.exe	92
PID 1100 wrote to memory of 5828	1100	msedge.exe	94
PID 1100 wrote to memory of 2364	1100	msedge.exe	95
PID 1100 wrote to memory of 2364	1100	msedge.exe	95
PID 1100 wrote to memory of 2364	1100	msedge.exe	95
PID 1100 wrote to memory of 5412	1100	msedge.exe	96
PID 1100 wrote to memory of 5412	1100	msedge.exe	96
PID 1100 wrote to memory of 5932	1100	msedge.exe	97
PID 1100 wrote to memory of 5932	1100	msedge.exe	97
PID 1100 wrote to memory of 5932	1100	msedge.exe	97
PID 1100 wrote to memory of 3256	1100	msedge.exe	98
PID 1100 wrote to memory of 3256	1100	msedge.exe	98
PID 1100 wrote to memory of 3256	1100	msedge.exe	98
PID 1100 wrote to memory of 3452	1100	msedge.exe	99
PID 1100 wrote to memory of 3452	1100	msedge.exe	99
PID 1100 wrote to memory of 3452	1100	msedge.exe	99
PID 1100 wrote to memory of 4992	1100	msedge.exe	100
PID 1100 wrote to memory of 4992	1100	msedge.exe	100
PID 1100 wrote to memory of 4992	1100	msedge.exe	100
PID 1100 wrote to memory of 2372	1100	msedge.exe	101
PID 1100 wrote to memory of 2372	1100	msedge.exe	101
PID 1100 wrote to memory of 1760	1100	msedge.exe	105
PID 1100 wrote to memory of 1368	1100	msedge.exe	106
PID 1100 wrote to memory of 1760	1100	msedge.exe	105
PID 1100 wrote to memory of 1368	1100	msedge.exe	106
PID 5548 wrote to memory of 4728	5548	wuomgeywrojhbztr.exe	107
PID 1100 wrote to memory of 5280	1100	msedge.exe	110
PID 1720 wrote to memory of 4160	1720	bwtrmjeywu.exe	112
PID 1100 wrote to memory of 1224	1100	msedge.exe	115
PID 1100 wrote to memory of 1224	1100	msedge.exe	115
PID 1100 wrote to memory of 5692	1100	msedge.exe	116
PID 1100 wrote to memory of 5692	1100	msedge.exe	116
PID 5548 wrote to memory of 1344	5548	wuomgeywrojhbztr.exe	119
PID 5548 wrote to memory of 3304	5548	wuomgeywrojhbztr.exe	123
PID 3028 wrote to memory of 2176	3028	zwroigbywq.exe	125
PID 5548 wrote to memory of 2028	5548	wuomgeywrojhbztr.exe	128
PID 5548 wrote to memory of 4132	5548	wuomgeywrojhbztr.exe	132
PID 612 wrote to memory of 560	612	dbytqljdbv.exe	134
PID 5548 wrote to memory of 5312	5548	wuomgeywrojhbztr.exe	137
PID 5548 wrote to memory of 3092	5548	wuomgeywrojhbztr.exe	142
PID 4140 wrote to memory of 2600	4140	tnlgdbvtnl.exe	144
PID 5548 wrote to memory of 4704	5548	wuomgeywrojhbztr.exe	147
PID 1100 wrote to memory of 2400	1100	msedge.exe	149
PID 1100 wrote to memory of 4440	1100	msedge.exe	150
PID 1100 wrote to memory of 2116	1100	msedge.exe	151
PID 5548 wrote to memory of 3744	5548	wuomgeywrojhbztr.exe	154
PID 6012 wrote to memory of 1444	6012	yvqnifdxvs.exe	156
PID 5548 wrote to memory of 5768	5548	wuomgeywrojhbztr.exe	159
PID 5548 wrote to memory of 4564	5548	wuomgeywrojhbztr.exe	163
PID 960 wrote to memory of 3860	960	pnhfaxsqni.exe	165
PID 5548 wrote to memory of 5016	5548	wuomgeywrojhbztr.exe	168
PID 5548 wrote to memory of 1388	5548	wuomgeywrojhbztr.exe	172
PID 2324 wrote to memory of 5948	2324	smkfcwupmh.exe	174
PID 5548 wrote to memory of 3524	5548	wuomgeywrojhbztr.exe	177
PID 5548 wrote to memory of 3148	5548	wuomgeywrojhbztr.exe	181
PID 2628 wrote to memory of 3316	2628	xrpjhczxrp.exe	183
PID 5548 wrote to memory of 616	5548	wuomgeywrojhbztr.exe	186
PID 1100 wrote to memory of 5632	1100	msedge.exe	188
PID 1100 wrote to memory of 5632	1100	msedge.exe	188
PID 5548 wrote to memory of 2836	5548	wuomgeywrojhbztr.exe	194
PID 3596 wrote to memory of 5216	3596	wuomhecwuo.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_9ca6add0a724064c8c2559487cbdfa3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Temp\wuomgeywrojhbztr.exe
  C:\Temp\wuomgeywrojhbztr.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtrmjeywu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4728
  - - C:\Temp\bwtrmjeywu.exe
      C:\Temp\bwtrmjeywu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1720
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4160
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwtrmjeywu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1344
  - - C:\Temp\i_bwtrmjeywu.exe
      C:\Temp\i_bwtrmjeywu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwroigbywq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3304
  - - C:\Temp\zwroigbywq.exe
      C:\Temp\zwroigbywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3028
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2176
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwroigbywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2028
  - - C:\Temp\i_zwroigbywq.exe
      C:\Temp\i_zwroigbywq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbytqljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4132
  - - C:\Temp\dbytqljdbv.exe
      C:\Temp\dbytqljdbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:612
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:560
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbytqljdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5312
  - - C:\Temp\i_dbytqljdbv.exe
      C:\Temp\i_dbytqljdbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnlgdbvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3092
  - - C:\Temp\tnlgdbvtnl.exe
      C:\Temp\tnlgdbvtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4140
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2600
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnlgdbvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4704
  - - C:\Temp\i_tnlgdbvtnl.exe
      C:\Temp\i_tnlgdbvtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5008
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvqnifdxvs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3744
  - - C:\Temp\yvqnifdxvs.exe
      C:\Temp\yvqnifdxvs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6012
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1444
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvqnifdxvs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5768
  - - C:\Temp\i_yvqnifdxvs.exe
      C:\Temp\i_yvqnifdxvs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfaxsqni.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4564
