systex | 1b729936a4c2a27c631bc57d65ae3410b45dd25c54beb24fc3223a2ace243f62

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260709-th5wpsdy7s
SHA256 1b729936a4c2a27c631bc57d65ae3410b45dd25c54beb24fc3223a2ace243f62
MD5 f7d0d03b813b3f33c64f643add5cd890
SHA1 2b469b1003b7681090e26bb1db32cd831e284b45
SHA512 f9198ddb9d57a24fd17a1163d096d8baa38f535d5b0d2047a95d23fb46510625a5153c38cd49450fa950cf15b4e1c431569cff5ba6bcf5d958a5c83ce711724a
SSDEEP 6144:LflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:LflfAsiVGjSGecvX
TLSH
T130747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2356	hfzxspkicausmkfc.exe
3496	hfzxspkicausmkfc.sys
2196	CreateProcess.exe
1096	fzxspkecau.exe
3340	CreateProcess.exe
2780	CreateProcess.exe
1816	i_fzxspkecau.exe
2228	pmhfzxrpjh.sys
3452	CreateProcess.exe
6060	eczusmkecx.exe
4868	CreateProcess.exe
4820	CreateProcess.exe
4496	i_eczusmkecx.exe
2764	kecwuomkec.sys
2120	CreateProcess.exe
5924	rpjhbzxrpj.exe
5860	CreateProcess.exe
3992	CreateProcess.exe
4596	i_rpjhbzxrpj.exe
4280	trmjecwuom.sys
6016	CreateProcess.exe
6140	mjebwuomge.exe
3792	CreateProcess.exe
3344	CreateProcess.exe
4524	i_mjebwuomge.exe
5288	ljdbvtoljd.sys
2228	CreateProcess.exe
5104	bvtolgeywq.exe
4576	CreateProcess.exe
2928	CreateProcess.exe
1228	i_bvtolgeywq.exe
4284	bvtnlgdyvq.sys
5876	CreateProcess.exe
1052	qligaytqlj.exe
4848	CreateProcess.exe
5832	CreateProcess.exe
3488	i_qligaytqlj.exe
1068	ysqkidavsq.sys
6108	CreateProcess.exe
5920	nlfdxvqnlf.exe
3672	CreateProcess.exe
4744	CreateProcess.exe
2880	i_nlfdxvqnlf.exe
5916	kifaysqkic.sys
3000	CreateProcess.exe
2788	usnkfcxvpn.exe
5844	CreateProcess.exe
1816	CreateProcess.exe
3680	i_usnkfcxvpn.exe
1844	faxspkicau.sys
1888	CreateProcess.exe
5116	spnhfaxsqk.exe
6092	CreateProcess.exe
1932	CreateProcess.exe
4872	i_spnhfaxsqk.exe
4864	cxupmhfzxu.sys
2544	CreateProcess.exe
1960	smhfzxrpmh.exe
4588	CreateProcess.exe
5524	CreateProcess.exe
1376	i_smhfzxrpmh.exe
4956	urmkecwupm.sys
724	CreateProcess.exe
1284	mhezwuomge.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2280_927031723\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2280_1995632640\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2280_1995632640\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2280_1995632640\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2280_744838951\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2280_927031723\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2280_1995632640\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2280_360359862\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2280_360359862\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usnkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnhfaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezwrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rlbvtrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidavtqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczusmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtolgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smhfzxrpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvqnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidavtqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxspkicausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtolgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qligaytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnhfaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgezwrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxspkecau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxspkecau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qligaytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smhfzxrpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczusmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rlbvtrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvqnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usnkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbvtnlg.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4132	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1128	ipconfig.exe
4468	ipconfig.exe
6040	ipconfig.exe
2516	ipconfig.exe
5756	ipconfig.exe
2308	ipconfig.exe
2812	ipconfig.exe
5540	ipconfig.exe
5844	ipconfig.exe
1388	ipconfig.exe
5324	ipconfig.exe
5704	ipconfig.exe
4836	ipconfig.exe
1352	ipconfig.exe
4540	ipconfig.exe
3752	ipconfig.exe
2876	ipconfig.exe
3940	ipconfig.exe
1720	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280866834083594"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2699128254-3633964024-152949075-1000\{8F60260F-26C2-4956-A069-588232ECAF0C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2356	hfzxspkicausmkfc.exe
2356	hfzxspkicausmkfc.exe
2356	hfzxspkicausmkfc.exe
2356	hfzxspkicausmkfc.exe
2356	hfzxspkicausmkfc.exe
2356	hfzxspkicausmkfc.exe
2356	hfzxspkicausmkfc.exe
2356	hfzxspkicausmkfc.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	1816	i_fzxspkecau.exe
Token: SeDebugPrivilege	4496	i_eczusmkecx.exe
Token: SeDebugPrivilege	4596	i_rpjhbzxrpj.exe
Token: SeDebugPrivilege	4524	i_mjebwuomge.exe
Token: SeDebugPrivilege	1228	i_bvtolgeywq.exe
Token: SeDebugPrivilege	3488	i_qligaytqlj.exe
Token: SeDebugPrivilege	2880	i_nlfdxvqnlf.exe
Token: SeDebugPrivilege	3680	i_usnkfcxvpn.exe
Token: SeDebugPrivilege	4872	i_spnhfaxsqk.exe
Token: SeDebugPrivilege	1376	i_smhfzxrpmh.exe
Token: SeDebugPrivilege	4208	i_mhezwuomge.exe
Token: SeDebugPrivilege	5356	i_omgezwrojh.exe
Token: SeDebugPrivilege	4568	i_rlbvtrljdb.exe
Token: SeDebugPrivilege	3528	i_rljdbvtnlg.exe
Token: SeDebugPrivilege	1836	i_lidavtqlid.exe
Token: SeDebugPrivilege	3060	i_snkfdxvpnh.exe
Token: SeDebugPrivilege	5424	i_spkicausmk.exe
Token: SeDebugPrivilege	3740	i_usmkecwupm.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2280	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 2356	5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 5004 wrote to memory of 2684	5004	2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 2684 wrote to memory of 2280	2684	iexplore.exe	90
