systex | 94b2335fe4609a4721f699d470722e09501338b0493abbb80519cc86cf69cc31

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 17:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260708-vwpbjsdt6k
SHA256 94b2335fe4609a4721f699d470722e09501338b0493abbb80519cc86cf69cc31
MD5 9a674aa881ecf3ea66f04b2a54f46bf4
SHA1 d7cd6fea7775955a38cb34765249a0ceab196128
SHA512 b0ee1628322c70f13c84a47eef769d2221d7d807a69eda0a162da2ca6af52d74dbde7ab59ba1102f6b0febdea8ffd2c758895510225e2b92f40961981cf9d4a6
SSDEEP 6144:YflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:YflfAsiVGjSGecvX
TLSH
T1EF747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2384	fzpjhczusmkecwup.exe
2828	fzpjhczusmkecwup.sys
2996	CreateProcess.exe
2092	zxrpmhfzxr.exe
3440	CreateProcess.exe
4808	CreateProcess.exe
920	i_zxrpmhfzxr.exe
1184	fzxrpjhbzu.sys
4152	CreateProcess.exe
2876	jhecwuomhe.exe
1900	CreateProcess.exe
1404	CreateProcess.exe
2676	i_jhecwuomhe.exe
1064	ebwuomgeyw.sys
4448	CreateProcess.exe
2424	wuolgbwrmj.exe
5508	CreateProcess.exe
2900	CreateProcess.exe
6084	i_wuolgbwrmj.exe
1692	geywqojgby.sys
4048	CreateProcess.exe
1556	ytrljeywto.exe
2456	CreateProcess.exe
3840	CreateProcess.exe
5540	i_ytrljeywto.exe
6060	lfdbvtnlgd.sys
4972	CreateProcess.exe
4532	bvtnljdbvt.exe
5848	CreateProcess.exe
3112	CreateProcess.exe
5768	i_bvtnljdbvt.exe
5136	nifayvqnig.sys
2212	CreateProcess.exe
2848	dxvtnlgays.exe
3036	CreateProcess.exe
5268	CreateProcess.exe
1020	i_dxvtnlgays.exe
6084	fdxvqnifay.sys
2440	CreateProcess.exe
1304	nkfdxvsnkf.exe
5684	CreateProcess.exe
2264	CreateProcess.exe
3200	i_nkfdxvsnkf.exe
6044	vpnkfzxvpk.sys
3396	CreateProcess.exe
3016	hcxvpnhfdx.exe
2956	CreateProcess.exe
5112	CreateProcess.exe
5988	i_hcxvpnhfdx.exe
1500	kecwupmhfc.sys
2008	CreateProcess.exe
5432	cxupmhfzxr.exe
5092	CreateProcess.exe
4736	CreateProcess.exe
1396	i_cxupmhfzxr.exe
3032	bzurmkecwu.sys
4948	CreateProcess.exe
2776	rpjhbzuomh.exe
3676	CreateProcess.exe
4356	CreateProcess.exe
2968	i_rpjhbzuomh.exe
5748	bwuomgeywu.sys
5836	CreateProcess.exe
2316	rljdbwuomg.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_502182439\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_71003142\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1665838010\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1740728258\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_71003142\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1665838010\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1740728258\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1740728258\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1740728258\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxupmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxspnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuolgbwrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxspnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmkecwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmkecwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvtnlgays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcxvpnhfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxupmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbzuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhfzukec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhfzukec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvtnlgays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icaupnkfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfdxvsnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfdxvsnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbzuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvsnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytrljeywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvsnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytrljeywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcxvpnhfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzpjhczusmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icaupnkfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuolgbwrmj.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5468	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 18 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1488	ipconfig.exe
1244	ipconfig.exe
3868	ipconfig.exe
5720	ipconfig.exe
2836	ipconfig.exe
6020	ipconfig.exe
3400	ipconfig.exe
5768	ipconfig.exe
3024	ipconfig.exe
1376	ipconfig.exe
2060	ipconfig.exe
5560	ipconfig.exe
2068	ipconfig.exe
5952	ipconfig.exe
5748	ipconfig.exe
3164	ipconfig.exe
5968	ipconfig.exe
1284	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280048472525613"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{1EE5129E-EDC4-4EE6-953C-C096E7E0DFC2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2384	fzpjhczusmkecwup.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2384	fzpjhczusmkecwup.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2384	fzpjhczusmkecwup.exe
2384	fzpjhczusmkecwup.exe
2384	fzpjhczusmkecwup.exe
2384	fzpjhczusmkecwup.exe
2384	fzpjhczusmkecwup.exe
2384	fzpjhczusmkecwup.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	920	i_zxrpmhfzxr.exe
Token: SeDebugPrivilege	2676	i_jhecwuomhe.exe
Token: SeDebugPrivilege	6084	i_wuolgbwrmj.exe
Token: SeDebugPrivilege	5540	i_ytrljeywto.exe
Token: SeDebugPrivilege	5768	i_bvtnljdbvt.exe
Token: SeDebugPrivilege	1020	i_dxvtnlgays.exe
Token: SeDebugPrivilege	3200	i_nkfdxvsnkf.exe
Token: SeDebugPrivilege	5988	i_hcxvpnhfdx.exe
Token: SeDebugPrivilege	1396	i_cxupmhfzxr.exe
Token: SeDebugPrivilege	2968	i_rpjhbzuomh.exe
Token: SeDebugPrivilege	5732	i_rljdbwuomg.exe
Token: SeDebugPrivilege	5916	i_oigbytrljd.exe
Token: SeDebugPrivilege	3516	i_oigbytqljd.exe
Token: SeDebugPrivilege	5844	i_bvsnlfdxvq.exe
Token: SeDebugPrivilege	5232	i_ifaxspnifa.exe
Token: SeDebugPrivilege	1512	i_icaupnkfzx.exe
Token: SeDebugPrivilege	3384	i_rpjhfzukec.exe
Token: SeDebugPrivilege	1016	i_zurmkecwrp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4704	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 2384	960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 960 wrote to memory of 4660	960	2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4660 wrote to memory of 4704	4660	iexplore.exe	90
PID 4704 wrote to memory of 5396	4704	msedge.exe	91
PID 4704 wrote to memory of 1724	4704	msedge.exe	93
PID 4704 wrote to memory of 5468	4704	msedge.exe	94
PID 4704 wrote to memory of 1724	4704	msedge.exe	93
PID 4704 wrote to memory of 1724	4704	msedge.exe	93
PID 4704 wrote to memory of 2084	4704	msedge.exe	95
PID 4704 wrote to memory of 2084	4704	msedge.exe	95
PID 4704 wrote to memory of 2044	4704	msedge.exe	96
PID 4704 wrote to memory of 2044	4704	msedge.exe	96
PID 4704 wrote to memory of 2044	4704	msedge.exe	96
PID 4704 wrote to memory of 2980	4704	msedge.exe	97
PID 4704 wrote to memory of 2980	4704	msedge.exe	97
PID 4704 wrote to memory of 2980	4704	msedge.exe	97
PID 4704 wrote to memory of 1584	4704	msedge.exe	98
PID 4704 wrote to memory of 1584	4704	msedge.exe	98
PID 4704 wrote to memory of 1584	4704	msedge.exe	98
PID 4704 wrote to memory of 5680	4704	msedge.exe	99
PID 4704 wrote to memory of 5680	4704	msedge.exe	99
PID 4704 wrote to memory of 5680	4704	msedge.exe	99
PID 4704 wrote to memory of 5612	4704	msedge.exe	100
PID 4704 wrote to memory of 5612	4704	msedge.exe	100
PID 2384 wrote to memory of 2996	2384	fzpjhczusmkecwup.exe	104
PID 2092 wrote to memory of 3440	2092	zxrpmhfzxr.exe	107
PID 4704 wrote to memory of 4788	4704	msedge.exe	110
PID 4704 wrote to memory of 2868	4704	msedge.exe	111
PID 4704 wrote to memory of 4788	4704	msedge.exe	110
PID 4704 wrote to memory of 2868	4704	msedge.exe	111
PID 4704 wrote to memory of 5136	4704	msedge.exe	113
PID 4704 wrote to memory of 2796	4704	msedge.exe	114
PID 4704 wrote to memory of 2796	4704	msedge.exe	114