  - - C:\Temp\pnhfaxsqni.exe
      C:\Temp\pnhfaxsqni.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfaxsqni.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5016
  - - C:\Temp\i_pnhfaxsqni.exe
      C:\Temp\i_pnhfaxsqni.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkfcwupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1388
  - - C:\Temp\smkfcwupmh.exe
      C:\Temp\smkfcwupmh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2324
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5948
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkfcwupmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3524
  - - C:\Temp\i_smkfcwupmh.exe
      C:\Temp\i_smkfcwupmh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpjhczxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3148
  - - C:\Temp\xrpjhczxrp.exe
      C:\Temp\xrpjhczxrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2628
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3316
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpjhczxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:616
  - - C:\Temp\i_xrpjhczxrp.exe
      C:\Temp\i_xrpjhczxrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomhecwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2836
  - - C:\Temp\wuomhecwuo.exe
      C:\Temp\wuomhecwuo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3596
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5216
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomhecwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5732
  - - C:\Temp\i_wuomhecwuo.exe
      C:\Temp\i_wuomhecwuo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omjebztrom.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5820
  - - C:\Temp\omjebztrom.exe
      C:\Temp\omjebztrom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1436
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4864
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omjebztrom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1608
  - - C:\Temp\i_omjebztrom.exe
      C:\Temp\i_omjebztrom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqljdbytql.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3380
  - - C:\Temp\tqljdbytql.exe
      C:\Temp\tqljdbytql.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2580
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2916
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqljdbytql.exe ups_ins
    3⤵
    PID:552
  - - C:\Temp\i_tqljdbytql.exe
      C:\Temp\i_tqljdbytql.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqligaytql.exe ups_run
    3⤵
    PID:1748
  - - C:\Temp\tqligaytql.exe
      C:\Temp\tqligaytql.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1848
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5752
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqligaytql.exe ups_ins
    3⤵
    PID:4512
  - - C:\Temp\i_tqligaytql.exe
      C:\Temp\i_tqligaytql.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfdyvqnig.exe ups_run
    3⤵
    PID:2660
  - - C:\Temp\nlfdyvqnig.exe
      C:\Temp\nlfdyvqnig.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1908
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3504
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfdyvqnig.exe ups_ins
    3⤵
    PID:6076
  - - C:\Temp\i_nlfdyvqnig.exe
      C:\Temp\i_nlfdyvqnig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axspnlfcau.exe ups_run
    3⤵
    PID:2864
  - - C:\Temp\axspnlfcau.exe
      C:\Temp\axspnlfcau.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1368
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4476
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axspnlfcau.exe ups_ins
    3⤵
    PID:5812
  - - C:\Temp\i_axspnlfcau.exe
      C:\Temp\i_axspnlfcau.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axvpnhfzxs.exe ups_run
    3⤵
    PID:4992
  - - C:\Temp\axvpnhfzxs.exe
      C:\Temp\axvpnhfzxs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1472
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4724
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axvpnhfzxs.exe ups_ins
    3⤵
    PID:1340
  - - C:\Temp\i_axvpnhfzxs.exe
      C:\Temp\i_axvpnhfzxs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczxrpnhfc.exe ups_run
    3⤵
    PID:5520
  - - C:\Temp\hczxrpnhfc.exe
      C:\Temp\hczxrpnhfc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4084
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1224
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczxrpnhfc.exe ups_ins
    3⤵
    PID:2256
  - - C:\Temp\i_hczxrpnhfc.exe
      C:\Temp\i_hczxrpnhfc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxuomkecwu.exe ups_run
    3⤵
    PID:2004
  - - C:\Temp\zxuomkecwu.exe
      C:\Temp\zxuomkecwu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2308
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3336
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxuomkecwu.exe ups_ins
    3⤵
    PID:2536
  - - C:\Temp\i_zxuomkecwu.exe
      C:\Temp\i_zxuomkecwu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtrmjecwu.exe ups_run
    3⤵
    PID:5736
  - - C:\Temp\bwtrmjecwu.exe
      C:\Temp\bwtrmjecwu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4556
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4816
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwtrmjecwu.exe ups_ins
    3⤵
    PID:3540
  - - C:\Temp\i_bwtrmjecwu.exe
      C:\Temp\i_bwtrmjecwu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqomgdbvtq.exe ups_run
    3⤵
    PID:3348
  - - C:\Temp\wqomgdbvtq.exe
      C:\Temp\wqomgdbvtq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4892
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3844
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqomgdbvtq.exe ups_ins
    3⤵
    PID:1904
  - - C:\Temp\i_wqomgdbvtq.exe
      C:\Temp\i_wqomgdbvtq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbvtolge.exe ups_run