PID 2280 wrote to memory of 5820	2280	msedge.exe	91
PID 2280 wrote to memory of 2164	2280	msedge.exe	93
PID 2280 wrote to memory of 4132	2280	msedge.exe	94
PID 2280 wrote to memory of 2164	2280	msedge.exe	93
PID 2280 wrote to memory of 2164	2280	msedge.exe	93
PID 2280 wrote to memory of 1940	2280	msedge.exe	95
PID 2280 wrote to memory of 1940	2280	msedge.exe	95
PID 2280 wrote to memory of 3164	2280	msedge.exe	96
PID 2280 wrote to memory of 3164	2280	msedge.exe	96
PID 2280 wrote to memory of 3164	2280	msedge.exe	96
PID 2280 wrote to memory of 4240	2280	msedge.exe	97
PID 2280 wrote to memory of 4240	2280	msedge.exe	97
PID 2280 wrote to memory of 4240	2280	msedge.exe	97
PID 2280 wrote to memory of 3272	2280	msedge.exe	98
PID 2280 wrote to memory of 1052	2280	msedge.exe	99
PID 2280 wrote to memory of 3272	2280	msedge.exe	98
PID 2280 wrote to memory of 3272	2280	msedge.exe	98
PID 2280 wrote to memory of 1052	2280	msedge.exe	99
PID 2280 wrote to memory of 1052	2280	msedge.exe	99
PID 2280 wrote to memory of 4304	2280	msedge.exe	100
PID 2280 wrote to memory of 4304	2280	msedge.exe	100
PID 2280 wrote to memory of 1492	2280	msedge.exe	104
PID 2280 wrote to memory of 3848	2280	msedge.exe	105
PID 2280 wrote to memory of 1492	2280	msedge.exe	104
PID 2280 wrote to memory of 3848	2280	msedge.exe	105
PID 2356 wrote to memory of 2196	2356	hfzxspkicausmkfc.exe	106
PID 2280 wrote to memory of 6028	2280	msedge.exe	109
PID 1096 wrote to memory of 3340	1096	fzxspkecau.exe	111
PID 2280 wrote to memory of 5540	2280	msedge.exe	116
PID 2280 wrote to memory of 5540	2280	msedge.exe	116
PID 2280 wrote to memory of 1284	2280	msedge.exe	117
PID 2280 wrote to memory of 1284	2280	msedge.exe	117
PID 2356 wrote to memory of 2780	2356	hfzxspkicausmkfc.exe	118
PID 2356 wrote to memory of 3452	2356	hfzxspkicausmkfc.exe	122
PID 6060 wrote to memory of 4868	6060	eczusmkecx.exe	124
PID 2356 wrote to memory of 4820	2356	hfzxspkicausmkfc.exe	127
PID 2356 wrote to memory of 2120	2356	hfzxspkicausmkfc.exe	131
PID 5924 wrote to memory of 5860	5924	rpjhbzxrpj.exe	133
PID 2356 wrote to memory of 3992	2356	hfzxspkicausmkfc.exe	136
PID 2356 wrote to memory of 6016	2356	hfzxspkicausmkfc.exe	141
PID 6140 wrote to memory of 3792	6140	mjebwuomge.exe	143
PID 2280 wrote to memory of 5988	2280	msedge.exe	146
PID 2280 wrote to memory of 2024	2280	msedge.exe	147
PID 2280 wrote to memory of 2872	2280	msedge.exe	148
PID 2356 wrote to memory of 3344	2356	hfzxspkicausmkfc.exe	149
PID 2356 wrote to memory of 2228	2356	hfzxspkicausmkfc.exe	153
PID 5104 wrote to memory of 4576	5104	bvtolgeywq.exe	155
PID 2356 wrote to memory of 2928	2356	hfzxspkicausmkfc.exe	158
PID 2356 wrote to memory of 5876	2356	hfzxspkicausmkfc.exe	162
PID 1052 wrote to memory of 4848	1052	qligaytqlj.exe	164
PID 2356 wrote to memory of 5832	2356	hfzxspkicausmkfc.exe	167
PID 2356 wrote to memory of 6108	2356	hfzxspkicausmkfc.exe	171
PID 5920 wrote to memory of 3672	5920	nlfdxvqnlf.exe	173
PID 2356 wrote to memory of 4744	2356	hfzxspkicausmkfc.exe	176
PID 2356 wrote to memory of 3000	2356	hfzxspkicausmkfc.exe	180
PID 2788 wrote to memory of 5844	2788	usnkfcxvpn.exe	182
PID 2280 wrote to memory of 3276	2280	msedge.exe	185
PID 2280 wrote to memory of 3276	2280	msedge.exe	185
PID 2356 wrote to memory of 1816	2356	hfzxspkicausmkfc.exe	189
PID 2356 wrote to memory of 1888	2356	hfzxspkicausmkfc.exe	193
PID 5116 wrote to memory of 6092	5116	spnhfaxsqk.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_f7d0d03b813b3f33c64f643add5cd890_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Temp\hfzxspkicausmkfc.exe
  C:\Temp\hfzxspkicausmkfc.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxspkecau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2196
  - - C:\Temp\fzxspkecau.exe
      C:\Temp\fzxspkecau.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1096
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3340
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxspkecau.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2780
  - - C:\Temp\i_fzxspkecau.exe
      C:\Temp\i_fzxspkecau.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eczusmkecx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3452
  - - C:\Temp\eczusmkecx.exe
      C:\Temp\eczusmkecx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6060
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4868
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eczusmkecx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4820
  - - C:\Temp\i_eczusmkecx.exe
      C:\Temp\i_eczusmkecx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhbzxrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2120
  - - C:\Temp\rpjhbzxrpj.exe
      C:\Temp\rpjhbzxrpj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5924
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhbzxrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3992
  - - C:\Temp\i_rpjhbzxrpj.exe
      C:\Temp\i_rpjhbzxrpj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4596
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjebwuomge.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6016
  - - C:\Temp\mjebwuomge.exe
      C:\Temp\mjebwuomge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6140
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3792
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjebwuomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3344
  - - C:\Temp\i_mjebwuomge.exe
      C:\Temp\i_mjebwuomge.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtolgeywq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2228
  - - C:\Temp\bvtolgeywq.exe
      C:\Temp\bvtolgeywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5104
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4576
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtolgeywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2928
  - - C:\Temp\i_bvtolgeywq.exe
      C:\Temp\i_bvtolgeywq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qligaytqlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5876
  - - C:\Temp\qligaytqlj.exe