PID 4704 wrote to memory of 4644	4704	msedge.exe	117
PID 4704 wrote to memory of 4644	4704	msedge.exe	117
PID 2384 wrote to memory of 4808	2384	fzpjhczusmkecwup.exe	118
PID 2384 wrote to memory of 4152	2384	fzpjhczusmkecwup.exe	122
PID 2876 wrote to memory of 1900	2876	jhecwuomhe.exe	124
PID 2384 wrote to memory of 1404	2384	fzpjhczusmkecwup.exe	127
PID 2384 wrote to memory of 4448	2384	fzpjhczusmkecwup.exe	131
PID 2424 wrote to memory of 5508	2424	wuolgbwrmj.exe	133
PID 2384 wrote to memory of 2900	2384	fzpjhczusmkecwup.exe	136
PID 2384 wrote to memory of 4048	2384	fzpjhczusmkecwup.exe	141
PID 1556 wrote to memory of 2456	1556	ytrljeywto.exe	143
PID 4704 wrote to memory of 5456	4704	msedge.exe	146
PID 4704 wrote to memory of 5436	4704	msedge.exe	147
PID 4704 wrote to memory of 3408	4704	msedge.exe	148
PID 2384 wrote to memory of 3840	2384	fzpjhczusmkecwup.exe	149
PID 2384 wrote to memory of 4972	2384	fzpjhczusmkecwup.exe	153
PID 4532 wrote to memory of 5848	4532	bvtnljdbvt.exe	155
PID 2384 wrote to memory of 3112	2384	fzpjhczusmkecwup.exe	158
PID 2384 wrote to memory of 2212	2384	fzpjhczusmkecwup.exe	162
PID 2848 wrote to memory of 3036	2848	dxvtnlgays.exe	164
PID 2384 wrote to memory of 5268	2384	fzpjhczusmkecwup.exe	167
PID 2384 wrote to memory of 2440	2384	fzpjhczusmkecwup.exe	171
PID 1304 wrote to memory of 5684	1304	nkfdxvsnkf.exe	173
PID 2384 wrote to memory of 2264	2384	fzpjhczusmkecwup.exe	176
PID 4704 wrote to memory of 5832	4704	msedge.exe	180
PID 4704 wrote to memory of 5832	4704	msedge.exe	180
PID 2384 wrote to memory of 3396	2384	fzpjhczusmkecwup.exe	182
PID 3016 wrote to memory of 2956	3016	hcxvpnhfdx.exe	184
PID 2384 wrote to memory of 5112	2384	fzpjhczusmkecwup.exe	189
PID 2384 wrote to memory of 2008	2384	fzpjhczusmkecwup.exe	193
PID 5432 wrote to memory of 5092	5432	cxupmhfzxr.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_9a674aa881ecf3ea66f04b2a54f46bf4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:960
- C:\Temp\fzpjhczusmkecwup.exe
  C:\Temp\fzpjhczusmkecwup.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrpmhfzxr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2996
  - - C:\Temp\zxrpmhfzxr.exe
      C:\Temp\zxrpmhfzxr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2092
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3440
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrpmhfzxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4808
  - - C:\Temp\i_zxrpmhfzxr.exe
      C:\Temp\i_zxrpmhfzxr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhecwuomhe.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4152
  - - C:\Temp\jhecwuomhe.exe
      C:\Temp\jhecwuomhe.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2876
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1900
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhecwuomhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1404
  - - C:\Temp\i_jhecwuomhe.exe
      C:\Temp\i_jhecwuomhe.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuolgbwrmj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4448
  - - C:\Temp\wuolgbwrmj.exe
      C:\Temp\wuolgbwrmj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2424
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5508
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuolgbwrmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2900
  - - C:\Temp\i_wuolgbwrmj.exe
      C:\Temp\i_wuolgbwrmj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ytrljeywto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4048
  - - C:\Temp\ytrljeywto.exe
      C:\Temp\ytrljeywto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1556
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ytrljeywto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3840
  - - C:\Temp\i_ytrljeywto.exe
      C:\Temp\i_ytrljeywto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtnljdbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4972
  - - C:\Temp\bvtnljdbvt.exe
      C:\Temp\bvtnljdbvt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4532
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5848
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtnljdbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3112
  - - C:\Temp\i_bvtnljdbvt.exe
      C:\Temp\i_bvtnljdbvt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvtnlgays.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2212
  - - C:\Temp\dxvtnlgays.exe
      C:\Temp\dxvtnlgays.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2848
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3036
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvtnlgays.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5268
  - - C:\Temp\i_dxvtnlgays.exe
      C:\Temp\i_dxvtnlgays.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkfdxvsnkf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2440
  - - C:\Temp\nkfdxvsnkf.exe
      C:\Temp\nkfdxvsnkf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1304
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkfdxvsnkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2264
  - - C:\Temp\i_nkfdxvsnkf.exe
      C:\Temp\i_nkfdxvsnkf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hcxvpnhfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3396
  - - C:\Temp\hcxvpnhfdx.exe
      C:\Temp\hcxvpnhfdx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3016
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2956
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hcxvpnhfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5112
  - - C:\Temp\i_hcxvpnhfdx.exe
      C:\Temp\i_hcxvpnhfdx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxupmhfzxr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2008
  - - C:\Temp\cxupmhfzxr.exe
      C:\Temp\cxupmhfzxr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5432
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5092
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxupmhfzxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4736
  - - C:\Temp\i_cxupmhfzxr.exe
      C:\Temp\i_cxupmhfzxr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhbzuomh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4948
  - - C:\Temp\rpjhbzuomh.exe
      C:\Temp\rpjhbzuomh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2776
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3676
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhbzuomh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4356
  - - C:\Temp\i_rpjhbzuomh.exe
      C:\Temp\i_rpjhbzuomh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljdbwuomg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5836
  - - C:\Temp\rljdbwuomg.exe
      C:\Temp\rljdbwuomg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2316
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljdbwuomg.exe ups_ins
    3⤵
    PID:1548
  - - C:\Temp\i_rljdbwuomg.exe
      C:\Temp\i_rljdbwuomg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigbytrljd.exe ups_run
    3⤵
    PID:3128
  - - C:\Temp\oigbytrljd.exe
      C:\Temp\oigbytrljd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1292
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5880
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigbytrljd.exe ups_ins
    3⤵
    PID:4648
  - - C:\Temp\i_oigbytrljd.exe
      C:\Temp\i_oigbytrljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigbytqljd.exe ups_run
    3⤵
    PID:4060
  - - C:\Temp\oigbytqljd.exe
      C:\Temp\oigbytqljd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4672
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2368
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigbytqljd.exe ups_ins
    3⤵
    PID:5980
  - - C:\Temp\i_oigbytqljd.exe
      C:\Temp\i_oigbytqljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvsnlfdxvq.exe ups_run