    3⤵
    PID:5368
  - - C:\Temp\ljdbvtolge.exe
      C:\Temp\ljdbvtolge.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3500
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5944
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x334,0x7ff95bd0c188,0x7ff95bd0c194,0x7ff95bd0c1a0
      4⤵
      PID:5748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,10428425816544567818,18138749119125745142,524288 --field-trial-handle=2724,i,9999951825513237231,9046388316733363930,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:11
      4⤵
      System Time Discovery
      PID:5828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2020,i,8396377952128148068,5869916036124791963,262144 --field-trial-handle=2724,i,9999951825513237231,9046388316733363930,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:2
      4⤵
      PID:2364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,4854938535790094331,2413551856965033104,524288 --field-trial-handle=2724,i,9999951825513237231,9046388316733363930,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:13
      4⤵
      PID:5412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,16880289784975530199,4540289183517441256,2097152 --field-trial-handle=2724,i,9999951825513237231,9046388316733363930,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:5932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,17759421359030521149,5930409758816113790,2097152 --field-trial-handle=2724,i,9999951825513237231,9046388316733363930,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:3256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,3247501217453396686,16800322684933985535,2097152 --field-trial-handle=2724,i,9999951825513237231,9046388316733363930,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:1
      4⤵
      PID:3452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,3183173270767044659,9130084684335635748,2097152 --field-trial-handle=2724,i,9999951825513237231,9046388316733363930,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:9
      4⤵
      PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,12026814660911130937,12177110745121702591,524288 --field-trial-handle=2724,i,9999951825513237231,9046388316733363930,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
      4⤵
      PID:2372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,15031911694768195580,14250482886684359317,524288 --field-trial-handle=2724,i,9999951825513237231,9046388316733363930,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
      4⤵
      PID:1760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,742518325649449887,13299713369784930861,524288 --field-trial-handle=2724,i,9999951825513237231,9046388316733363930,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
      4⤵
      PID:1368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,13271373250015932670,17903252017707770193,524288 --field-trial-handle=2724,i,9999951825513237231,9046388316733363930,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:2080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,13271373250015932670,17903252017707770193,524288 --field-trial-handle=2724,i,9999951825513237231,9046388316733363930,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:5280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,18005035125380482094,11975830130577505272,524288 --field-trial-handle=2724,i,9999951825513237231,9046388316733363930,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:1224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,10155241080288733298,3828495953264841848,524288 --field-trial-handle=2724,i,9999951825513237231,9046388316733363930,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
      4⤵
      PID:5692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1244,i,174489150433952500,8162819745924587141,524288 --field-trial-handle=2724,i,9999951825513237231,9046388316733363930,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
      4⤵
      PID:2400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1224,i,1161256919700980664,1900763921707207389,524288 --field-trial-handle=2724,i,9999951825513237231,9046388316733363930,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:4440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,4201557744409951307,11359840280968368270,524288 --field-trial-handle=2724,i,9999951825513237231,9046388316733363930,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
      4⤵
      PID:2116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,17480497908517463924,17975842603489317417,524288 --field-trial-handle=2724,i,9999951825513237231,9046388316733363930,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
      4⤵
      PID:5632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,3740045475136847703,6389808115203994800,524288 --field-trial-handle=2724,i,9999951825513237231,9046388316733363930,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
      4⤵
      PID:3168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,14476121854940520135,3011056125007563168,524288 --field-trial-handle=2724,i,9999951825513237231,9046388316733363930,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
      4⤵
      PID:900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,5715017718670513207,10455473343422283102,524288 --field-trial-handle=2724,i,9999951825513237231,9046388316733363930,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
      4⤵
      PID:2652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3664,i,10470283496968801338,3563510029810868101,262144 --field-trial-handle=2724,i,9999951825513237231,9046388316733363930,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:10
      4⤵
      PID:2404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1220,i,9891803295484723525,4905562869976428810,524288 --field-trial-handle=2724,i,9999951825513237231,9046388316733363930,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
      4⤵
      PID:5776

