systex | 66aaf7a890c4902b4c3d44aabdead8f307c3d90d3f7ac20cf4ce6ac9c0886f2b

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260705-tbe2psdv4t
SHA256 66aaf7a890c4902b4c3d44aabdead8f307c3d90d3f7ac20cf4ce6ac9c0886f2b
MD5 c60628d53e77096b9ea60ec92c1db9df
SHA1 53960330fa2b05642d9eb26fd527e2a768d18add
SHA512 9f3679d6d38baa35b22cd8558c91806deebb853f5ecb11c9c2617ea4d75e7492cb9a5554eec67609af93ea3fc04ce0c7df68f91aa66f73a321b7cb7b027430e8
SSDEEP 6144:pflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:pflfAsiVGjSGecvX
TLSH
T135747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
6912	vtnlfdyvqoigaysq.exe
2224	vtnlfdyvqoigaysq.sys
1416	CreateProcess.exe
6124	gayvqkidav.exe
712	CreateProcess.exe
3932	CreateProcess.exe
4204	i_gayvqkidav.exe
3408	fcavpnlfdx.sys
6048	CreateProcess.exe
1864	ysqkicavsk.exe
820	CreateProcess.exe
4176	CreateProcess.exe
6824	i_ysqkicavsk.exe
4252	pnkfdxvpnh.sys
5692	CreateProcess.exe
796	ausnkfcxvp.exe
5324	CreateProcess.exe
1992	CreateProcess.exe
6356	i_ausnkfcxvp.exe
5060	rpnhfzxspk.sys
5192	CreateProcess.exe
6868	hfzusmkfcx.exe
6424	CreateProcess.exe
1944	CreateProcess.exe
3264	i_hfzusmkfcx.exe
5456	zxrpjhczur.sys
4856	CreateProcess.exe
3320	smkecwupmh.exe
1856	CreateProcess.exe
3444	CreateProcess.exe
2664	i_smkecwupmh.exe
1124	hezwrpjhbz.sys
3420	CreateProcess.exe
296	wrpjhbztrm.exe
124	CreateProcess.exe
7000	CreateProcess.exe
5748	i_wrpjhbztrm.exe
1908	ljeywrojge.sys
6188	CreateProcess.exe
3276	wtomgbywto.exe
4876	CreateProcess.exe
4204	CreateProcess.exe
6408	i_wtomgbywto.exe
3428	bztrljdbwt.sys
1340	CreateProcess.exe
1216	qojgbztqlj.exe
5460	CreateProcess.exe
5640	CreateProcess.exe
1104	i_qojgbztqlj.exe
5124	gaysqliday.sys
1816	CreateProcess.exe
2512	vtoigdbvtn.exe
3456	CreateProcess.exe
5712	CreateProcess.exe
1860	i_vtoigdbvtn.exe
5960	sqlidavtnl.sys
5756	CreateProcess.exe
6076	ifaysqkida.exe
4348	CreateProcess.exe
2328	CreateProcess.exe
3500	i_ifaysqkida.exe
3032	icavsnkfdx.sys
4944	CreateProcess.exe
6648	mkfcxvpnif.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6264_1464298551\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6264_1464298551\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6264_1464298551\kp_pinslist.pb	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6264_789111378\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6264_789111378\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6264_133013087\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6264_133013087\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6264_1464298551\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qojgbztqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgbztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqlidavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icausnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkicavsk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausnkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomgecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igbytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzusmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxspcxusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomgecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgbztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gayvqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gayvqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzusmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtomgbywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qojgbztqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkicavsk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtoigdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytrljebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqlidavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkfcxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytrljebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtoigdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkfcxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxspcxusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igbytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdyvqoigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausnkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtomgbywto.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5180	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6320	ipconfig.exe
1128	ipconfig.exe
5768	ipconfig.exe
6140	ipconfig.exe
3212	ipconfig.exe
5856	ipconfig.exe
6476	ipconfig.exe
5384	ipconfig.exe
6476	ipconfig.exe
1740	ipconfig.exe
3972	ipconfig.exe
896	ipconfig.exe
6948	ipconfig.exe
3960	ipconfig.exe
3804	ipconfig.exe
7072	ipconfig.exe
4796	ipconfig.exe
5612	ipconfig.exe
892	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277403768264155"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1749168396-1890032557-311772428-1000\{50468BE0-582D-4AB3-8772-5146D99E25C8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6912	vtnlfdyvqoigaysq.exe
6912	vtnlfdyvqoigaysq.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6912	vtnlfdyvqoigaysq.exe
6912	vtnlfdyvqoigaysq.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6912	vtnlfdyvqoigaysq.exe