    3⤵
    PID:6044
  - - C:\Temp\bvsnlfdxvq.exe
      C:\Temp\bvsnlfdxvq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5528
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1296
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvsnlfdxvq.exe ups_ins
    3⤵
    PID:3408
  - - C:\Temp\i_bvsnlfdxvq.exe
      C:\Temp\i_bvsnlfdxvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifaxspnifa.exe ups_run
    3⤵
    PID:4788
  - - C:\Temp\ifaxspnifa.exe
      C:\Temp\ifaxspnifa.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2828
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3284
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifaxspnifa.exe ups_ins
    3⤵
    PID:3024
  - - C:\Temp\i_ifaxspnifa.exe
      C:\Temp\i_ifaxspnifa.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icaupnkfzx.exe ups_run
    3⤵
    PID:1144
  - - C:\Temp\icaupnkfzx.exe
      C:\Temp\icaupnkfzx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1904
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4444
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icaupnkfzx.exe ups_ins
    3⤵
    PID:2792
  - - C:\Temp\i_icaupnkfzx.exe
      C:\Temp\i_icaupnkfzx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhfzukec.exe ups_run
    3⤵
    PID:6064
  - - C:\Temp\rpjhfzukec.exe
      C:\Temp\rpjhfzukec.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1388
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4056
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhfzukec.exe ups_ins
    3⤵
    PID:5968
  - - C:\Temp\i_rpjhfzukec.exe
      C:\Temp\i_rpjhfzukec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zurmkecwrp.exe ups_run
    3⤵
    PID:696
  - - C:\Temp\zurmkecwrp.exe
      C:\Temp\zurmkecwrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1028
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zurmkecwrp.exe ups_ins
    3⤵
    PID:5596
  - - C:\Temp\i_zurmkecwrp.exe
      C:\Temp\i_zurmkecwrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1016
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fff02ebc188,0x7fff02ebc194,0x7fff02ebc1a0
      4⤵
      PID:5396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1944,i,3430922155393248211,12136678509359590704,262144 --field-trial-handle=2652,i,6931046428346533703,4559807952215837985,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:2
      4⤵
      PID:1724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,3976719328159988051,1917366318002499494,524288 --field-trial-handle=2652,i,6931046428346533703,4559807952215837985,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:11
      4⤵
      System Time Discovery
      PID:5468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,5512797996045865881,10254463586183847575,524288 --field-trial-handle=2652,i,6931046428346533703,4559807952215837985,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:13
      4⤵
      PID:2084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,687209605060278224,7691031325368464261,2097152 --field-trial-handle=2652,i,6931046428346533703,4559807952215837985,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:2044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,837065750422610700,12473915938538624297,2097152 --field-trial-handle=2652,i,6931046428346533703,4559807952215837985,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:2980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,3045560572538700111,17758683260654694511,2097152 --field-trial-handle=2652,i,6931046428346533703,4559807952215837985,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
      4⤵
      PID:1584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,10831696361954820555,12580534261377411382,2097152 --field-trial-handle=2652,i,6931046428346533703,4559807952215837985,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:9
      4⤵
      PID:5680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,1285609499192454009,6343923186615150607,524288 --field-trial-handle=2652,i,6931046428346533703,4559807952215837985,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
      4⤵
      PID:5612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,5073130692379390990,772821062661849748,524288 --field-trial-handle=2652,i,6931046428346533703,4559807952215837985,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
      4⤵
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,15585225685549430772,2837507584420157877,524288 --field-trial-handle=2652,i,6931046428346533703,4559807952215837985,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:14
      4⤵
      PID:2868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,10907077934579187810,9926186422861765913,524288 --field-trial-handle=2652,i,6931046428346533703,4559807952215837985,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
      4⤵
      PID:4856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,10907077934579187810,9926186422861765913,524288 --field-trial-handle=2652,i,6931046428346533703,4559807952215837985,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
      4⤵
      PID:5136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,15971858950093984571,18005333670164927495,524288 --field-trial-handle=2652,i,6931046428346533703,4559807952215837985,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
      4⤵
      PID:2796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,12442135829668661570,15099683702524493346,524288 --field-trial-handle=2652,i,6931046428346533703,4559807952215837985,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
      4⤵
      PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,6246833196184017133,6211694640163698254,524288 --field-trial-handle=2652,i,6931046428346533703,4559807952215837985,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
      4⤵
      PID:5456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,3593310154385452630,2871550185465293183,524288 --field-trial-handle=2652,i,6931046428346533703,4559807952215837985,262144 --variations-seed-version --mojo-platform-channel-handle=1272 /prefetch:14
      4⤵
      PID:5436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4728,i,4649517912062534786,6129013655931489703,524288 --field-trial-handle=2652,i,6931046428346533703,4559807952215837985,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:14
      4⤵
      PID:3408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,6596927513506865944,17182248206618872222,524288 --field-trial-handle=2652,i,6931046428346533703,4559807952215837985,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:14
      4⤵
      PID:5832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,10326911504711024014,16640584444633857151,524288 --field-trial-handle=2652,i,6931046428346533703,4559807952215837985,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:14
      4⤵
      PID:3508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,6009631668175004012,14998927641301455232,524288 --field-trial-handle=2652,i,6931046428346533703,4559807952215837985,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:14
      4⤵
      PID:4980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,13197654892161847415,5645369681076952762,524288 --field-trial-handle=2652,i,6931046428346533703,4559807952215837985,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
      4⤵
      PID:3260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6656,i,5644768660285375923,6618409285483303927,262144 --field-trial-handle=2652,i,6931046428346533703,4559807952215837985,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:10
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,16724569437494884009,9538434551789296397,524288 --field-trial-handle=2652,i,6931046428346533703,4559807952215837985,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
      4⤵
      PID:1652