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1308

C:\Temp\wuomgeywrojhbztr.sys
C:\Temp\wuomgeywrojhbztr.sys
1⤵
- Executes dropped EXE
PID:3304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5948

C:\Temp\eywrojgbzt.sys
C:\Temp\eywrojgbzt.sys
1⤵
- Executes dropped EXE
PID:5900

C:\Temp\qljdbztqol.sys
C:\Temp\qljdbztqol.sys
1⤵
- Executes dropped EXE
PID:5752

C:\Temp\vqolgdyvqo.sys
C:\Temp\vqolgdyvqo.sys
1⤵
- Executes dropped EXE
PID:2524

C:\Temp\lfdavtnlfd.sys
C:\Temp\lfdavtnlfd.sys
1⤵
- Executes dropped EXE
PID:2000

C:\Temp\mkifdxvpnh.sys
C:\Temp\mkifdxvpnh.sys
1⤵
- Executes dropped EXE
PID:2836

C:\Temp\cxvpnhfzxs.sys
C:\Temp\cxvpnhfzxs.sys
1⤵
- Executes dropped EXE
PID:4320

C:\Temp\usmkecwusm.sys
C:\Temp\usmkecwusm.sys
1⤵
- Executes dropped EXE
PID:5988

C:\Temp\zwromhecwu.sys
C:\Temp\zwromhecwu.sys
1⤵
- Executes dropped EXE
PID:2160

C:\Temp\ljgeywuolj.sys
C:\Temp\ljgeywuolj.sys
1⤵
- Executes dropped EXE
PID:5832

C:\Temp\ywqomjebwt.sys
C:\Temp\ywqomjebwt.sys
1⤵
- Executes dropped EXE
PID:5420

C:\Temp\trligaytqo.sys
C:\Temp\trligaytqo.sys
1⤵
PID:3512

C:\Temp\tqkigaysqn.sys
C:\Temp\tqkigaysqn.sys
1⤵
PID:1904

C:\Temp\icausnkfdx.sys
C:\Temp\icausnkfdx.sys
1⤵
PID:2064

C:\Temp\icaxvpnkfd.sys
C:\Temp\icaxvpnkfd.sys
1⤵
PID:2148

C:\Temp\kiczusmkec.sys
C:\Temp\kiczusmkec.sys
1⤵
PID:4628

C:\Temp\czurpjhecw.sys
C:\Temp\czurpjhecw.sys
1⤵
PID:2840

C:\Temp\ecwuomgezt.sys
C:\Temp\ecwuomgezt.sys
1⤵
PID:2392

C:\Temp\ebztrljgby.sys
C:\Temp\ebztrljgby.sys
1⤵
PID:1360

C:\Temp\igbywtrljd.sys
C:\Temp\igbywtrljd.sys
1⤵
PID:1708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bwtrmjeywu.exe

Path C:\Temp\bwtrmjeywu.exe
Size 361KB
SHA256 d9f61dbde9def72c39b7d4e43a475a870fc16e453aed6a55ed9193e61ab34bc5
MD5 a2e7ea81a1343162f1850213b4b0932c
SHA1 b773a2b8c9b227da7e278d63b30f9cba738812e9
SHA512 8508652c65cc28fa48def2c51299988b9649de150dbe1c698522a33b2fab8906954ab59b67110f3a0191f6565908f2d7fcd41d9a689a8d0a0ece3ca733ca3951
SSDEEP 6144:2flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:2flfAsiVGjSGecvX
TLSH
T150747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbytqljdbv.exe

Path C:\Temp\dbytqljdbv.exe
Size 361KB
SHA256 0da3fb7109af3e79ccc44bb8c5b472832ec4887c9645a80cd11ff5bdf4abb2bc
MD5 8015aef98a13da8497b6b66aeb9d5f12
SHA1 58ecf48f4f433de0b85ac7fb3710066e63427992
SHA512 4c0a9f09c5d6e17eaa1abd489d4e6ec193036865c0069d15792e15317c0040ead13d3d2493543097fd9267f7165318e0cb7f14d2f9a3dea0a7c98fdf72d77a12
SSDEEP 6144:uflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:uflfAsiVGjSGecvX
TLSH
T1A0747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywrojgbzt.sys

Path C:\Temp\eywrojgbzt.sys
Size 293KB
SHA256 fdd690d391e57753fcafc06f4d533ad3839200110fe48f39f198415ab28252df
MD5 ae6ada9a8c0347b87ddec6cea1a4d3de
SHA1 edb75ffc08d4237c94005884f5ebc33a726f3348
SHA512 cf7f266c107d36006366490deb1edadc451973c6574ceb4622d9a110618bf90d4524119f4563c3baf23db6fa01725a8582b6a6be57a03083d46e9e6ddb752e8d
SSDEEP 3072:rtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:rIJjiJcbI03GBc3ucY5DCSj
TLSH
T138545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bwtrmjeywu.exe

Path C:\Temp\i_bwtrmjeywu.exe
Size 361KB
SHA256 a3eb05c4d14226ce03b7a5dd89baf277ca3c3b0ef5fe24be2cfbd2495d9a8081
MD5 b03a9fbdb8a403370de16a4d65d6ddaa
SHA1 320ef245b00ced1eed3dc1f6f5108ed75df729e4
SHA512 78700b44321bb7f7a9e262499b3ac03495404149b53d9bca8ac58c255eede87c331192e92ae917ee10d173a86ffe43e4e8652cce0199cf2838d4285b2d979500
SSDEEP 6144:uflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:uflfAsiVGjSGecvX
TLSH
T12E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbytqljdbv.exe