6912	vtnlfdyvqoigaysq.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6912	vtnlfdyvqoigaysq.exe
6912	vtnlfdyvqoigaysq.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6912	vtnlfdyvqoigaysq.exe
6912	vtnlfdyvqoigaysq.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6912	vtnlfdyvqoigaysq.exe
6912	vtnlfdyvqoigaysq.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
6264	msedge.exe
6264	msedge.exe
6264	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4204	i_gayvqkidav.exe
Token: SeDebugPrivilege	6824	i_ysqkicavsk.exe
Token: SeDebugPrivilege	6356	i_ausnkfcxvp.exe
Token: SeDebugPrivilege	3264	i_hfzusmkfcx.exe
Token: SeDebugPrivilege	2664	i_smkecwupmh.exe
Token: SeDebugPrivilege	5748	i_wrpjhbztrm.exe
Token: SeDebugPrivilege	6408	i_wtomgbywto.exe
Token: SeDebugPrivilege	1104	i_qojgbztqlj.exe
Token: SeDebugPrivilege	1860	i_vtoigdbvtn.exe
Token: SeDebugPrivilege	3500	i_ifaysqkida.exe
Token: SeDebugPrivilege	6288	i_mkfcxvpnif.exe
Token: SeDebugPrivilege	5704	i_zxspcxusmk.exe
Token: SeDebugPrivilege	4424	i_pnhfzxrpkh.exe
Token: SeDebugPrivilege	2476	i_ecwuomgecw.exe
Token: SeDebugPrivilege	1716	i_ojgbztrljd.exe
Token: SeDebugPrivilege	6072	i_ytrljebwto.exe
Token: SeDebugPrivilege	808	i_igbytqljdb.exe
Token: SeDebugPrivilege	3324	i_ysqlidavsn.exe
Token: SeDebugPrivilege	2596	i_icausnkfdx.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6264	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 6912	1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 1752 wrote to memory of 6040	1752	2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	91
PID 6040 wrote to memory of 6264	6040	iexplore.exe	92
PID 6264 wrote to memory of 2148	6264	msedge.exe	93
PID 6264 wrote to memory of 6580	6264	msedge.exe	95
PID 6264 wrote to memory of 5180	6264	msedge.exe	96
PID 6264 wrote to memory of 6580	6264	msedge.exe	95
PID 6264 wrote to memory of 6580	6264	msedge.exe	95
PID 6264 wrote to memory of 6224	6264	msedge.exe	97
PID 6264 wrote to memory of 6224	6264	msedge.exe	97
PID 6264 wrote to memory of 476	6264	msedge.exe	99
PID 6264 wrote to memory of 2696	6264	msedge.exe	98
PID 6264 wrote to memory of 476	6264	msedge.exe	99
PID 6264 wrote to memory of 476	6264	msedge.exe	99
PID 6264 wrote to memory of 2696	6264	msedge.exe	98
PID 6264 wrote to memory of 2696	6264	msedge.exe	98
PID 6912 wrote to memory of 1416	6912	vtnlfdyvqoigaysq.exe	102
PID 6124 wrote to memory of 712	6124	gayvqkidav.exe	105
PID 6912 wrote to memory of 3932	6912	vtnlfdyvqoigaysq.exe	108
PID 6264 wrote to memory of 5952	6264	msedge.exe	110
PID 6264 wrote to memory of 5952	6264	msedge.exe	110
PID 6264 wrote to memory of 5076	6264	msedge.exe	111
PID 6264 wrote to memory of 5076	6264	msedge.exe	111
PID 6264 wrote to memory of 6348	6264	msedge.exe	113
PID 6912 wrote to memory of 6048	6912	vtnlfdyvqoigaysq.exe	118
PID 1864 wrote to memory of 820	1864	ysqkicavsk.exe	120
PID 6912 wrote to memory of 4176	6912	vtnlfdyvqoigaysq.exe	123
PID 6912 wrote to memory of 5692	6912	vtnlfdyvqoigaysq.exe	127
PID 796 wrote to memory of 5324	796	ausnkfcxvp.exe	129
PID 6912 wrote to memory of 1992	6912	vtnlfdyvqoigaysq.exe	132
PID 6912 wrote to memory of 5192	6912	vtnlfdyvqoigaysq.exe	136
PID 6868 wrote to memory of 6424	6868	hfzusmkfcx.exe	139
PID 6912 wrote to memory of 1944	6912	vtnlfdyvqoigaysq.exe	142
PID 6264 wrote to memory of 2404	6264	msedge.exe	144
PID 6264 wrote to memory of 6072	6264	msedge.exe	145
PID 6264 wrote to memory of 6084	6264	msedge.exe	146
PID 6912 wrote to memory of 4856	6912	vtnlfdyvqoigaysq.exe	149
PID 3320 wrote to memory of 1856	3320	smkecwupmh.exe	151
PID 6912 wrote to memory of 3444	6912	vtnlfdyvqoigaysq.exe	154
PID 6912 wrote to memory of 3420	6912	vtnlfdyvqoigaysq.exe	158
PID 296 wrote to memory of 124	296	wrpjhbztrm.exe	160
PID 6912 wrote to memory of 7000	6912	vtnlfdyvqoigaysq.exe	163
PID 6912 wrote to memory of 6188	6912	vtnlfdyvqoigaysq.exe	167
PID 3276 wrote to memory of 4876	3276	wtomgbywto.exe	169
PID 6912 wrote to memory of 4204	6912	vtnlfdyvqoigaysq.exe	172
PID 6912 wrote to memory of 1340	6912	vtnlfdyvqoigaysq.exe	176
PID 1216 wrote to memory of 5460	1216	qojgbztqlj.exe	178
PID 6912 wrote to memory of 5640	6912	vtnlfdyvqoigaysq.exe	181
PID 6264 wrote to memory of 7008	6264	msedge.exe	183
PID 6264 wrote to memory of 7008	6264	msedge.exe	183
PID 6912 wrote to memory of 1816	6912	vtnlfdyvqoigaysq.exe	188
PID 2512 wrote to memory of 3456	2512	vtoigdbvtn.exe	190
PID 6912 wrote to memory of 5712	6912	vtnlfdyvqoigaysq.exe	193
PID 6912 wrote to memory of 5756	6912	vtnlfdyvqoigaysq.exe	197
PID 6076 wrote to memory of 4348	6076	ifaysqkida.exe	199
PID 6912 wrote to memory of 2328	6912	vtnlfdyvqoigaysq.exe	202
PID 6264 wrote to memory of 6992	6264	msedge.exe	204
PID 6264 wrote to memory of 6992	6264	msedge.exe	204
PID 6912 wrote to memory of 4944	6912	vtnlfdyvqoigaysq.exe	207
PID 6648 wrote to memory of 5032	6648	mkfcxvpnif.exe	209
PID 6912 wrote to memory of 3712	6912	vtnlfdyvqoigaysq.exe	212
PID 6912 wrote to memory of 2956	6912	vtnlfdyvqoigaysq.exe	216
PID 4236 wrote to memory of 2856	4236	zxspcxusmk.exe	218
PID 6912 wrote to memory of 6596	6912	vtnlfdyvqoigaysq.exe	221