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4472

C:\Temp\fzpjhczusmkecwup.sys
C:\Temp\fzpjhczusmkecwup.sys
1⤵
- Executes dropped EXE
PID:2828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5832

C:\Temp\fzxrpjhbzu.sys
C:\Temp\fzxrpjhbzu.sys
1⤵
- Executes dropped EXE
PID:1184

C:\Temp\ebwuomgeyw.sys
C:\Temp\ebwuomgeyw.sys
1⤵
- Executes dropped EXE
PID:1064

C:\Temp\geywqojgby.sys
C:\Temp\geywqojgby.sys
1⤵
- Executes dropped EXE
PID:1692

C:\Temp\lfdbvtnlgd.sys
C:\Temp\lfdbvtnlgd.sys
1⤵
- Executes dropped EXE
PID:6060

C:\Temp\nifayvqnig.sys
C:\Temp\nifayvqnig.sys
1⤵
- Executes dropped EXE
PID:5136

C:\Temp\fdxvqnifay.sys
C:\Temp\fdxvqnifay.sys
1⤵
- Executes dropped EXE
PID:6084

C:\Temp\vpnkfzxvpk.sys
C:\Temp\vpnkfzxvpk.sys
1⤵
- Executes dropped EXE
PID:6044

C:\Temp\kecwupmhfc.sys
C:\Temp\kecwupmhfc.sys
1⤵
- Executes dropped EXE
PID:1500

C:\Temp\bzurmkecwu.sys
C:\Temp\bzurmkecwu.sys
1⤵
- Executes dropped EXE
PID:3032

C:\Temp\bwuomgeywu.sys
C:\Temp\bwuomgeywu.sys
1⤵
- Executes dropped EXE
PID:5748

C:\Temp\gbztrljdbw.sys
C:\Temp\gbztrljdbw.sys
1⤵
PID:2044

C:\Temp\ytqljgbvtr.sys
C:\Temp\ytqljgbvtr.sys
1⤵
PID:3356

C:\Temp\idaytqniga.sys
C:\Temp\idaytqniga.sys
1⤵
PID:6072

C:\Temp\snkfdxvpnk.sys
C:\Temp\snkfdxvpnk.sys
1⤵
PID:2356

C:\Temp\xvpnifaxsq.sys
C:\Temp\xvpnifaxsq.sys
1⤵
PID:4436

C:\Temp\cxupnhfzxr.sys
C:\Temp\cxupnhfzxr.sys
1⤵
PID:2712

C:\Temp\khczusmjec.sys
C:\Temp\khczusmjec.sys
1⤵
PID:5196

C:\Temp\ezwromhbzt.sys
C:\Temp\ezwromhbzt.sys
1⤵
PID:1960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtnljdbvt.exe

Path C:\Temp\bvtnljdbvt.exe
Size 361KB
SHA256 6ec32c8e37de1174ee4c4865d5d6ca340221008ca5964d90e83868bc38b82c07
MD5 d77a135fb328c2aa738b047320f5ce25
SHA1 b860667675fc68787e91087ef96cee80074a604e
SHA512 5e0a45b068d91b67c9e4fc5aeb0b32f90f87696000eb79d745294d504572dcb6e996091eff948e087b995247f2632fbad4f8d385420ecf7972deb022bc99d599
SSDEEP 6144:tflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:tflfAsiVGjSGecvX
TLSH
T161747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvtnlgays.exe