      C:\Temp\qligaytqlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1052
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4848
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1388
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qligaytqlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5832
  - - C:\Temp\i_qligaytqlj.exe
      C:\Temp\i_qligaytqlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfdxvqnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6108
  - - C:\Temp\nlfdxvqnlf.exe
      C:\Temp\nlfdxvqnlf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5920
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3672
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfdxvqnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4744
  - - C:\Temp\i_nlfdxvqnlf.exe
      C:\Temp\i_nlfdxvqnlf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usnkfcxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3000
  - - C:\Temp\usnkfcxvpn.exe
      C:\Temp\usnkfcxvpn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2788
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5844
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usnkfcxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1816
  - - C:\Temp\i_usnkfcxvpn.exe
      C:\Temp\i_usnkfcxvpn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spnhfaxsqk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1888
  - - C:\Temp\spnhfaxsqk.exe
      C:\Temp\spnhfaxsqk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5116
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6092
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spnhfaxsqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1932
  - - C:\Temp\i_spnhfaxsqk.exe
      C:\Temp\i_spnhfaxsqk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smhfzxrpmh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2544
  - - C:\Temp\smhfzxrpmh.exe
      C:\Temp\smhfzxrpmh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4588
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smhfzxrpmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5524
  - - C:\Temp\i_smhfzxrpmh.exe
      C:\Temp\i_smhfzxrpmh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhezwuomge.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:724
  - - C:\Temp\mhezwuomge.exe
      C:\Temp\mhezwuomge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1284
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1984
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhezwuomge.exe ups_ins
    3⤵
    PID:2696
  - - C:\Temp\i_mhezwuomge.exe
      C:\Temp\i_mhezwuomge.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgezwrojh.exe ups_run
    3⤵
    PID:2792
  - - C:\Temp\omgezwrojh.exe
      C:\Temp\omgezwrojh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2904
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4664
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgezwrojh.exe ups_ins
    3⤵
    PID:1576
  - - C:\Temp\i_omgezwrojh.exe
      C:\Temp\i_omgezwrojh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rlbvtrljdb.exe ups_run
    3⤵
    PID:1540
  - - C:\Temp\rlbvtrljdb.exe
      C:\Temp\rlbvtrljdb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:564
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5024
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rlbvtrljdb.exe ups_ins
    3⤵
    PID:4812
  - - C:\Temp\i_rlbvtrljdb.exe
      C:\Temp\i_rlbvtrljdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljdbvtnlg.exe ups_run
    3⤵
    PID:2168
  - - C:\Temp\rljdbvtnlg.exe
      C:\Temp\rljdbvtnlg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1232
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4404
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljdbvtnlg.exe ups_ins
    3⤵
    PID:4248
  - - C:\Temp\i_rljdbvtnlg.exe
      C:\Temp\i_rljdbvtnlg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lidavtqlid.exe ups_run
    3⤵
    PID:3164
  - - C:\Temp\lidavtqlid.exe
      C:\Temp\lidavtqlid.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5976
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4824
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lidavtqlid.exe ups_ins
    3⤵
    PID:4468
  - - C:\Temp\i_lidavtqlid.exe
      C:\Temp\i_lidavtqlid.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snkfdxvpnh.exe ups_run
    3⤵
    PID:1860
  - - C:\Temp\snkfdxvpnh.exe
      C:\Temp\snkfdxvpnh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2868
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3288
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snkfdxvpnh.exe ups_ins
    3⤵
    PID:1324
  - - C:\Temp\i_snkfdxvpnh.exe
      C:\Temp\i_snkfdxvpnh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkicausmk.exe ups_run
    3⤵
    PID:2368
  - - C:\Temp\spkicausmk.exe
      C:\Temp\spkicausmk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:896
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4488
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkicausmk.exe ups_ins
    3⤵
    PID:1920
  - - C:\Temp\i_spkicausmk.exe
      C:\Temp\i_spkicausmk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkecwupm.exe ups_run
    3⤵
    PID:1712
  - - C:\Temp\usmkecwupm.exe
      C:\Temp\usmkecwupm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3696
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3588
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkecwupm.exe ups_ins
    3⤵
    PID:5352
  - - C:\Temp\i_usmkecwupm.exe
      C:\Temp\i_usmkecwupm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upmhfzxrpj.exe ups_run
    3⤵
    PID:3544
  - - C:\Temp\upmhfzxrpj.exe
      C:\Temp\upmhfzxrpj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1836
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1584
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2876
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fffff88c188,0x7fffff88c194,0x7fffff88c1a0
      4⤵
      PID:5820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,5885292471393166930,11074832300375985669,262144 --field-trial-handle=2224,i,3796498225056043436,12670936432665705704,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