C:\Users\Admin\AppData\Local\Temp\2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_c60628d53e77096b9ea60ec92c1db9df_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Temp\vtnlfdyvqoigaysq.exe
  C:\Temp\vtnlfdyvqoigaysq.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gayvqkidav.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1416
  - - C:\Temp\gayvqkidav.exe
      C:\Temp\gayvqkidav.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6124
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:712
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gayvqkidav.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3932
  - - C:\Temp\i_gayvqkidav.exe
      C:\Temp\i_gayvqkidav.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqkicavsk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6048
  - - C:\Temp\ysqkicavsk.exe
      C:\Temp\ysqkicavsk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:820
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqkicavsk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4176
  - - C:\Temp\i_ysqkicavsk.exe
      C:\Temp\i_ysqkicavsk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ausnkfcxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5692
  - - C:\Temp\ausnkfcxvp.exe
      C:\Temp\ausnkfcxvp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5324
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ausnkfcxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1992
  - - C:\Temp\i_ausnkfcxvp.exe
      C:\Temp\i_ausnkfcxvp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzusmkfcx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5192
  - - C:\Temp\hfzusmkfcx.exe
      C:\Temp\hfzusmkfcx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6868
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6424
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3212
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfzusmkfcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1944
  - - C:\Temp\i_hfzusmkfcx.exe
      C:\Temp\i_hfzusmkfcx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkecwupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4856
  - - C:\Temp\smkecwupmh.exe
      C:\Temp\smkecwupmh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3320
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1856
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkecwupmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3444
  - - C:\Temp\i_smkecwupmh.exe
      C:\Temp\i_smkecwupmh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrpjhbztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3420
  - - C:\Temp\wrpjhbztrm.exe
      C:\Temp\wrpjhbztrm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:296
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrpjhbztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:7000
  - - C:\Temp\i_wrpjhbztrm.exe
      C:\Temp\i_wrpjhbztrm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtomgbywto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6188
  - - C:\Temp\wtomgbywto.exe
      C:\Temp\wtomgbywto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3276
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4876
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtomgbywto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4204
  - - C:\Temp\i_wtomgbywto.exe
      C:\Temp\i_wtomgbywto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qojgbztqlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1340
  - - C:\Temp\qojgbztqlj.exe
      C:\Temp\qojgbztqlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1216
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5460
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qojgbztqlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5640
  - - C:\Temp\i_qojgbztqlj.exe
      C:\Temp\i_qojgbztqlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtoigdbvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1816
  - - C:\Temp\vtoigdbvtn.exe
      C:\Temp\vtoigdbvtn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2512
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtoigdbvtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5712
  - - C:\Temp\i_vtoigdbvtn.exe
      C:\Temp\i_vtoigdbvtn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifaysqkida.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5756
  - - C:\Temp\ifaysqkida.exe
      C:\Temp\ifaysqkida.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4348
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifaysqkida.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2328
  - - C:\Temp\i_ifaysqkida.exe
      C:\Temp\i_ifaysqkida.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkfcxvpnif.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4944
  - - C:\Temp\mkfcxvpnif.exe
      C:\Temp\mkfcxvpnif.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6648
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5032
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:7072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkfcxvpnif.exe ups_ins
    3⤵
    PID:3712
  - - C:\Temp\i_mkfcxvpnif.exe
      C:\Temp\i_mkfcxvpnif.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxspcxusmk.exe ups_run
    3⤵
    PID:2956
  - - C:\Temp\zxspcxusmk.exe
      C:\Temp\zxspcxusmk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4236
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2856
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxspcxusmk.exe ups_ins
    3⤵
    PID:6596
  - - C:\Temp\i_zxspcxusmk.exe
      C:\Temp\i_zxspcxusmk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfzxrpkh.exe ups_run
    3⤵
    PID:5764
  - - C:\Temp\pnhfzxrpkh.exe
      C:\Temp\pnhfzxrpkh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:944
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1936
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfzxrpkh.exe ups_ins
    3⤵
    PID:5904
  - - C:\Temp\i_pnhfzxrpkh.exe
      C:\Temp\i_pnhfzxrpkh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwuomgecw.exe ups_run
    3⤵
    PID:5736
  - - C:\Temp\ecwuomgecw.exe
      C:\Temp\ecwuomgecw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3408
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5044
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwuomgecw.exe ups_ins
    3⤵
    PID:6572
  - - C:\Temp\i_ecwuomgecw.exe
      C:\Temp\i_ecwuomgecw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ojgbztrljd.exe ups_run
    3⤵
    PID:7028
  - - C:\Temp\ojgbztrljd.exe
      C:\Temp\ojgbztrljd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2216
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1740
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ojgbztrljd.exe ups_ins
    3⤵
    PID:7096
  - - C:\Temp\i_ojgbztrljd.exe
      C:\Temp\i_ojgbztrljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ytrljebwto.exe ups_run
    3⤵
    PID:5052
  - - C:\Temp\ytrljebwto.exe
      C:\Temp\ytrljebwto.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4976
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ytrljebwto.exe ups_ins
    3⤵
    PID:1436
  - - C:\Temp\i_ytrljebwto.exe
      C:\Temp\i_ytrljebwto.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igbytqljdb.exe ups_run
    3⤵
    PID:6604
  - - C:\Temp\igbytqljdb.exe
      C:\Temp\igbytqljdb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2208
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igbytqljdb.exe ups_ins
    3⤵
    PID:1368
  - - C:\Temp\i_igbytqljdb.exe
      C:\Temp\i_igbytqljdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqlidavsn.exe ups_run
    3⤵
    PID:7044
  - - C:\Temp\ysqlidavsn.exe
      C:\Temp\ysqlidavsn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5480
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5708
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqlidavsn.exe ups_ins
    3⤵
    PID:4824
  - - C:\Temp\i_ysqlidavsn.exe
      C:\Temp\i_ysqlidavsn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icausnkfdx.exe ups_run
    3⤵
    PID:4224
  - - C:\Temp\icausnkfdx.exe
      C:\Temp\icausnkfdx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1052
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1908
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icausnkfdx.exe ups_ins
    3⤵
    PID:7092
  - - C:\Temp\i_icausnkfdx.exe
      C:\Temp\i_icausnkfdx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2596
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:6040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd57a9c188,0x7ffd57a9c194,0x7ffd57a9c1a0
      4⤵
      PID:2148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1988,i,17994705508683595622,14958044739530846387,262144 --field-trial-handle=2484,i,7392288970107343278,16125198537584020605,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:2
      4⤵
      PID:6580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2168,i,4843357671808674253,8716697739956602147,524288 --field-trial-handle=2484,i,7392288970107343278,16125198537584020605,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:11
      4⤵
      System Time Discovery
      PID:5180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2692,i,5799885490665489709,8009654418767579761,524288 --field-trial-handle=2484,i,7392288970107343278,16125198537584020605,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:13
      4⤵
      PID:6224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,11755542884252653304,9065840835087611905,2097152 --field-trial-handle=2484,i,7392288970107343278,16125198537584020605,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:2696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,7929532145601198923,16886344787514051217,2097152 --field-trial-handle=2484,i,7392288970107343278,16125198537584020605,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,5422459849852184102,8785560402766120006,524288 --field-trial-handle=2484,i,7392288970107343278,16125198537584020605,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
      4⤵
      PID:5952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,8567982599933374604,6032834770715896693,524288 --field-trial-handle=2484,i,7392288970107343278,16125198537584020605,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
      4⤵
      PID:5076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,17982738698147519887,997613196908310197,524288 --field-trial-handle=2484,i,7392288970107343278,16125198537584020605,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
      4⤵
      PID:1448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,17982738698147519887,997613196908310197,524288 --field-trial-handle=2484,i,7392288970107343278,16125198537584020605,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
      4⤵
      PID:6348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1268,i,1998920040268341145,10523366434762740737,524288 --field-trial-handle=2484,i,7392288970107343278,16125198537584020605,262144 --variations-seed-version --mojo-platform-channel-handle=1432 /prefetch:14
      4⤵
      PID:2404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,12127134912602261411,9572212531382886322,524288 --field-trial-handle=2484,i,7392288970107343278,16125198537584020605,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
      4⤵
      PID:6072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,13549678019382635851,13076580980457902788,524288 --field-trial-handle=2484,i,7392288970107343278,16125198537584020605,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
      4⤵
      PID:6084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,13452226120984317921,14699803246742098103,524288 --field-trial-handle=2484,i,7392288970107343278,16125198537584020605,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
      4⤵
      PID:7008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,8474204819431605535,1569967941860315439,524288 --field-trial-handle=2484,i,7392288970107343278,16125198537584020605,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
      4⤵
      PID:6992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,1624424199202810058,10680997912982285879,524288 --field-trial-handle=2484,i,7392288970107343278,16125198537584020605,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
      4⤵
      PID:748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6416,i,16809747549745964385,6528272101771079123,262144 --field-trial-handle=2484,i,7392288970107343278,16125198537584020605,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:10
      4⤵
      PID:7048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,17896023029489480319,5196123999715725278,524288 --field-trial-handle=2484,i,7392288970107343278,16125198537584020605,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
      4⤵
      PID:4244