Path C:\Temp\dxvtnlgays.exe
Size 361KB
SHA256 2629cac1c9358bad41eab4e4cbc5d4a2bce7fd4964ab8d69c9908efa91798d92
MD5 fdfa71d8be7cf202f14450ed53adf42b
SHA1 fe687b2151736b5f1a687bd9ce49b1830eb127d1
SHA512 c15e57b665c55f2e2dd7e71b0eb8445f241dbe61c50d3e782ff1907c124b1d4156b1c3e2c8bd96859d0cafc2fc41e3bfefc0f8b3b7c5679104cda3e9a694060c
SSDEEP 6144:EflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:EflfAsiVGjSGecvX
TLSH
T1D1747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwuomgeyw.sys

Path C:\Temp\ebwuomgeyw.sys
Size 293KB
SHA256 f7c1a672d156e26ce5313f84560831b26ffd03bcf7c240719a3740d818b3db82
MD5 c1f2ffd70a6fa5116b09c9b04b0b424b
SHA1 5f2c75233dc662fdc1b1fafa14c0e2e14c85d213
SHA512 f928a834e689fd6c7cccde47636199d325d0f93febe27610dda9253b81cf5cb19c6794add5c369ca8f2ff8e611cedf9de74c4b8c84015cad6b87a07f518c8318
SSDEEP 3072:ZtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:ZIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzpjhczusmkecwup.exe

Path C:\Temp\fzpjhczusmkecwup.exe
Size 361KB
SHA256 32080558dd46098fb730b14467741765b10d04b5f19a8b0cd168a1728151b0ef
MD5 a9d5b02e0b21cbbce518576d3ca0c733
SHA1 1f2721eed479243e1b9e8295286dd0b470159cf2
SHA512 9311dcd72e6fc85d610a6e6237ece2fe43724194f7a35fa1d8ec13f8130ace5965b6715cc19b0135ae3d2b595098a0c57c0f49ae04d4616e90ad9159cf3acca0
SSDEEP 6144:JflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:JflfAsiVGjSGecvX
TLSH
T11E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzpjhczusmkecwup.sys

Path C:\Temp\fzpjhczusmkecwup.sys
Size 293KB
SHA256 fc289790acb0be5dcfcd12ad54375c5f1bd0c01ffde123418dd82a953a35d726
MD5 c0a60613ee433df3c117f7a8b16fe901
SHA1 c4da695d1984e6e21d27f70ece3e8bd0881cf093
SHA512 eaf52bec1df76443a12ff56e007afe9df919ae0e6b23ca655f3b772f1c14a9a2382232c813b06c6ba3be390bf3270b940512d9f767db037371a8c719d4f6c330
SSDEEP 3072:btKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:bIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxrpjhbzu.sys

Path C:\Temp\fzxrpjhbzu.sys
Size 293KB
SHA256 582b364dbb78af6fe0ea25d2c74eafd6cac206512326a8896059a57187afabc0
MD5 ccee6279249076df380a99c9f9efee99
SHA1 2d9dd44d8d3c849880fd6f00b581bfe1d2fb099b
SHA512 eb3f86f28bc15f2eedad0e5887ca5e8b0ec5ffe7e53e8c43cbf3195d9cf9ea7a4f15d255e28080492a1ef3b85e0a35f4f5199ec471df8339af990b70efe54df6
SSDEEP 3072:/tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:/IJjiJcbI03GBc3ucY5DCSj
TLSH
T1F3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqojgby.sys

Path C:\Temp\geywqojgby.sys
Size 293KB
SHA256 9dcfeb7c19b142fb703eeccd4a000a80e4498c0795219085308f159ea851120b
MD5 a4b5e99efa21d9a1490b2ba17bdb397b
SHA1 e81a4b543ebdb04db217fab9aa34513e8483e0e4
SHA512 eb4dc25332f871f1e19db67fd24ba9f0ce73c3caf6a641d0b096f807a6317b3a2bce7a70454f180916d35838ace7b64a71135bbef32910589291fb5d7f3b3e5b
SSDEEP 3072:FtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:FIJjiJcbI03GBc3ucY5DCSj
TLSH
T17C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtnljdbvt.exe

Path C:\Temp\i_bvtnljdbvt.exe
Size 361KB
SHA256 5fa905dee878ce5cf665785ef1904f18fb75f1e83a7779437b44d335eb7053e5
MD5 cdeb57dcc5cfad1b6079f8d5b0c8664b
SHA1 e84189393ea4b470878b2ec92bd5161278215ebb
SHA512 1ce3cefb2df66c547da06ae78ffdeb2512dbea56b6b1d3fec327fafb120ed50212b8f16214f83a35911e4e09837e03782d284f58f3e260a105a5a89f661293ce
SSDEEP 6144:UflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:UflfAsiVGjSGecvX
TLSH
T1DE747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dxvtnlgays.exe

Path C:\Temp\i_dxvtnlgays.exe
Size 361KB
SHA256 1a91b1a3a35f60f4cd39ac690814a3cb8ab0f441a426838d0cce0c873e45ed5b
MD5 c132d9ff84c71611545e7d00f4e92105
SHA1 1f349cf6e90041cab7e7874b177fed548bafbeff
SHA512 7e70071c371acb0943c75bdcf88ce5e93df65a4780ac9438485a38ea15348159337a6335dcd7e1606ee7b49005dc6f2a09925657b0ec2f1d95c4fcb0e789481f
SSDEEP 6144:SflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:SflfAsiVGjSGecvX
TLSH
T1B7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhecwuomhe.exe

Path C:\Temp\i_jhecwuomhe.exe
Size 361KB
SHA256 d0ba37951cc97e58c219eb845cd72629c1caf8c1a1143df398ccb00ddea84cbc
MD5 6b5b70d0d05dd236b2316cb12a392abf
SHA1 b8be0042cb72d96bdaf7f2d65cd2f6e9432c2900
SHA512 9f111cabdcb8c769f9bb1ca0fc1a1fc3184bb0541fe9afe3c8d221820f3dab41817f59391a2edcf267d3b43b870d62068a31841967554c082ce6c601eb243e4c
SSDEEP 6144:GflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:GflfAsiVGjSGecvX
TLSH
T190747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wuolgbwrmj.exe