      4⤵
      PID:2164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,6705755747090788716,3934547241023573349,524288 --field-trial-handle=2224,i,3796498225056043436,12670936432665705704,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:11
      4⤵
      System Time Discovery
      PID:4132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,8525710096592275695,16911422794115097648,524288 --field-trial-handle=2224,i,3796498225056043436,12670936432665705704,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:13
      4⤵
      PID:1940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3356,i,11193503258622455703,7689452498262547811,2097152 --field-trial-handle=2224,i,3796498225056043436,12670936432665705704,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
      4⤵
      PID:3164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3360,i,10990177539678289106,5415162000766882317,2097152 --field-trial-handle=2224,i,3796498225056043436,12670936432665705704,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:4240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,11143470427501502048,15761313242798789148,2097152 --field-trial-handle=2224,i,3796498225056043436,12670936432665705704,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
      4⤵
      PID:3272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,3798279421393849162,6898357737015005088,2097152 --field-trial-handle=2224,i,3796498225056043436,12670936432665705704,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:9
      4⤵
      PID:1052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,8283370767118062053,11151021191012799373,524288 --field-trial-handle=2224,i,3796498225056043436,12670936432665705704,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,8807871529381383623,5766169396533705632,524288 --field-trial-handle=2224,i,3796498225056043436,12670936432665705704,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
      4⤵
      PID:1492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,16305914120460460623,7869728542079361451,524288 --field-trial-handle=2224,i,3796498225056043436,12670936432665705704,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
      4⤵
      PID:3848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,11259010398100159888,9459603817452540076,524288 --field-trial-handle=2224,i,3796498225056043436,12670936432665705704,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
      4⤵
      PID:1688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,11259010398100159888,9459603817452540076,524288 --field-trial-handle=2224,i,3796498225056043436,12670936432665705704,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
      4⤵
      PID:6028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,12647958573389233404,821382596323872003,524288 --field-trial-handle=2224,i,3796498225056043436,12670936432665705704,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:5540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,17463788525932486221,12418863457464388819,524288 --field-trial-handle=2224,i,3796498225056043436,12670936432665705704,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
      4⤵
      PID:1284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4752,i,12537666057384741634,12592814834672805364,524288 --field-trial-handle=2224,i,3796498225056043436,12670936432665705704,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
      4⤵
      PID:5988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,2090866762654161074,8808625826242865969,524288 --field-trial-handle=2224,i,3796498225056043436,12670936432665705704,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
      4⤵
      PID:2024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,5704508883931383044,11166410884789547717,524288 --field-trial-handle=2224,i,3796498225056043436,12670936432665705704,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:2872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,13840079234698911033,11899276071968926938,524288 --field-trial-handle=2224,i,3796498225056043436,12670936432665705704,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
      4⤵
      PID:3276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,18218960564695508563,9441203430165136732,524288 --field-trial-handle=2224,i,3796498225056043436,12670936432665705704,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
      4⤵
      PID:5576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=916,i,13728517884347625583,633033503168353942,524288 --field-trial-handle=2224,i,3796498225056043436,12670936432665705704,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
      4⤵
      PID:4300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,12271551416390821885,13371690277109407481,524288 --field-trial-handle=2224,i,3796498225056043436,12670936432665705704,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
      4⤵
      PID:3140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2844,i,15070625883612839174,16926211106286407175,262144 --field-trial-handle=2224,i,3796498225056043436,12670936432665705704,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:10
      4⤵
      PID:2524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,14494108340545156300,14253340940699856969,524288 --field-trial-handle=2224,i,3796498225056043436,12670936432665705704,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
      4⤵
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=748,i,13361344702204569390,13200769620944617756,2097152 --field-trial-handle=2224,i,3796498225056043436,12670936432665705704,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:1
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6320,i,17571773740814564009,15146884771934337482,2097152 --field-trial-handle=2224,i,3796498225056043436,12670936432665705704,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
      4⤵
      PID:6076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3744