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2388

C:\Temp\vtnlfdyvqoigaysq.sys
C:\Temp\vtnlfdyvqoigaysq.sys
1⤵
- Executes dropped EXE
PID:2224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5612

C:\Temp\fcavpnlfdx.sys
C:\Temp\fcavpnlfdx.sys
1⤵
- Executes dropped EXE
PID:3408

C:\Temp\pnkfdxvpnh.sys
C:\Temp\pnkfdxvpnh.sys
1⤵
- Executes dropped EXE
PID:4252

C:\Temp\rpnhfzxspk.sys
C:\Temp\rpnhfzxspk.sys
1⤵
- Executes dropped EXE
PID:5060

C:\Temp\zxrpjhczur.sys
C:\Temp\zxrpjhczur.sys
1⤵
- Executes dropped EXE
PID:5456

C:\Temp\hezwrpjhbz.sys
C:\Temp\hezwrpjhbz.sys
1⤵
- Executes dropped EXE
PID:1124

C:\Temp\ljeywrojge.sys
C:\Temp\ljeywrojge.sys
1⤵
- Executes dropped EXE
PID:1908

C:\Temp\bztrljdbwt.sys
C:\Temp\bztrljdbwt.sys
1⤵
- Executes dropped EXE
PID:3428

C:\Temp\gaysqliday.sys
C:\Temp\gaysqliday.sys
1⤵
- Executes dropped EXE
PID:5124

C:\Temp\sqlidavtnl.sys
C:\Temp\sqlidavtnl.sys
1⤵
- Executes dropped EXE
PID:5960

C:\Temp\icavsnkfdx.sys
C:\Temp\icavsnkfdx.sys
1⤵
- Executes dropped EXE
PID:3032

C:\Temp\kicausmkfc.sys
C:\Temp\kicausmkfc.sys
1⤵
PID:2420

C:\Temp\zusmkecaus.sys
C:\Temp\zusmkecaus.sys
1⤵
PID:240

C:\Temp\pmhezxrpjh.sys
C:\Temp\pmhezxrpjh.sys
1⤵
PID:2056

C:\Temp\hbztjebwuo.sys
C:\Temp\hbztjebwuo.sys
1⤵
PID:6716

C:\Temp\ojgbytrljd.sys
C:\Temp\ojgbytrljd.sys
1⤵
PID:3212

C:\Temp\qoigaytqli.sys
C:\Temp\qoigaytqli.sys
1⤵
PID:4920

C:\Temp\idbvtnlfdy.sys
C:\Temp\idbvtnlfdy.sys
1⤵
PID:3696

C:\Temp\snlfdxvpni.sys
C:\Temp\snlfdxvpni.sys
1⤵
PID:6064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ausnkfcxvp.exe

Path C:\Temp\ausnkfcxvp.exe
Size 361KB
SHA256 d4ba64d1aebe09f86bffaed4e89c198caffb0065cd1d3ed9598f1fa5c63d6150
MD5 45d5d59337666632a6119f3a5c2a4e59
SHA1 0aa7fb509351b60a23d1b1d03787152463865cd3
SHA512 3c22ac8e9bacbb1c164fd4ace545b4d7a1ad95dc691ee0d29deb889b0a8903b34ee9894b5e84fb72611d52f83fb28539243e4f97b0e80ef478557d228120f9ee
SSDEEP 6144:iflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:iflfAsiVGjSGecvX
TLSH
T1A3747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcavpnlfdx.sys

Path C:\Temp\fcavpnlfdx.sys
Size 293KB
SHA256 6ac612e4c09caaa897d7787b97a7764ccc83754d54f30ebd4d756c7be25ad528
MD5 3ace31df6242a0967e4b8816d8691c3e
SHA1 92bf099d8f6df7a2b7d79c7d43af23a515b784b2
SHA512 a326182cb857fa64dc30d5f49f5bdcec42437dffdda782399ad2f0fbb293670dae8d6b186ac0fc887dbc11eb41371efdc336a8998b0bba46422b8c4aaeef18e7
SSDEEP 3072:CtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:CIJjiJcbI03GBc3ucY5DCSj
TLSH
T13C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gayvqkidav.exe