Path C:\Temp\i_wuolgbwrmj.exe
Size 361KB
SHA256 047859e59ce5622ddfcd1e86675e83ccff32fd5cdaefe45a28b5c16d26df91e6
MD5 85ca16092c706c6304d801512b23a294
SHA1 f6e67be7307ee86f185b88d534a348c8ce333ccf
SHA512 a5b71aac043b5b3291bd68b56fc4c3e2f218601a5b19cbf4f598601d898f7d1e2567a707e0e01751627894d8eb60045ef5767f9befd3609ce0a361f6793f9381
SSDEEP 6144:oflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:oflfAsiVGjSGecvX
TLSH
T137747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ytrljeywto.exe

Path C:\Temp\i_ytrljeywto.exe
Size 361KB
SHA256 7a20080578e524b192b82adf099e674ea8b1462f0acd8b8279fe5ec8b6602fec
MD5 2f283858220aa645101af1bf535527ed
SHA1 5da464f8f3af15f6306f3a48c0ee8e958e87d265
SHA512 f0a9895eec986f6a3a7c3ee47b24a223882d2fd68a33ef0189156a702c4e90180f49089f8ff8e304ad90b80dc8966d3b14b8d57612a027a44400cab7982abdd4
SSDEEP 6144:JflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:JflfAsiVGjSGecvX
TLSH
T11B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxrpmhfzxr.exe

Path C:\Temp\i_zxrpmhfzxr.exe
Size 361KB
SHA256 5307a0a69811bdf6fbff09d2c1761412c9045d840a258fa6f980fc12751eb9f5
MD5 1a4a961edfdf388cc04e40c16a611926
SHA1 41da612ef4427b2eed4e1e8ff65956a7d2676ab9
SHA512 75edbd75d6b824fdb7c35978f02a7d4becba494afed070ecfd515d1d85f92264739a04a03dd370d38f828ddff5334307287e33091bb1e4c23e6c349c9c824489
SSDEEP 6144:CflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:CflfAsiVGjSGecvX
TLSH
T1E0747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhecwuomhe.exe

Path C:\Temp\jhecwuomhe.exe
Size 361KB
SHA256 1d5164813de03504c637c8953fb9673068dedb95693826b15802bed5af38bad6
MD5 4444f2e982ac4109389053c43874a99c
SHA1 59968f97d2caa989cbbcd39ef74ca711f229f536
SHA512 a8819e99c9fc1d7dcb18767923734c689088394ccb019da1a0afe56df8aaaa7ecf8f4913a6900a80f80335120aa188770483d8bc055ea8d8538afd1b570a16d7
SSDEEP 6144:IflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:IflfAsiVGjSGecvX
TLSH
T12B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdbvtnlgd.sys

Path C:\Temp\lfdbvtnlgd.sys
Size 293KB
SHA256 9ac08c327ca6a63ee726da86bf917ae561ab56452c3a722e59831ced61a75bb1
MD5 1509d4fbb1a169967fcf9bb0038668c6
SHA1 b8d6fb17eafd94be4ac6def58a2c636925761c20
SHA512 0cc522e9a596a84c6cc1f6c45645bbb37bc577907597f3d8c2bd08718e483e31d6f79ce253ce243ecf2867238eb06997e15c5003d8b71f0f22a01f609ab71aac
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifayvqnig.sys

Path C:\Temp\nifayvqnig.sys
Size 293KB
SHA256 be8aa4fecadff51ebc65c33a442f289c4483065ea7b1142e1adeaf2f7c512a29
MD5 21a902ce636c2d1953ba3192d1b424c9
SHA1 7b0d1d1eac01d6d723668d5638a62176e45a05dc
SHA512 573e0e971ab2b0061d3d1bd0489f9e357e3f3c8c111a193e3fdb69213f5bef08aa501571d8801a82ce3f348209607c7f2d8591820cc7600441ad2419a7e8dd42
SSDEEP 3072:7tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:7IJjiJcbI03GBc3ucY5DCSj
TLSH
T1F7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuolgbwrmj.exe

Path C:\Temp\wuolgbwrmj.exe
Size 361KB
SHA256 0b8088a239be724374b2f11f50db6c802651f78e2a477061c952920825ab7cf4
MD5 9c541fb4d692e2a9b8e0ce1775a8e304
SHA1 a391570581c3ad3cdb7fc056319692f4075ede47
SHA512 061b45ce52a69b848d3b2a498d5566442fff001b68fbda1c316ce356a952caff547b646755b1484f467db975da9d6ade503b675a41f289945b3657b311370749
SSDEEP 6144:uflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:uflfAsiVGjSGecvX
TLSH
T11F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytrljeywto.exe

Path C:\Temp\ytrljeywto.exe
Size 361KB
SHA256 3275a06ecfc20799154f84d0784cddf8000d8c67520c4026043e9b69fa396b1e
MD5 00f957f78b43c4cab69f0fd3cb0e4db0
SHA1 eca4e3a4e086331bc4f87efedca19fc0b2937f2f
SHA512 c8d23fa7f362125b577f93adc5ac85b448b585fdca9827567085714a28cc44cc8f12dfb23384f80f602a034a099ca413809e6055bd98aaf9202806106e7f75ed
SSDEEP 6144:LflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:LflfAsiVGjSGecvX
TLSH
T164747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpmhfzxr.exe