C:\Temp\hfzxspkicausmkfc.sys
C:\Temp\hfzxspkicausmkfc.sys
1⤵
- Executes dropped EXE
PID:3496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1560

C:\Temp\pmhfzxrpjh.sys
C:\Temp\pmhfzxrpjh.sys
1⤵
- Executes dropped EXE
PID:2228

C:\Temp\kecwuomkec.sys
C:\Temp\kecwuomkec.sys
1⤵
- Executes dropped EXE
PID:2764

C:\Temp\trmjecwuom.sys
C:\Temp\trmjecwuom.sys
1⤵
- Executes dropped EXE
PID:4280

C:\Temp\ljdbvtoljd.sys
C:\Temp\ljdbvtoljd.sys
1⤵
- Executes dropped EXE
PID:5288

C:\Temp\bvtnlgdyvq.sys
C:\Temp\bvtnlgdyvq.sys
1⤵
- Executes dropped EXE
PID:4284

C:\Temp\ysqkidavsq.sys
C:\Temp\ysqkidavsq.sys
1⤵
- Executes dropped EXE
PID:1068

C:\Temp\kifaysqkic.sys
C:\Temp\kifaysqkic.sys
1⤵
- Executes dropped EXE
PID:5916

C:\Temp\faxspkicau.sys
C:\Temp\faxspkicau.sys
1⤵
- Executes dropped EXE
PID:1844

C:\Temp\cxupmhfzxu.sys
C:\Temp\cxupmhfzxu.sys
1⤵
- Executes dropped EXE
PID:4864

C:\Temp\urmkecwupm.sys
C:\Temp\urmkecwupm.sys
1⤵
- Executes dropped EXE
PID:4956

C:\Temp\jecwuomhez.sys
C:\Temp\jecwuomhez.sys
1⤵
PID:3200

C:\Temp\ywqojgbytr.sys
C:\Temp\ywqojgbytr.sys
1⤵
PID:5896

C:\Temp\bytqljdbtq.sys
C:\Temp\bytqljdbtq.sys
1⤵
PID:3328

C:\Temp\vtnlfdxvtn.sys
C:\Temp\vtnlfdxvtn.sys
1⤵
PID:3696

C:\Temp\aysqkicavs.sys
C:\Temp\aysqkicavs.sys
1⤵
PID:2876

C:\Temp\kicausnkfd.sys
C:\Temp\kicausnkfd.sys
1⤵
PID:2172

C:\Temp\fzxrpkhcau.sys
C:\Temp\fzxrpkhcau.sys
1⤵
PID:3408

C:\Temp\ezxrpjhczu.sys
C:\Temp\ezxrpjhczu.sys
1⤵
PID:1992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtnlgdyvq.sys

Path C:\Temp\bvtnlgdyvq.sys
Size 293KB
SHA256 e1b17177d6abb812a6b76abef882faf331b59dd4a52a1a3520adf41b56fbec00
MD5 6fbdd62476d49213bbd475cd4af51b56
SHA1 6665162fe86b59ec560208d4c9f4c1ca4c2932f3
SHA512 00401edf3e61aaf7b5742ad1578a3c3cdd4ba495db352f488b9ba6480fe6cbd66677365a15a8f72bb10d729c7bde498c3be13a27699cf2056b876f68f4ff89f7
SSDEEP 3072:+tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:+IJjiJcbI03GBc3ucY5DCSj
TLSH
T12B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtolgeywq.exe

Path C:\Temp\bvtolgeywq.exe
Size 361KB
SHA256 eb105770a3933e1b6324e926436b6678747e673ccd892e67768b78781e29ac84
MD5 070da53faafa98c97ae512a65385186b
SHA1 78a8a46cbb7023191b1c750c9b1651426a212d99
SHA512 d28830f993cbf096a5dcb20e307a7eb31034d29419b65176cb406339ff3a9b941abec5711c91c3806de57dec0235b21107feaba3d52a850e8d6f761075cacf08
SSDEEP 6144:RflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:RflfAsiVGjSGecvX
TLSH
T196747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eczusmkecx.exe

Path C:\Temp\eczusmkecx.exe
Size 361KB
SHA256 ab113c8184dbf8a3273ff93d9e1df662523988293e1465e2781b48012d546611
MD5 1e2b8f0e39fca967f409760a285d7d2f
SHA1 a1f340baabf29d527bdcf80a59204d7ea3b9ad34
SHA512 2b9a012bbd845a51a076d1b7ccb075d3e9c3ac0f9b267866f549369610b225422652b8e41230e2cc5f4515a65738a7a7363bc5cb5c6e0209846d31cfeb1c4fed
SSDEEP 6144:SflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:SflfAsiVGjSGecvX
TLSH
T14A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxspkecau.exe

Path C:\Temp\fzxspkecau.exe
Size 361KB
SHA256 9967e717db283e8d3efec67d23fcbf25cfea079745b5c1da174f756262bb21e3
MD5 3ad1b11f65ed3f5b807c2799d756433d
SHA1 9e4a4ecc8bf7831031af43624cd80bb6ebf9b528
SHA512 3ba7eec93981f286d64a58b949aec9b6a8d9e0da38478001514d9f8f18b36b70228ed2009f5802636d55cd285df3110a392bce2276358c7092f2d976fd6436e5
SSDEEP 6144:IflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:IflfAsiVGjSGecvX
TLSH
T1ED747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxspkicausmkfc.exe

Path C:\Temp\hfzxspkicausmkfc.exe
Size 361KB
SHA256 7ae17e8b486875c86c39d5470d9bf09831f134159afa51be4989383614a467eb
MD5 28231738b41ba705a9965b1478bf8fda
SHA1 40d7084cb023e91aa3c662715fbc419aa57ef28f
SHA512 68331cb4971a95eab61518658065f701aacc85d6bad978cb7bda74cf5ca3418e932f7cd01f5ba0c89f75df2571c7358533c19ead2d1bf155087e5b3d89908669
SSDEEP 6144:VflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:VflfAsiVGjSGecvX
TLSH
T1ED747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxspkicausmkfc.sys