Path C:\Temp\gayvqkidav.exe
Size 361KB
SHA256 f489de266fd72d7b506c4f4320900d71bf660c4a1eaa1762458ab14a5f772bd2
MD5 f0531f5d83e321bcea956d8f59c97029
SHA1 2cd47ac70ce82ce77e47d8c92e75a34eab648bc4
SHA512 2c71949ef07af3373123a4fe55c29977c721328c304e462abd48d35dfaa738c5d0e1c9cd2c2a1db78f6b61025d4582abdc992debb6311ca8541b230ded84e9a9
SSDEEP 6144:IflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:IflfAsiVGjSGecvX
TLSH
T117747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hezwrpjhbz.sys

Path C:\Temp\hezwrpjhbz.sys
Size 293KB
SHA256 66742a41a31d0d022b9bc710806ac64e1f3bdd0bcf71b0aa16285d54459e44fe
MD5 f289aa209ddf8810d1ec9e7ffd6d5b94
SHA1 616f6a2978bc5411174c82a3233848bc296a0919
SHA512 e061558b873ee6b5ecfef8c89b6a307839a505f3181a46dfaab491cfb5a08ac057ca97e7c8b03ca7d6cc076154bd5489cab5caf3774abad3b5442c02d03391af
SSDEEP 3072:ktKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:kIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzusmkfcx.exe

Path C:\Temp\hfzusmkfcx.exe
Size 361KB
SHA256 26ab00cd9aaf40a855ff67b93d077a23adbe02a8d2487cece33f1f14bdef5c7b
MD5 1d7958ddac32cebe29163d9153b34e89
SHA1 d4138f331d520512b7b048c10e80ea86668b38ac
SHA512 238618392f7e26e76e676b7f8165a83611ae079154a80b66d02d7cab95a9abf12714a1b12f112bcd9bc893e8435cbafdf24aad389dd7fd6664a5ae1c6a3d8676
SSDEEP 6144:zflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:zflfAsiVGjSGecvX
TLSH
T1EB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ausnkfcxvp.exe

Path C:\Temp\i_ausnkfcxvp.exe
Size 361KB
SHA256 7cf64eb8dd8506268e5516e7a3c22c46dae058f67cc2c46ed110e00942c64a3f
MD5 f64b357f4e737bf37b32227d0d302a06
SHA1 349c71018aedd928547949660a50404eded2dd9c
SHA512 b414dbac72e1d0bc385ce666494e18ef2e02261ec9bbe907dff10211c64aa92ac319bd941285753bb90de5742926f5335ba53342bc8d6562a4b796da40d91b7f
SSDEEP 6144:1flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:1flfAsiVGjSGecvX
TLSH
T1AF747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gayvqkidav.exe

Path C:\Temp\i_gayvqkidav.exe
Size 361KB
SHA256 6a398293f7f33b5e3da96b5dc7f63edb833cd3bd1d5a4bcef57e7417089a4485
MD5 b3688057b40bd34f7e90eaccc8060e5e
SHA1 28131487ab98688adbadddeadff2376541e4be7c
SHA512 bc31f74408f857baf4b21af432602f4b676e27baa26f0c248388325aa63462efbf99cf59ddec736789fdfe4e3ea735ee0ebf646833e145480cbbd4f19400fd38
SSDEEP 6144:iflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:iflfAsiVGjSGecvX
TLSH
T15A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfzusmkfcx.exe

Path C:\Temp\i_hfzusmkfcx.exe
Size 361KB
SHA256 34715ba4b04cea5e0c9ee8f1cebb672659db1e19f8d369664c291f836159b1e8
MD5 8ca121ff4921493c24f8a19c449f2830
SHA1 8bb51b4b0f6cbd8db2b55eba630a51eba9668c5c
SHA512 7ce7587c0611640995a6426dc346015dfab4b13303b0492cf9d6ebfe79a4c089ba1188147e5755cc5410aad0a2e0f93c7e0dad27df5a16d94922bb1ad0b0b7cf
SSDEEP 6144:qflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:qflfAsiVGjSGecvX
TLSH
T1A8747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_smkecwupmh.exe

Path C:\Temp\i_smkecwupmh.exe
Size 361KB
SHA256 b7fd98449d973a496f6a957eeb594b19845fa724fb59c652a23665f05b231788
MD5 e5c85a9c8589e5466d43306337b34eb5
SHA1 f98ca71e5a6cb44c5f036f10d221b16410c7eefa
SHA512 deaaf7d4a4b9a7ad1879fd9fab84b1643165236e8cd25ab576022ba6aa510d2cafae4ff53fdfafcf9c10f20eeb324f5c1d27c9b0217d3b0d13ca2a055ba3cea3
SSDEEP 6144:HflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:HflfAsiVGjSGecvX
TLSH
T167747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrpjhbztrm.exe

Path C:\Temp\i_wrpjhbztrm.exe
Size 361KB
SHA256 c9ad03622a4bea39c2d907d2184b0a5737da4b0f8e37e036302db6e3cc618b82
MD5 aee6ef002a63a35d874b05e8069f02e2
SHA1 a93cb6cddfc28acfcb48931fc969ab0c19bcffd9
SHA512 0f7855d7aa1f4692a7a69e80849f1efd175724887bd020ae713c1f7c0deb674ac950449f0d0f7f8f332bd822db508fd8311873b5943f140c407256d2ed70e5d2
SSDEEP 6144:2flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:2flfAsiVGjSGecvX
TLSH
T1AA747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqkicavsk.exe

Path C:\Temp\i_ysqkicavsk.exe
Size 361KB
SHA256 587bf5c9242b52a7649a7210d9f3f6bc66070b49572a640938bc785beecf195d
MD5 177dece82a87469f49efe93f76934c8f
SHA1 9b8860f8b31a667979223e2d8074536bea4c2d8f
SHA512 9c0d3b00fe37d63ccf7394d88ed28552a3eaf2a600cc31c58a43be8724d8f1011eb416080daa2d7704d747ab208885be87d2eb00d3c5fe4b41524619ea36f957
SSDEEP 6144:yflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:yflfAsiVGjSGecvX
TLSH
T16A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljeywrojge.sys