Path C:\Temp\zxrpmhfzxr.exe
Size 361KB
SHA256 3f44905878f4364845486998cf572e4d741820a91dbfcf13c13065428b6ffb5c
MD5 14edb11304d892488a3193cb63399753
SHA1 9926c10be12bfd62945bc62dcb4b09392014fd27
SHA512 f36bce9db65ae05798a22caeca85dddbf0c8e9635474b13b4cc0bf7c9e390afb8fb4ecc114423f49f84c04fdbb90ee6ec16408cfc1a1ce4dfb1c90fc9c22cf06
SSDEEP 6144:ZflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:ZflfAsiVGjSGecvX
TLSH
T175747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 174576d263d17c1ded542f85fe22b729d39689265635c9c57a2bfd1af11bcb69
MD5 e54a3dd3758ae26f8eb9c7149476114c
SHA1 dd4159ecc029af9dd3da72970ac8bfa500a0651c
SHA512 eabda803f8f816ad2a6d57d3ce37f9c8cf72ef9a0a1ebecd6f39990ef65120d12a76e6ae5a2cb62c423511cbb36f0da6835b1dfa5907c5559c0ead5b0735873c
TLSH
T1E6D092757764A90CC9A5B0322CA7B29AA322A8300495860444E5F2A8CDB6A82567B5AE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2cfb77611c6372588cbb86850301c7d4d2a98bc9870148a0233cb9ff0ba848ae
MD5 30dd1402eab1adcd1b7a879da690d903
SHA1 5ad2617a2f54fb4647f217e450aa852cfab95912
SHA512 396e3e6a4f4d2b6cdab94a4fc9fcd07b5b3b76f067ce5666b89e9fb8d48b00e16fe2a2e9189c9d96e3f8d9d2f1a719132c8694f2859c94a22a5b7ecb4e74a3fc
TLSH
T1A3D02B343300650CC89070321C52B249532158300440420000D0B158CC7168102370AE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a3fe4e831703002a1346a5bc0446ebe30aa4653869fdbaab2ba7471d19d7070d
MD5 f808730ce7f01eec76a138163a924900
SHA1 5a3af08c8c66daadec484d1da8ccf796ff967f92
SHA512 7548973f4896b028596fbbfc23463277428ae4b3071485c09eb76d5c4fa2ecdf6f744e682b0fab2aef25e55fc39032d72552ebafd809bd047a2d09ffb48a939e
TLSH
T1F86141A503F60BC2D75DEEB1D2DE1E9F37B708A951076E0041F0ACB85686F75B209528
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595b45.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595b45.TMP
Size 3KB
SHA256 d5aea60e958296ae033a2bf04d305ce8734927c5bb02eeb8063faa16b27c2e01
MD5 bab7916d78209968a7abcd766f0c7c3d
SHA1 860a4acd747e79cbe1ad0a504351226fa930c950
SHA512 2d4e660ab2a6b04065f2817b82fdc271f93a25734fbc719b948ad6ceeb013be6cd673c697911887d8fc1646656e41084c7f9cfc72aeadedb51cce4a61ce31cff
TLSH
T1126151A503F60BC2D75DEEB1D2DE1E9F37B748A951076E0041F0ACB856C6F75B209528
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d665c902f70f534ea8e094d1c7de0a672ee3bbfb7c04b67e1822f7626cc62038
MD5 0f5867c2f9d636cacd62a04324651b8d
SHA1 72edc2ed232e246d6ed274ec252099bee71cd485
SHA512 b97023aaf30575f5d16ffd645d0fa8372db37ff4be476697611cf2e438e5579139fb89354cfe1abc89c3c67cc6a769edf9f34d95d0f2f0bad7076c00207c8314
TLSH
T18051CEF3C3E8856DDA0156F0AA147E1BCE2D0954832C3D5AC9E4AF5BA3F2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 82096e81d5578068b844f4bb3e5900e764d7d111eec082a6b4d017af46e49eca
MD5 8b9380188cb70625b266292eb60f017b
SHA1 eb805cc4cbe1cf08f16b5feefbd7654a9b3db380
SHA512 4fc4b50dcedabee20cdb4995836070e4515204c5bb5c9e211bb50d990c9128e611ad14b6f9396bf5aea3e03cabc9c6bd6655faad8809b2e4135ccac7999959e8
SSDEEP 192:sxRoRJyM/jK1Ml8wCm/fhsoXddARWQOZxDzoA8pi/g6+WNIYtZI2l9WqaG6IgtJ:sxRoF8m/fhsoXw0Qoxyi/5IsiuXc3
TLSH
T19352EA15AA289937CCDBD20DFA557F93D2F81533A2941E44AAFCCB0C05E66DD121382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3cac4a5617bba277ba66cc89496171ecdaaa4144df01f09f0f5a2fe5e00557b7
MD5 7a2b1e0396c5df97e796513b70b7f502
SHA1 b63151654107df15ab66d24ad6a88cb3017cfe9a
SHA512 eec468b63d81b9f075a76f0040dec5757e6304d6a9081b5a503c1efda9e21459f18c654188a9050f17829dfbef384edbf70fc7715c3ffa51b7a7845859f10425
SSDEEP 192:sxRnRJyM/jK1Ml8UQYCm/fhs5XddARQQOZxDzoA8pw/g6+WNIYtZInl9WqaG6Igy:sxRnFqfm/fhs5XwaQoxyw/5IsilXcy
TLSH
T1E662D815AA2899378CDBD20DFA557F93D2F85473A6941E44AAFCCB0C01E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 17b3263c79d24a4ac9c3791517b7f0b0cf212b40b81ded2a010258de4691aa5e
MD5 7dd5b322243da7c44a4eb2f4f8d0138c
SHA1 e235feb710b1fea7fe4ae380bff4391043a158d3
SHA512 e0a7295b89e5d624ee819444348d1e994503e0ccae7daedbb72899ce372f00769c54d26d5c7ec30ac5e18d263c738f307ce5c9bd9637468cc5d91a44bbdfeb1d
SSDEEP 192:sxRnRJyM/jK1Ml8wCm/fhs5XddARWQOZxDzoA8pi/g6+WNIYtZI2l9WqaG6IgDUJ:sxRnF8m/fhs5Xw0Qoxyi/5IsiuXcU
TLSH
T1AC62EA15AA2899378CDBD20DFA557F93D2F81473A2941E44AAFCCB0C05E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 58648dfba94de2df8d162c6d9fcc7ff4eb4d8ec948d18c9904a8fdf883eaa5e3
MD5 1db1bb90a92c942bd8e43f7518b495f6
SHA1 74f500418cc8ede6c01d256a4c4d093b86e93b8c
SHA512 0abde35336b5ee50df7887be01d6f5189b738657260ca1c4092398f4c3ee185a3d9d9e3b1801f955fbe2442746c32c002df174327806ad9663380d863eaf93d7
SSDEEP 768:dOwS1wBzwRbU7pLuL761wiWg1zwsfMZwK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhw:dOwS1wBzwRbYE761wiWg1zwsfMZwKu1Y
TLSH
T14BE2EC3B684CCB7F4F804A9CEC2A7D9A6DE801CF56D8895447FA880C03C66EB551B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a0479e04f2c59b7d9d07111d10e01cc0db9504509cc49a8dca3bd7a2315d5b6b