Path C:\Temp\hfzxspkicausmkfc.sys
Size 293KB
SHA256 005b7f8488a8ae7915b34bc44fe93af5f54c0c42df85caeaf174159fdb77c403
MD5 e78e8db9a3f2473719bc20ea9cd6e816
SHA1 29c2909febd41352957c40615e76fdb92822bb6d
SHA512 c38085e829a91dec638c2c1b1a3a671d14fd33de88f2f71d07818954a0c637a167d7f845334e3e01da0def73fe09b5face9f9bc511ee37950e5e5ea0287ba198
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T104545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtolgeywq.exe

Path C:\Temp\i_bvtolgeywq.exe
Size 361KB
SHA256 fa4cf602df535f6350f67b3bfc206242a072adc2529de78f854b9ff4fc53dd57
MD5 a66f733731b3f865bef0f9fe046cba85
SHA1 5e062477437acb6ad890e7edce55eb6b55b656d9
SHA512 af809069eda780ddd0d30fb9f5a3b8a4eb3e9d21808f76ccd5209f5994bb6de5e4a9153791dd4ccbf32c1a68a397b65613a86e58aa93442a7f4b6d1ae3a7df72
SSDEEP 6144:6flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:6flfAsiVGjSGecvX
TLSH
T152747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eczusmkecx.exe

Path C:\Temp\i_eczusmkecx.exe
Size 361KB
SHA256 1faf6b0a35819f797f41a43b72ba61b64c201ea0ed7497be01ec121d65c38d9b
MD5 4ef498b69422a411fb6fdc1ad2dfa599
SHA1 a2882a8799d1bb0c1075d57297ccca21dbcbd3fc
SHA512 84b2c7b750c23fabbbbd855e10c736cd07eaf47d30e882de5c37bb2135b14e15e9e0eda4edd68f4fd0cb7caa95886a3794e7deda767a0174ad6fb5840e1ae073
SSDEEP 6144:AflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:AflfAsiVGjSGecvX
TLSH
T1C1747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxspkecau.exe

Path C:\Temp\i_fzxspkecau.exe
Size 361KB
SHA256 7ae0f01da6db0e69f5d783bb2a23ecceaba1c7d1fb69add992a24b926a9c539f
MD5 13df0cdb4047cd07cea1457f745f6812
SHA1 983c6e9f88792357554e513d47fd07d912467065
SHA512 261fb9cab811b58bdaabdd8abc253e5f2529972f49fdd5e709656a9cc96b5e4e70d5d27992b70881a85023246741ce5d46a58ef1a0a26cb9de50cddbd8fa273c
SSDEEP 6144:LflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:LflfAsiVGjSGecvX
TLSH
T142747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mjebwuomge.exe

Path C:\Temp\i_mjebwuomge.exe
Size 361KB
SHA256 4b01aea069656beeb214a79851f754f47333d37a09b30d428ea1cfeac91dd392
MD5 724d7cac46eada87041a208c9f0091fa
SHA1 f7adea3a05b87f07c327d059139e4b58164d36c7
SHA512 64aef595780f91ffbf909b5e184b2aaf538bbeda31f1245311937b34dc276b9b75ab6d6bc9a616ff5b2c766ddf66285b48aafeba6159f4cf3be5ac0bf8ed8f45
SSDEEP 6144:7flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:7flfAsiVGjSGecvX
TLSH
T14F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qligaytqlj.exe

Path C:\Temp\i_qligaytqlj.exe
Size 361KB
SHA256 312db6c88e4f6d63994a72fa8afe7a00b9819b48a65a5573481ce81c1262e720
MD5 1cfa71f56884d43d01bfd17be5837c7c
SHA1 80c05867c0072a2ee32a6402daf4b645b2866b7e
SHA512 f968aae12d42ecea0fbee27c651076507e0846fbef6ed777736be57fd95d7cca9bd4edf583ed4c6f515209eefd8d8871ad99f3540d818b7900050b72ca78aeea
SSDEEP 6144:WflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:WflfAsiVGjSGecvX
TLSH
T10A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpjhbzxrpj.exe

Path C:\Temp\i_rpjhbzxrpj.exe
Size 361KB
SHA256 c0c12990246e62c26fd1a4904898d56be595d26347ce5293877399f8dfbaa31f
MD5 e2629118d9c0f4249dd89c663c450b35
SHA1 9a0a13c3cb4cd363ec18a2f4b100b73029e02c72
SHA512 ef8bf192a975b9288285175048dd10b4cb7b101d5bc02a9a218e59a25d32b827e31690c071f8a9f184ced114078496d5c1febcd20a50df576b74442195db6123
SSDEEP 6144:WflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:WflfAsiVGjSGecvX
TLSH
T1AF747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwuomkec.sys

Path C:\Temp\kecwuomkec.sys
Size 293KB
SHA256 ef36ed09e975046980a8d24c1ebe95d6a841b99c42c54b53bc130082ebbbc13d
MD5 bae5e80a33be01f6020924b8a81c0969
SHA1 23a225d1652fe0c4851819fb412ef99d159c497e
SHA512 ba045ab910af1503542d5c56031558519fad715dc6007ba7b538029f74a66d0e668553fceee8c53ca6c68585d66f84e898123f42f444afd64a7b53535c170359
SSDEEP 3072:NtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:NIJjiJcbI03GBc3ucY5DCSj
TLSH
T103545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbvtoljd.sys