Path C:\Temp\i_dbytqljdbv.exe
Size 361KB
SHA256 09c490d19734901ef609a67a85b6de7bbbd2dc3c4477f29498e8d1d47a6ddbfd
MD5 cf5ab519019e67d0ed4f001c8a6524d6
SHA1 277407ad329e6bfc513bd708539579797f5b8743
SHA512 2be51b0df40ae8222d4f105400d89ed1695a156d7bb8e8621d499c082b62da6c9cb2652c5724e7051559202785282722e6d6d0b06bd88af5d85cca84dde7aaae
SSDEEP 6144:aflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:aflfAsiVGjSGecvX
TLSH
T177747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnlgdbvtnl.exe

Path C:\Temp\i_tnlgdbvtnl.exe
Size 361KB
SHA256 4e08430f8b96004ba571b0936131fc6fc571869cbd032934ac4146d8e51468b9
MD5 59f5d9722a74ebed94ed064d139c6d1c
SHA1 8e30909367659cbd8f30e68fc6fd1495b6d92a11
SHA512 634dedeacd55149fc99f26f1e1805d2a680c089268a716920641cb80b7fc0f5aef1c3bcb303abb587c0756a1b1192e4d441b363406067b2bad798519b11421c3
SSDEEP 6144:yflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:yflfAsiVGjSGecvX
TLSH
T186747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvqnifdxvs.exe

Path C:\Temp\i_yvqnifdxvs.exe
Size 361KB
SHA256 ce5aa2e410d4e29f64a895fbc4c7aa0c277157a000daa3389e0b1ef0871cade0
MD5 ed392e0f257603c663aef4d63b6a3c07
SHA1 ad68af98df1230296d8924c33075bae83375642c
SHA512 e621db1be41f8bf69b9ec34ae42a4a76534c951ca2204eb667a736b9f6c773871e24d3243b7e5e34f89b63060799b9c573cc6498003da19fcad536d7d781c569
SSDEEP 6144:CflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:CflfAsiVGjSGecvX
TLSH
T1A1747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zwroigbywq.exe

Path C:\Temp\i_zwroigbywq.exe
Size 361KB
SHA256 4a9cde5d1aad92f46035e998da7635eb9a49c6953a414f035194cdd923c2531c
MD5 a64455b33faca132ecb0f336edc3f381
SHA1 1aef54d8bd96cc015aad7c58ebb98463379673fa
SHA512 d56fd67a44099271a5292fbe8476fb98381f3e6af2ba7cf273b80debcdcb011959565da4e8721e1160efd3bf99af471f16775aae74859dab66ae12f9360ef3e8
SSDEEP 6144:7flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:7flfAsiVGjSGecvX
TLSH
T16B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdavtnlfd.sys

Path C:\Temp\lfdavtnlfd.sys
Size 293KB
SHA256 c95477a04d235b243ac786d49978a31e4d19ca37a5d26b9922ad7df951d6cf15
MD5 aa6d1618df432787dbdc718327daf99a
SHA1 32630568a6098192a3a8802dfafc76d32e639417
SHA512 8619d83577970697ba6c4780a10e4b4ccad88f74b5b720965e75bbefc874c84f287eba146aefe3b54fa5232952b523273dc40f65e9ff3132a46a9ff112b46da2
SSDEEP 3072:StKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:SIJjiJcbI03GBc3ucY5DCSj
TLSH
T1ED545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkifdxvpnh.sys

Path C:\Temp\mkifdxvpnh.sys
Size 293KB
SHA256 8cef4f56afedb925e03e26679eaf1278c1c3e0893bb8211c86f6b1a2f365848b
MD5 725df4ec48772a47f4e04121602f6e2d
SHA1 d06f842fe3c352ed64a9d7678e82167edd0ec1a4
SHA512 4cb5c3b1a64f4fb61e7ef62235a4063b7a8d2c2af543f91961be23af5a4395cf7bc1378f7f053a339b7cde9fa356536f8b28a95c8f3f4a514080d04f754860be
SSDEEP 3072:8tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:8IJjiJcbI03GBc3ucY5DCSj
TLSH
T108545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfaxsqni.exe

Path C:\Temp\pnhfaxsqni.exe
Size 361KB
SHA256 f9366c066e22915299ca4ae9c2b01d41e1fbdaf02cd2e48bb9e976659feee824
MD5 e828fa64c23bac0b8574954ee70722f0
SHA1 60670393a5aaafbe7f43dac47111b7c3c0c75d17
SHA512 171177d37d311fa9e7e1aae0ec2aeb3f249aff662515ae624d213b356328da1a329cfa3b6fbde2197a81ca887823e6316b2e153bc972f6329c57540b493c24cb
SSDEEP 6144:1flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:1flfAsiVGjSGecvX
TLSH
T187747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qljdbztqol.sys

Path C:\Temp\qljdbztqol.sys
Size 293KB
SHA256 4098cd740910dbf1b71a964a5f7c97645756ebc891ede2f6632745ac1cfb9c80
MD5 4d9cae5501482994ac43056000f7f7c9
SHA1 9a55c5132cb6f7f3db97b972743fd55937e368c9
SHA512 94bf61cc97b68be2ff9fd46fc91f083ee43172cf92c990c45a92fced8f5c588c40870e89f55b675a6e9665b14b0301664a0251a8429f7dc064834c8fd6cbddd7
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T19F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlgdbvtnl.exe