Path C:\Temp\ljeywrojge.sys
Size 293KB
SHA256 623afd8a6db1fd7057a9eb5d69822f529f2651b31cfbd8111d242ec409417d77
MD5 7a319e040b596abef3a33ad87cf04706
SHA1 f16911223998f011707c51465a583caf49de31ae
SHA512 c7ca3013fb9ee6c9fe49d4185b7f6ff22816f55e9a2f666d0e6d0e4b2ef7ca814f7a2e97c48309bae2cf4acd1fd6df698268bc16d2e846bd8b3665ec79f8657c
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnkfdxvpnh.sys

Path C:\Temp\pnkfdxvpnh.sys
Size 293KB
SHA256 830181caabf26c09ed8bc300b09bf5ed08760d1aedb138d5ee9252fa5f05282e
MD5 c2face5d9913d9d930443ea98434d7d6
SHA1 a18c440a4d55540edb406f1a3f5cf77414f5e2d2
SHA512 1b7eb1ffa3109d3fd649caec2471b510f074e692b55edb7a691a77297204748f8a9b1f9a84630367e2e7ae33a209f8a36e0ea3528a74896a13d3c499b92dbb21
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T18A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpnhfzxspk.sys

Path C:\Temp\rpnhfzxspk.sys
Size 293KB
SHA256 36e956d6d248cb87224e5d8b08d17afe3a5774dde329db116263ea310f983693
MD5 bf450cd4b9cc916fc547900743e0d5c2
SHA1 a897cabe01300eebe9cb2c7c4b55bf7e7a352c2d
SHA512 f76c788cab03406c912507350b65daf45eec859bcd8aa0fa276ad678776808f941c92c2321f72801d42e0757f058e28cd4f85d4b6d25875408b86be69a1fe42e
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkecwupmh.exe

Path C:\Temp\smkecwupmh.exe
Size 361KB
SHA256 a1285cd66a4703d519f66766b1f7be8e52ccca62b3f7e0a9af23e64af983cd9e
MD5 32aa16a55b17bda6be62df6e30a97d67
SHA1 14572b6b04af6b55af52a10c2f820232fecd0260
SHA512 72d095a3b9a04d5f7467d68f51a3a76886c5ef02fa89347619cbc86a2e5d28153fe669ff80f97f1eee65a381ee22f62f1505cefaf43c6320721924557245d8f8
SSDEEP 6144:XflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:XflfAsiVGjSGecvX
TLSH
T1B0747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdyvqoigaysq.exe

Path C:\Temp\vtnlfdyvqoigaysq.exe
Size 361KB
SHA256 094999ba8051028bdade886c628896047d0178c86555e0e0dca8e6d26b21d9b6
MD5 930ab92339a8f2dc7ec2721e102fe588
SHA1 24ad2efa64ebbdab0020230433871b129b47d471
SHA512 aff7a03aff694ea3cce846a9ff74fc25e2d49a70bdbdeee9a5714d9f10fcd0d80250cb404037e1870b55193e9e7ec821eb10acae8b21d4841599d4c8ca674da2
SSDEEP 6144:2flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:2flfAsiVGjSGecvX
TLSH
T181747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdyvqoigaysq.sys

Path C:\Temp\vtnlfdyvqoigaysq.sys
Size 293KB
SHA256 04b809e1b6127de7c0d53edb27e3a7e3d88314f599f0805c3aad5ac662cc21e5
MD5 6430819c1c1ccda9620bd2382f32848e
SHA1 762be42595c357062c605d9a00fa34729c4a435c
SHA512 8a6ee936e763347ba18e91b09f09e715a6d063f488f7faac594fe13bd64b9e0ff2e31e9569b0bd8a7417295c449ae5137a70c7c5679f7dae126026106d7b473d
SSDEEP 3072:UtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:UIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrpjhbztrm.exe

Path C:\Temp\wrpjhbztrm.exe
Size 361KB
SHA256 07160eb353cec60cd9f369356ded4bed247dfde416990ea088cb90ef4e744028
MD5 81818d4bb2de105a71547356c5da9497
SHA1 e8d24639130947d83fc79ff8dd88d78bba7435c4
SHA512 2eddf9efdf5a01bf006aea2df27ac61634c2a5c3c0463db2ba904e2dac83ee835c3562ab8744f2f7ad631540942a678782fecd8a44ed56fae4a81ceff5b0324c
SSDEEP 6144:DflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:DflfAsiVGjSGecvX
TLSH
T10C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtomgbywto.exe

Path C:\Temp\wtomgbywto.exe
Size 361KB
SHA256 b12d6fe3444c6c0c539628141db52e7353a17d27da7f0250b77bc023b6381071
MD5 d6eac2b25b0b82ca52dd51f0e2ec8325
SHA1 b23a6a9d975c036b1e60815a42543c1af0222883
SHA512 c8a1cd1491708422cc89f2eea5c58beefe8e6dbf4bf7cccabc39496c6a5e5d87cfc0e726fd6a8542d9e2d4837385412ac8e1a79c11bf54ee73978eec8377ce7a
SSDEEP 6144:eflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:eflfAsiVGjSGecvX
TLSH
T17C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqkicavsk.exe

Path C:\Temp\ysqkicavsk.exe
Size 361KB
SHA256 17f940fb9d15cad993828dda577d13816b1fbc1cd16e9e7881c5f0668df49781
MD5 3f388e17eea9c89a5313534288d436c1
SHA1 3817ec1ce2410305c285f1736cdccdcdf4461d01
SHA512 5affbf9d6ccde505955d3df339897d74e097c4352bf198a31797fc059cf49bd50ccd93f240906397995367a89629086c6dd38807ae4871efb5b91bc45da5b7ce
SSDEEP 6144:IflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:IflfAsiVGjSGecvX
TLSH
T199747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpjhczur.sys