Path C:\Temp\ljdbvtoljd.sys
Size 293KB
SHA256 046be68501e3146eb3b673c4803a0cc9efb7ad255b318ba5f287ba62e7d565a2
MD5 5c7df9c374ad1fff5b592c223fe7a11a
SHA1 c2b6b3d924e6919f84329c6a24c3f6194116bb16
SHA512 561851f2c059bede4020cf6633da8a05d1bed1c9158670d104339297737e6c055df3c37df335d150fdfab6cfa28c29697819f2eba93057358a5b004eaa457b5e
SSDEEP 3072:9tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:9IJjiJcbI03GBc3ucY5DCSj
TLSH
T13E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjebwuomge.exe

Path C:\Temp\mjebwuomge.exe
Size 361KB
SHA256 c976279ccd755532596ab4ace22c07073eee23f04d508a7e2bb8d0eafa022652
MD5 c450f376a3168b9fc4332d52d3234f4c
SHA1 ef0b8fcf028136a03a4a6d62d998b01e7075a7c7
SHA512 07e17d16790342ff7f1295a2c95fbdd2dd9dbaccb166e89c11f426a7bc8ce75f1b30cdf95c3d5529525dc18fc3534b7dfde75b19c5137ed1c32a5ae6554a5c54
SSDEEP 6144:TflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:TflfAsiVGjSGecvX
TLSH
T1CB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhfzxrpjh.sys

Path C:\Temp\pmhfzxrpjh.sys
Size 293KB
SHA256 6375d6dbe570ad756f6eb37c40b5941faab8b383602c6ba2957cca6347d23780
MD5 82943f972b20dc48e562f2600bf6020d
SHA1 54d0845d2ab4174b8c7ca4fde9166572e841d2a5
SHA512 eeef93bc867fdc43ceba66c3535ea36bf9a8eef06f6040bc290f1596a8e23e3cad81e91aa561be701821e6e28d4bbe63fae74786025a4c297b3e37cc8b206426
SSDEEP 3072:VtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:VIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F0545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qligaytqlj.exe

Path C:\Temp\qligaytqlj.exe
Size 361KB
SHA256 305bcba01542c33517dd674620d1362394ba708439f4beec1246a52e543478ff
MD5 ade2927989fa0166e464b5d4625abf0e
SHA1 a47df232f394cd32d35cf5509ef68fd07111e6ad
SHA512 14dc19b3ff5e5dbf18a55cb9c4110362f86536997443a3ac0c412de38427eaa29a949684ff3f7968db68eef3b8cabfe129123d3599a137938cf17ecbe80d8903
SSDEEP 6144:NflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:NflfAsiVGjSGecvX
TLSH
T149747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhbzxrpj.exe

Path C:\Temp\rpjhbzxrpj.exe
Size 361KB
SHA256 31f189f231f868547adbe650f2fa61bccd57f958669ac6f1b63143a25961d120
MD5 b13711010b98e141cb287d9adade8e2c
SHA1 d1dbc2e15231a98e91270f8ab85ecd9dc23d5b0c
SHA512 53fe2d5a7fc4a1ddf7d8a4e37e63c4918356768fc8f41268dc6c95208100d170e14c3b324c66557892a93d122edbcd7302e614516ec539a31b82e3e4f1907eac
SSDEEP 6144:KflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:KflfAsiVGjSGecvX
TLSH
T183747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trmjecwuom.sys