Path C:\Temp\tnlgdbvtnl.exe
Size 361KB
SHA256 e5d5cfca8f973c4a67dcfcfe36d23922000e4ff14708c79bc5bedbeb6c5faae3
MD5 28a93d5c9bb4ca4eed5ad269cc6f8d2c
SHA1 a75d3c19014de27ebb895c9b38596c0dda18049d
SHA512 7277131e494a12b90c78e41cb38f979c1da2bbee88fc42bca67a4bf4632e0b955adb8b36f8d29f3876c6f65b6ba8107966b630299f025589bd90c7d065ab9304
SSDEEP 6144:OflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:OflfAsiVGjSGecvX
TLSH
T1A9747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqolgdyvqo.sys

Path C:\Temp\vqolgdyvqo.sys
Size 293KB
SHA256 269260588663d0bda1d80af577b5f8004a0c99f9aa1f07aea3396929344e94ae
MD5 188fe5a71c920c88a59872cabd03e11e
SHA1 063087da8252dbab3fbbf526967b6fcdd4772be7
SHA512 d59ddc8f8d20e3f982a30ebefeab7761db0b3b36cb92c173abb919330d4392e7d7cb27613781aba78dca9cf4743784a53e521c0211fefa37c491f62693b0ff1b
SSDEEP 3072:HtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:HIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgeywrojhbztr.exe

Path C:\Temp\wuomgeywrojhbztr.exe
Size 361KB
SHA256 ecac5201baf4a01656abb50cfb27c82a287b28f5d4963aae676a44ced0527ba9
MD5 41a139070199f0ede9f1db0176065cb4
SHA1 208dd3078475064c4e81b3cbd2f6b15595a00a14
SHA512 6e1d1d92fdebd2efedcbce32f45e26e00eec505763a504509a64baa12d456c7dd985700c4d990cf27cdce448cdfa5e69ca6569eadd402bb6ffb948e1e9a7487c
SSDEEP 6144:LflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:LflfAsiVGjSGecvX
TLSH
T19D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgeywrojhbztr.sys

Path C:\Temp\wuomgeywrojhbztr.sys
Size 293KB
SHA256 9df9766f40dedb376207ac3f4f3c2dd0aee343b4d1b52ba8a359449ffd406f46
MD5 279a871589cb10e505d9c15d97e7a3a5
SHA1 aceb3ed64fa1838afd26ffb3b9134e81f6177880
SHA512 9cdabbec3f3eb0e905a32a25bdc7257891bcc3700f3f3b751f710571aa806a6329082a24167ca75a2db6440456d075f38e139c958198e0a73e19999d5730c5ed
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T161545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqnifdxvs.exe

Path C:\Temp\yvqnifdxvs.exe
Size 361KB
SHA256 5d5eb98f08311e292180323dcf3c6e8654b2439f5987af0f821230028baea681
MD5 99e4cf846828d85e4f0cdf6d0be5d619
SHA1 75b987f173d4b3c0dac13a23859df91ae7421846
SHA512 d1d4533790fb7a21156442165f1560baf3bebbcf096246a7a9bc9855f162089253249641ddf72b8acf864bcd82c704241b74a4d0b41297c471120d119ab2534e
SSDEEP 6144:KflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:KflfAsiVGjSGecvX
TLSH
T1CA747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwroigbywq.exe