MD5 3bb27db85e980b96f96785ca2daf5933
SHA1 18dc79634d7e8daf1fffaa6b964758b12b089ef9
SHA512 0365f5740a3a5c4d913e27fea53026af4e0dd15e30756f23e21ff526f52a89802c8d20526637e5575d504b08bb32af59635369d382c2eb36fb57c808e262179a
SSDEEP 96:KRtaTHd3LfWTI2gPfK4Ogxfc1NAj70H2r6WwYY+Wo9lg2+K4Lgk+ce2VUGI0IVIg:CtaTHd3LeTInPlOgxU1NAj70H2r6WwYX
TLSH
T123915446353B42C0693E684A90A49957C2C170E2311DE86B3FAC05E35F67F419FFE5DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59f9a8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59f9a8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9c3beb0344e6f306ec336d9173d1fb401449024de0270623690a14dda1875435
MD5 c7587720f1fa6243e4ae955e56c2af3b
SHA1 e4934575061976fd095b56edfb629257ccd9e90a
SHA512 6a3d6f771abd8cda5c558d79cca1355dad13fe827dda37afaacd6160ea8a6510587591c56322bc955e9acea84c25ae14f3813f133331fa1a85d3f2a7ada3ac05
SSDEEP 768:CIrv+4UNbdX3FiHT4hY53u37BtAwjUSzZTUikB+:CIbsbR3FuT4CuoTOUJI
TLSH
T1DB03BF32A88499379CE7D28AB24B7A43BFB45163C5C91FD4C8ED2B0D428B15D2347E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 afc197608f6a6d6c15f1143b14f26b3fc5e6d01d6bab7e06d1d80e0723dee894
MD5 98be7ab75224e1694c85a969e9460622
SHA1 7ce4b51a01c720ee74111a7872a9fff0eeccad8f
SHA512 5875be4039a07769137a1f43910a7c7f256102cc96c25f2943f515a91fa38307dae3595024940eee9f82b56f77752987139a042ff2506973bc9f1157d28dfa67
SSDEEP 768:tjj+903Gx4hY5IzDu37BtAwjUSzFNMj7p:tm903U4PDuoTQkp
TLSH
T126F2AE31A8459D639CEA9299B25A27C2DFB051B3C8C52FC4C9E96F0D40C32AC2747D3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 af216694a3e34ac95e08ff628fcdb9cc665dae7bde37151b449ef7168238130d
MD5 3cc39542c02e8a8f258d4ea2e8b59020
SHA1 f78f96f8686dff1edbba76c471efcf76f6c82f42
SHA512 090ba06c780de2145a8d511fc4365293acac989ae74791bb490a34e43fd23e3264d18b20aa52e62345a5d4d101c06b3baafd91c01782bbcce761b0ee516802f2
SSDEEP 768:8jj+903vx4hY5IzDu37BtAwjUSzFNMj7p:8m903Z4PDuoTQkp
TLSH
T12CF2AE31A8459D639CEA8299B25A27C2DFB051B3C8C52F84C9E96F0D41C32AC2747D3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9bb7cf7b1a370b2b546b0b18ece7d2d5ff67a8b69d028ba4f0bf0813f1630ad1
MD5 07a64d4a4b965f8ae0198dc5ca3658e9
SHA1 1699e5e56907c4ac7e8afa19bb420cebbbdb63d1
SHA512 7a5abe9fa9e9a54ad5c363cf0c930d076ac1b3fcc900347cd4adf77a530149b246fade0be1fa355ced69245b75a1b65d0ba9adb6a0e85f4f1b506109c9774fe2
SSDEEP 768:FxFKj+9930wgIpcY5IzBu37BtAwjUSzFNMj7p:F5993kBuoTQkp
TLSH
T144038D32D885CA6BACE787C5A7593786DFE001B3C8C86ED4D9D86E4D00C329D134BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6fe8045f40ec0de0561e949963d7a680d7291e638187c73f65620689a061e1ff
MD5 5109fabd17c9dd9819c57891da16d189
SHA1 58c05195332a00475d6d5b56580c249853a8484c
SHA512 b10b2d9dedcdbccebc8f92f52afeea469b7b896e18f5ffce869ff2d402d4e47f55646a9ee4c33740cafe55dc75566ffcfdc4551b58a673ef9b2c59e6f076a70f
SSDEEP 768:8Hj+9035x4hY5IzXu37BtAwjUSzFNMj7p:8q903z4PXuoTQkp
TLSH
T19BF2AE31A8419E679CEA9299B25A2782DFB051B3C8C52F84DDE96F0D41C32AC1347D3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 d7eb711c491fa33b67cca007431d4a7c42af3fda14003a6d1c5913553d08ac2d
MD5 f823268508efc72c8e7dc8072a3ebd61
SHA1 d28318f25b35415a794b16792c7395d03065a3f9
SHA512 13d77a20e19ce0d2181c47375e6b5760e9d6e222d07669485fc694e8d4a9634e49fcd313efe67ffe63b95da34ffd92658abe8b9ca3f29d742fc8053975020ce2
TLSH
T15271008367A9DAF2C29A5FF002835244F2BB227C072320640B51558AAA30A3A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1064-223-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1184-176-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1500-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1692-251-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1960-481-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2044-383-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2044-396-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2356-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2712-477-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2712-451-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2828-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3032-350-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3356-394-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4436-431-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5136-292-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5196-455-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5748-362-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6044-306-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6060-264-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6072-415-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6084-302-0x0000000000010000-0x00000000000AB000-memory.dmp

Download