Path C:\Temp\zxrpjhczur.sys
Size 293KB
SHA256 15e28bd8274c036f8c6b69d5bf1bd1c310861bee6d5ec957c98543f484404ba4
MD5 f52b6b68a356d140406e8c055c4776cc
SHA1 5f660821fb0779de20e5b6f7163fda5f0ecdfe9d
SHA512 326903edd866c33ce07ae8087946eec73974c6f64d2846bddf8b8925d8340b2f12e9f14a7d1ee2056b4b12c9c7848aabcd76277cd6bccf9265ded8a5934fcac1
SSDEEP 3072:ztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:zIJjiJcbI03GBc3ucY5DCSj
TLSH
T188545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 55b968461c3cac4c7effa8a6c28244f55447bc6d9425abffdc980dbcf8f66a56
MD5 0f2dd8d756f52925ee56edb716c271af
SHA1 5baaa4f814deacaf47060c8d09015a8db39ce0b5
SHA512 9f360c7252debebc7f5372dc3ef1b650a635a7874dcf1f582432193203c260b088889ed1445047bad1f96fda147db83e0ec8ddfccd1d60be7a75e2fa03873bb0
TLSH
T1A1D0C0E073697941C32134F278218700F35004B1682BCA41B0C4400C8D7504A53C620B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 aebb6c70ab7a24d554d6f6ac0f891eea8d0143d763ae26afd14158a62471d32c
MD5 4df2b013f915bbf768a35e9c1e788fe1
SHA1 5f99dfa4310596930be8e393c0de83bb374a10f7
SHA512 5285653806cab96614917acfa4a3f6992cd581c9ad8eb14808de784b888ecfebb44f82a0a32c756a63c062605216d2535eed0d53eb14c4498ab3ae12d2d005b5
TLSH
T148D080E077697941C32534F274158740F7555471646BCA41B0D4D10C8D7555AA7C6257
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1f8243265e796d2f2651ad963ab087b79c12afab83da4e18b391ff88c8eda21c
MD5 e038104cb30f853d4fb4c17d93d811bd
SHA1 fd60f18b9de22295125c43e8f69d0bb409d9e4e0
SHA512 80a02ea233087329d60395883bcea2f3da0ceeeb470966e0ea39af14d3eb10d17a1e1de9cb90f04c3b5a5aab52eae358823b9066867a21e71295bab997049157
TLSH
T1D6E02BAAC921AC2708FC6B6C70954641E650132627508D4F3A3D810CCFB2B7B426682C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0c424210c421c9c8b90e88d87be494949d88ab1b0025c00dfe6fd3280933d216
MD5 465f60af9589037978bd51e06c10c856
SHA1 873cfe983bc4688e8a8d07ef774f675cc8155d9b
SHA512 11eba2c2ab98cc23d7d16763434944c38bf9e4ed2febc03533231b44f339b0123ebb57d9e608f0cf032ac4a00297dac2d6177437132ef5eb7daa9479ceae6281
TLSH
T15241EFF783F4856ECA0196F0AA186E2FCE1C0911832C3D5AC9E4AF1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b74da21dd75794676d7ff129bedb6d5acad4e9e97468bf684c1c5bffc262e6a9
MD5 093ef2318153ee4fe369ad36738be1b8
SHA1 5259c954810d3310280b76bdf59a4dc48243cbac
SHA512 cba54bbf86ac9b2277cd97a001c7444e17b78f90b4c4e4086ab184b525211ae2201a4f3a29d092318ebc414c0be4cc646e96d5ebcdf999c521dc4bbceb3d36c5
SSDEEP 192:sxRcRwyMqZjK1Ml8wcf/fXsL1mtZKOOZJnzoA8pw/g6+WNIYAHDTfgGAIgjcViJ:sxRcfCf/fXsLcDeZ8w/5ITfgjcV+
TLSH
T1E562F9166938993B8CDBD208FA557F53D6F81573A2905E44EAFC8A0C05E76ED221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 06b2129d06550f9f2a5169ecd40da75309e3a2e3d2ca5d35f7738d4726aa6f65
MD5 fed4704e609caf570a0fdff51265d326
SHA1 742c5a6b19a7d958123c48a24d2b41dcc7aad250
SHA512 29fa9b73b70244fc0a3404e1b1fe7d2b93e98228cd3917c29e18ba51ff66237fd27cc8f0e9a9458213e7ed2a7f62e2872cedbd40a2aef50a01428883899537ec
SSDEEP 192:sxRcRwyMqZjK1Ml8UQUcf/fXsS1stZKOOZJnzoA8pw/g6+WNIYABKDTfgGAIgDia:sxRcfqzf/fXsSuDeZ8w/5Iefgua
TLSH
T1AD72D8166938993B8CDBD20CFA957F53D6F81573A1905E44AAFC8A0C05E76ED211383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 9ede867e033aa7df868c521fccf24a84a7be5602ef23c7b7d60e09174edb6fce
MD5 2bc11c0af638c1105b5a9e78979c68a5
SHA1 4eec180bec63fc2d6fd4b181b74ca9c52fbea232
SHA512 2f7f623843c309bc976303e91dad84e0c3f0909010b3bd0f44a2acdab974b8b64bb19a34ffee9d8db0cdd32ea1417d433076649da03aa9d2d2581bb3d4d671a3
SSDEEP 768:DckYJT7pLuL7glWg1NfgB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVeSVhHgurop/4h:DckYJFE7glWg1NfgBu1jaNSVdglpI
TLSH
T152E2DB7B680CCB7F4F804A9CEC297D9A6DA801CF96D8CD5447EA840C03C67EB511A5EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 90554ae971b7642950cac9654271947db97e209eb0e1483fdf821f6a05e83aae
MD5 c2eadf0d38fa86d23746527a9da0d84e
SHA1 25dfa2d910346ed4d1b7067bcdce8c370d0fde30
SHA512 4b4cb7dbe531fb02bc74bcfe345d311c6af1d6c2a60c1a94e2dd10f538f634ba348848a8aeaf0a9a21bbccea738a90b136bf1e38a703f93358d05fce60ceb0cb
SSDEEP 192:E61PhSGGXWL8MMLOi70MjSEJB3BPorbu/drtBZnZj5vcafG6V:E+PKFT3JoPuVr/ZZjh5
TLSH
T1E1B20611763B33C2387D39088194982F52C27563321AA96B7BBC54EA4F67E01DEFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 98c0024cbad92eee946b3d480063ebb565e34d3a780e44472bf4ee5513c637d0
MD5 a2d2480049a7d2c8113687098f2251a5
SHA1 f816c7ea7670194ad1c2337f9d935ea798ef19f8
SHA512 23188f56abe73d9ac576f4b7353483fb377dfe24585c3061c3333d2d87dd1913862f59f71054d401f9072054b145677ecd93f4ca89104547fa18085d17f007ec
SSDEEP 384:n/iF1tNn/s3n9Sy8N78TUNTUlIRvB1iiEsZstsfUGVou6Cmn15wbAjE+8L+1Iz3:KF1j+9XuwgYywGV0Cmn12bfb
TLSH