Path C:\Temp\zwroigbywq.exe
Size 361KB
SHA256 8485102fe68f912cb520ddafcf3d33971b517962f8912519a0a1373c0a5cf09b
MD5 35109f5e8856d2e1386b4f5f9485b945
SHA1 b9fd3162599fb2549931344ded75e855c28d4f2d
SHA512 d71bae4d4a8b55a62f86bd1a8d093cc9f5a468fe9f7d07c280b1e5cec0f52df0e3fe890bf4987ca2a0dedb0e8e35149eee1d6b70ccc6233c8d1f5e70b75c35ce
SSDEEP 6144:GflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:GflfAsiVGjSGecvX
TLSH
T159747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b4edbbe62f29386512f6cd1726c675b23fdeee21a26a2896a394ff9b87143167
MD5 c0060c375421fc206e85d98fc2ea6677
SHA1 2189b0dd881564dfef39585cc2cffda4dcd3ec91
SHA512 338dc8a4791fbbe759582d4a8fd55c1a6245fcc722bff11ff926118daa91041d62e98b05cb2e63b22ea119d41a557c511dcfb12592ab416dab9980af0b5ca713
TLSH
T1F2D0C0703F42F008C04904F08534EF101337B81230839900F170C80E84E40C0A3C8043
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b778cc535cfe9ef8131b9d727f221c5d63c7f15bcd4cd19db345f2c97bdf5594
MD5 a4b8f3b6133ca4686118d40b6c8d4ea7
SHA1 cbca41492cec17181764c1371da84a0e0481f93f
SHA512 65135f099a2e372c9a11538ad8ff73abdfa24612895545773034b613318a9166b5560e41026d2ec245dda6b088efde1566126dae35182ddcb3fe795a786554ad
TLSH
T1B7D0C0743F42F108C04904F08534EF101337B81230839900F070C80E84E40C0A3C9053
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 61b768f6dca06b6ca189942005b147c6527714d79d22b02c82574524d319d7f5
MD5 bfbdb7ab53ab97a2f1af3d4b320c7412
SHA1 c8df0e7f002ee3544c2713c829d897feeb839b3e
SHA512 2180c939272c658728a11559bc71dddae315df89f30fd4395577a5c9225370b4fe8ec72166300e56742250b0275fb176de4ca0db6f7d6d072421c35cb2220d71
TLSH
T17261E767B4E20E6EE7A44F7710DA2ED93B73CD58168F2EB310A8F178DA4AB04D055471
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2567ec296a45b89ee8d5add22b0cbaf365274b9248c139a3751af863200c4d96
MD5 3d627d61e6277431411e2d1c9b5a4ab9
SHA1 8dd1fcc971294e503120106c2585646efa06c83c
SHA512 016cc413cf15c2917ae3d49d24186f61704babafb4710914b15c331b2547e2e817d6137574404516aabc3a34dbc1c6b2b86e2334afd2aceb7737ad074b150b7e
TLSH
T14661E767B4E20E6EE7A44F7710DA2ED93B73CD58164F2EB310A4F178DA4AB04D015472
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3940f0e7-4290-4954-888d-28f1720ac663.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3940f0e7-4290-4954-888d-28f1720ac663.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 693ea0f35eaa4e8869e43cef5e0af16d3f3719514ef8c59b684fd064c8481417
MD5 175e4e45432beef53a5e0194545f1827
SHA1 74c1ea3e9be571a61bcf682720e56cd61f4390bf
SHA512 9858028f8b817dc434b9cb03b2c94ecf71cb2a29ade9e6c7a42504a7414dfbbac8c7d41ee99f484e619f56767cdf4488f46cc9f08fdbcc24539485d250febb3f
TLSH
T1FA51DEF7C2E8866DC90196F0BB147E2BCE1D0954832C3D5A89E4AF5B93E3471E14198F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 96d0e29eff56d8b39a05c43f322e0f187b592591f2d33a172f4e9a3557d3cecd
MD5 52cee797b827167eabe83d9ba51013e2
SHA1 d094d09a38cafaaa90a42e4f8de90a4a16f7c011
SHA512 f0601019582addb800bb4f7560d741504405407e2d3930384efdca5dedd39f6c79cc13389c0968d7ef4ffb7ab29993a25bd3f8909611153d2ec7ede9d7f0f442
SSDEEP 192:sxR7RzyM/jK1Ml8wcV/fZse6GaJZMzoA8p9K/g6+WNC7o/YYMWYuqZGmIgDex7J:sxR77CV/fZshGaH9o/59/BqRk
TLSH
T1CE62C716AA349977DCCBD20CFA957F53D6F85572A2901E44AAFCCA0C01E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 59360a47a5b2fdacf98fda400350496f59cce0ed3a81e1cdbe7997d4441ce7d9
MD5 dea8d1cdc0aebfc7b180fcea0ceb7d23
SHA1 1253c9573b376fc7267cc10abf6ce480951c17db
SHA512 2fdb6db6b1c1beae7bba0bc5049ba5e4de0e8c4f63195c1559bc2ef61e5dc427d42223502d39699869dcb45bede21fd84b7e7a1ffa405a0d20abfe69c9aa88fe
SSDEEP 192:sxRYRzyM/jK1Ml8wcV/fZs16GaJZMzoA8p9K/g6+WNC7o/YYMWYuqZGmIgVx7J:sxRY7CV/fZssGaH9o/59/BqRB
TLSH
T19262D816AA349977DCCBD20CFA557F53D6F85572A2901E44AAFCCA0C01E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b566df256555ce56f20d14233d3030482802f5d37ce7b737e3f2ac566f5a5cd8
MD5 e62b027b98f89068cd8bc2ff3edc62bb
SHA1 b50cdb183a2cbe368dd3260280da8e23c3d5d256
SHA512 1f8250f1af61fab685665a55483d3f88fedb81694d47e77fb7273c8e8893c3ae6d65aad143cb654a56d125020dc1bd9c44ac5e7df18c99448552071b5fb5b6be
SSDEEP 192:sxR7RzyM/jK1Ml8UQQcV/fZse6GSJZMzoA8prK/g6+WNC7o/YYM+YuqZGmIgDExN:sxR77qvV/fZshGSH9G/59/5qRq
TLSH
T1E862C756AA349977DCCBD20CBA817F53D6F85572A2900E44AAFCCA0C01E7ADD211381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 3884a87996888f3c46563be60b0b6142dedcb9bc9e08333d1d5258d479c75b88
MD5 505cf2e2f9f49a10c2bc1813076750ea
SHA1 cbdfae5fac8dd6ef2ce94299571eb0f1f7d6569e
SHA512 e55c0e16d06b48aef0f71b7c450b00421d691e679d363651af3d5f494903883227427dd3413f4d6662510d187e8c84bca91b45c8cc8ff34fc20891eaee34d138
SSDEEP 768:j+8ubA7pLuL7q7WgNVfq38F1+UoAYDCx9Tuqh0VfUC9xbog/OVVFpBJ66rolOd:j+8ubME7q7WgNVfq3u1jaOFpH6xlOd