T149C24A36DC64CA67ADF78FC9B70ABA06EEE001A385D859E4D9D94D4D01D32DD1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4062f9adbde906dccd80bc4830b5286e3af25395b836c34db1f2047c0abb4215
MD5 356d5781e86d3b314430020e64cb8ff1
SHA1 164966151c68667e12b6ee79cf1206035626cc9c
SHA512 3bb6a5481c4a2cb67cf06b625614e044b76696a6461b716eb6a73e3c75c945bd820d611209a2c884a64f4ac9f5fbd0fd28ff652802023b1f4b8b9478ed6bc3c2
SSDEEP 384:n8iF1tNn/s3n9SP8NI8TUNTUlIRJB1rhpjstsfUGVou47l+FBlOObjI9G6w7pV8j:nF1j+9Wlwg3nWGV67leBl29Mp+
TLSH
T117D25A32DC55CE67ACEB8BD9B74A7A47DEE401A385889ED8E9C95E0C01C71DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 28df0578be107996566c28bf8d9971107d1150c42ccc95b3e6781e4003b8c332
MD5 c4047bbe1cd27b0b08004c4728cef843
SHA1 7c4c5743f09908ef0b3e2069bb3d35af6c64021e
SHA512 5ca21f16c4dd4c7f9aadded2b1c4f8a623897797f52f0333328e09ccbfbb6902c71e341c704437e2412c8851ef9f59afbc4645e0371bbdb703a6c3fc1eea1693
SSDEEP 384:nNiF1tNn/s3n9Sf8NI8TUNTUlIRJB1rhpjstsfUGVou47l+FklOObjI9G6w7pV8j:EF1j+9ulwg3nWGV67lekl29Mp+
TLSH
T1ADD25A32DC55CE67ACE78BD9B74A7A47DEE401A385889ED8EAC95E0C01C71DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 18e64e83d8c1da80518d82e31342b89e93c7eeee3d681ad50bd026dede36e036
MD5 d1df6680429628fa4e5ade341e5b4fe4
SHA1 86ddc9f278be992374c0ec7c4e27ff74936eeb33
SHA512 2dad44df79fb282ace92553a2c2ecbc0df9824dc55f78ac5cab73dfedb661297ccf0c54faf1c043cb20fc334e8b5f34f793ed0721647eacde918a91bf14bd567
SSDEEP 384:nIiF1tNn/s3n9S8+8NI8TUNTUlIRJB1rdEpjstsfUGVou47l+FBlOObjI9G6w7p+:TF1j+9T+lwg3KWGV67leBl29Mp+
TLSH
T173D25A32DC54CE67ACEB8BD9B74A7A47DEE401A385889ED8E9C95E4C01C71DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 ea753126ca7b54beb91187854e0599fc354f32b34893b578233927c5d4dea736
MD5 19f1254a86347a0f6e6816737c9db780
SHA1 cf71c3c65d3c70384b925818b3fbfe1bc435f976
SHA512 784b8d3aacadfe04da6e97a395cb74a883ba04b4107fd61fa22805af70db92c74a967a0f83c5bb5b4c03d595d8bb70a26458caaef94a5bf356105d9cb3e601bf
TLSH
T1033144E09D3C1ED1C4BD0DAFF09735FC94D8D212F854343D6888F8A9962D64A658083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 08758f0b1d7e6f26577509cb1580231340d8c5b1291fd1e51ccca9f66fbf3658
MD5 7b2f9b3e8dbcf1980d2fb39480a43b1a
SHA1 915fc3937cd5628675c893a189e871815f34d2a7
SHA512 5ad3201fbc6a07a28e366ee9d452d60bc988f38d9d53308a2f154c85777e27fb815541313494f0c87cb4b19e8289a1da19f75696eccb2d47573f42c6d8026c22
TLSH
T1C83122E1993C0AD2C4BD4DBFA05B25FC94EC9616F49434392888EDA8962D649258043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 c44ec296e261fa8f541a38d2ebf2a2e93253384d1ad11b71f8a3ddc1f93c02cf
MD5 035eb15b0e4438df625176d0f35894fa
SHA1 7ec7e0c2f17dcb4b128e105b7c2bdc4673eb3f50
SHA512 fb8a6447076bda689cd6051dc094c09520e730fd4673ce5a36de3e61d6b41025f25cf320f7a247c5f9e7f922689bec3d1df29da93083e2a30f076c19b533569b
TLSH
T184315EE099380AC2C4BD4DBFB09B25FC94E89622F49434392898EC68962DA0D258083F
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 73867b68f790932f0e30c0225bf71114a9f1c3c8b12f41bafcf9c80a9b7e5c99
MD5 04584f7f0402a6e0b0eed86a20acb12a
SHA1 b3d573288bdccb606389c68bb97d4a7f5d20cffe
SHA512 e6c3568f6198d7a8d51033cb05328eb9bca61184d7ec27ea6ccfebb57b1673f4f3f7e5e8274c14ef745c226700e47dcc0ff0a9f4037c5dc46eeb4faa79b805a5
TLSH
T1FF71009356ADC9B2C19E5BF103839204F2FB223C4763302007965586AA70B3A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/240-338-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1124-242-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1908-278-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2056-349-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2224-61-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2224-179-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2420-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3032-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3212-373-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3408-158-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3428-284-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3696-403-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4252-186-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4920-391-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5060-228-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5060-214-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5124-288-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5456-227-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5960-292-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6064-423-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6716-369-0x0000000000010000-0x00000000000AB000-memory.dmp

Download