TLSH
T125E2EC3B680CCB7E4F804DDCE829BD9A6DE801CF96D8CD5447EA841C03C6AEB551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b3fa608f7c6540fe1e5dbe6d587d19aa461ce1f7fbd03150c947f85e7aba6ff2
MD5 5f953303919dda250dc447b13e9bc93d
SHA1 30869fe8838a90129405864d0ce27d5157ced3a9
SHA512 a992a71a9d27936898c6ec7c3d1fbd4afc6628096febf64e54e47685532c7498cef7211810655c4d7197302b9a60127d2cc3c1b2a768ed2fe6bf50b81406fc41
SSDEEP 24:KFJfyv2gTFjn/+vzsWI77/K44hgF/1SZvSkhqU63UyXeufBozggFimM+ywsXI7UX:KseIfKHqE7ytHIZKYYsE8IPKhm0DyL
TLSH
T17F916551357B22143CBD36CA81969A5E02823477364BA47B37AE60D71F2FE450EFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9bb1f98b-d7ea-47cc-b513-b3e07827f931.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9bb1f98b-d7ea-47cc-b513-b3e07827f931.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3893c36211e35523e0bcd0ffc8d482b62cd6e6367412b76de5975930e24fa330
MD5 575f9a00ea08ff5b1a723bae840aa5cb
SHA1 2f6353342d94a88c979c99d6f4cb4da4f8524eea
SHA512 50f64e4161d479b428b83a8c613b83598c3079158af88ef5e0b0ec9dc8a69e8725c5567e2a18efe8a674cddb119087c7e86f4a6d5d08d0051de0ad817a5b069f
SSDEEP 768:eGj+973GTgaff8fpf+zyJ5p3EFlnNMLmOdzn12bfJy:s9738f8fpf5p3EFlSCqByJy
TLSH
T115F2BE31A8A04E635DE6C689764B378B7EE44673DAC42A58D8CCAF0E40D73DD270F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a0f51a9506c809808a6e6f5e5ec29af9555e1a25d1f098cfab7aafd49b947a13
MD5 d3760ce961972fa0334389ef3c1d4d90
SHA1 af2ad39daa4946485131f216df6c784469ffadfa
SHA512 5e3f059ea90dd6c65cce386fe9d6d512aa1797c034909ac24957308b79bb114f5bb922dc49ae0560ad5916c1f2e8547944c4282963f9336483927e9a9e4ed63e
SSDEEP 768:UjaeqD4MlshiLdMmQ3regaff8f8yJ5p3EFlnNMLmKWyjWtTzTb:UqcjhIdMH3If8f9p3EFlSClyj2v
TLSH
T1B203D03A98A058B7CCB696C5764777976EB04293CB913B59DCCC7A0E40AB3DE130B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9cc99035ad5fe5e05b1e963397b985b3d59cf3c2728867fe1938d55a8f34a042
MD5 d55c3204995c9030c5b1dc122ccfc768
SHA1 1b27db467b661aaf77ce49594c467dd54484cfbc
SHA512 2d1dc38ef1c52ea889341999e1816e3f0f0d3b78c7160f67c458b807f67d82ea9db9115dc3277d44b2d797d988a8d1bcc074fedc10f4a2f63f2e18caee6a8eaf
SSDEEP 768:aGj+973nTgaff8fpf+iyJ5p3EFlnNMLmOdzn12bfJy:4973tf8fpfwp3EFlSCqByJy
TLSH
T175F2BF31A8A04E635DE6C689764B378B7EE44673D6C42A58D8CCAF0E40D73DD270F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 9b3bf4e0e53e288e0ee7460c03d1969fa7e42ed5cfa5d71532cfd07af4f0f8fd
MD5 d9b44397146b950c94f9b885b30cf950
SHA1 230e7ceefcfe9b89f86423b457c726dbd434621d
SHA512 50f5a6fc641fec6c8b51a44bf6cf35960d4b714cbe6d1ed40f245804b2794dd74558554b55454f2580683020b64f6f93fe38e0cef6c944a6feb11847b99dd15d
SSDEEP 768:CoF1j+9s3Awgc5Xf8fpf+RyJ5p3EFlnNMLmOdzn12bfJy:69s3Hf8fpf5p3EFlSCqByJy
TLSH
T15B1339F598D38A36E99E8787673E2E469DBCC163B5846594B7C85D0DCC832BFC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1100_1308107538\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 8dca17803e7fc20efc504394283ebc2b532612d1b095a86a1997707293a68d93
MD5 ebbcc6976e968c35526d91b357c1093d
SHA1 44d5fd7bccd0329affd7c2257ad08a07652e1ee5
SHA512 1bb227a34b35005861368a77825e845c990dcd0e04f3a2c9ec768ad6769984a455bb8a48929600b4370221c07ac8ba95f8756bb2951e672eb8e841101bc2ad4a
TLSH
T1A671238357B8C5B3C1DE5FF102835644F6FB223C4B6330210BA15586AB30A7E24B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1708-503-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1904-415-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2000-281-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2064-419-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2148-439-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2160-367-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2160-340-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2392-474-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2524-269-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2836-296-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2840-475-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3304-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3512-394-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4320-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4628-450-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5420-396-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5420-374-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5752-241-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5832-344-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5900-194-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5988-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download