Path C:\Temp\trmjecwuom.sys
Size 293KB
SHA256 5aa24d69906dfce453511c7e3b27bb0db3604795878896ab7d5b15378673893c
MD5 cfe6d4a88578479093435e3d5b6924fc
SHA1 dc882e325c74a68b7394e68e192570fb635f4fdb
SHA512 79740fdfa31780f067f0061a2e32f7a2daf1f45407ad2da4f08baa2879e08c03235ac8d894694a95ddb9d82b65fe1dc17c848c537e91ea80a92740996279e2fb
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A1545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5eeca2aa6e917b76d239047f52a1c2b6b37364fe74e84180ac7fdc9548b3be90
MD5 a153df1b2dbe0717abacfb5c09939775
SHA1 91c63971114b63dacf725afb7452bd3a26feb97e
SHA512 79f36c0948649f3fad8501147974bd9fd20b8a31fdfc130e22546c6adb15a9ea187ca804e252771bfe133494aa84c78a92d9352ebb50e60be11ddd64e17fcbcc
TLSH
T1DED09266B254A84BCB81217639E9B255A2189466401A0A580662B2B8C9F62D306BB8EA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 04de10cb82930e79f08535d557f64ac9621c6cda1d0eccfac6473c0104a0d637
MD5 dea6cb2606db8cdd2fabbd87e0a40db7
SHA1 c2098eca31b6920f57a11bd7cba61a0b491c4813
SHA512 f6292db5c9d79125ec3a39855ecfc244c3c4923eb58b067d4b707a04d5db627e491e5e836c8b067160f89ccf33eb15dca3b9d7fff40fd18590bc2a2ca2ba56e2
TLSH
T1C6D09B557244A94BCB81217235D4B2555214946654150658055171B8C9F62D305BB8ED
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 4f175463d1b7404e5981ad33b95296e802a98e8dd0417e79ab09eda2590428c4
MD5 2c6faea9440831318aef38bcc0a6f006
SHA1 64fe0bbd40bb06a471bae146be4b0be92a65c92c
SHA512 5e3e7e797f4efe64f214a4783f59643145e76ffeb2e97df110603e0f2ee7a8f021a5cd5ac01d27ebb9b3754c06651ef378adacc45f202e499dd8b30d61899c0c
TLSH
T1125184A103708BDBEF658EB698E0E89936F4F45A028B6E24C5F09375289630CFD01037
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7b88470aa1ba1ff74e87df7de9f2375725a39e55f77537bdcf89d9317819cfad
MD5 0ed3c5fd3dbf88d5b1e69eea67468703
SHA1 cf35d1d520110d8d0d28a5b6a7c690177acc2595
SHA512 8e0c3bed1ea2a707ffd9b342821e7cca1c5104583f96d83091298ab71d62085c4e3061dc3cd3836dad87b863ba661e57c1fb3d05735004040ceaa27e0320566c
TLSH
T134419EF3C3E4866E890155F4AA147E1BCE1D0915432C3D5AC9E4EF5B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 87818f3f07a60f9ee69a7a9a3e25b4cb2efd701e5cda3e4def536fb64001ad11
MD5 4a719955e48bedb886dead633eece3a9
SHA1 b220b1b9e62bad30f5f6e1cd96eefcc9057becd9
SHA512 54cb4f63345ca1c90636bcdde888f7acb6b5156a0985743d63616ff93613c4acedc1d3fd111e493f69a4c7a5ef409c59dc80731d903fabc675cb6aabe76be312
SSDEEP 192:sxR5RnyM/jK1Ml8wCG/fCsOfpIZq2grREYzoA8pi/g6+WNIYaUb0GnIgtJ:sxR5H8G/fCsOR2q2gl8i/5IeX3
TLSH
T1B152E9066A34993BCCDBD209FA557F93D6F81473A2941E04AAFCDA0C01E76ED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 403f1961d88bee9bf620d06ab940ea2c5bb79720e364ef437f7ccb175b734e0c
MD5 6482ff69069ac453ac2460cca151a04a
SHA1 10c15470df4ac8bc431f9017db9a3317b43cc621
SHA512 8b2a4392f4c4bfda6f6e4d86aa90d01e9d8f6906d653b8f4d225e113df65e8c252174b86cf58d2d83315689ebce6f73f44f13fefca7844e0b81115eae2660f7c
SSDEEP 192:sxRWRnyM/jK1Ml8UQ3CG/fCsCf1IZq2grREYzoA8pw/g6+WNIYaZb0GnIgDZJ:sxRWHqyG/fCsCt2q2gl8w/5I/X3
TLSH
T17162E9166A24993B8CDBD219FA557F93D6F81473A2941E04AAFCDB0C01E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 bd3531a7b309490f52516429821ba0afab7df20eafebab36b9be96fae303efed
MD5 d984174c5f3786ea478d15268568f95a
SHA1 c09f60ffce552b5c2b9a8d76e335916b809bd6f0
SHA512 f294282aac6a7d8af09ba82cbd95315e0a89007f5a3cfc30b86eb0ba5be3f8b8b90f63058d7bfc3907dc428b5c0fc4091367f39a4f2f4e0b8fa8c41900ed2815
SSDEEP 192:sxRWRnyM/jK1Ml8wCG/fCsCfpIZq2grREYzoA8pi/g6+WNIYaUb0GnIgDTJ:sxRWH8G/fCsCR2q2gl8i/5IeXZ
TLSH
T1D852EA066A34993B8CDBD219FA557F93D6F81473A2941E04AAFCDB0C01E76ED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 f3a79586a8d62cdf71c24fd3944dad2023637872a115273c7f6f3aef2b17f19e
MD5 521c867469006498252d498f2f26cb14
SHA1 179bb5b093e46c604a50a09b7a4dd706904c1bcf
SHA512 71430e9d13e2c8148e431ed81ce8a5eb2e60148504302d3e065db63f4cde11bfc0003191f51b91c51312810db46158f2093b28b2ebd2b91ff21e899de05b1377
SSDEEP 768:nTSdtH7pLuL7kFWg+wfla8F1+UoAYDCx9Tuqh0VfUC9xbog/OVKF9B0U7roKR:nTSdtBE7kFWg+wflau1jalF9mUI+
TLSH
T169E2FB7B280CCB7F4F844A9CEC29BD9AADE801CF56D8895447FA980C03C67EF51165DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 16bb5d3e9d3e28a5413886c2a4178c3b7ee6d45e8eafcfd1a74253a47966b7eb
MD5 a6e585ff41e78458892cae74cef7be26
SHA1 d2f8e3303aa32f6e5277ceddf8cbff9e940e004f
SHA512 f26403cced946f57238ff16243a656ab9c588ab2bf60655d35ce48daf0e8d1bf385963b3b63d7ecba5681a510850d37798926d205a295f25e2597af617a27a25
SSDEEP 96:KReTieYgQGWAltgeGK4DgcGcW+9M+XHOjyuIQAWWQVdguWK4zgsWcGONcON6zn93:CeTieYgQxAl+eODgc1W+9M+XHOjyuIQV
TLSH
T18B910544723A02C0393D6D4980A89C1BD5C5BC633069E53F7BA856E66F67E038DFE8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59d9ad.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59d9ad.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7770d5a1aba6d197d08ebd035c5c626626c0099874564f13e2f9e7cbef2e6bfc
MD5 8b45eb5e70823d74cde7ed60c37fbe73
SHA1 f6106d7149d847ef2d90ea97fdfa11a05d7a7313
SHA512 35e6a83578a0b54434f721d9177feaff5499df38ad7dae39a19a6951bdcda479508bbab55156f9362b2fe69c8d5d64015da2f97eff8819decc0e9fcd88b5650c
SSDEEP 768:zj+9k3rIMj5LBE1tB93XVGRh9zb3bml7b9MD:W9k3r9M9nVG1zub+D
TLSH
T1CCF2BF31A8268D73CCE286D4B20B3A86BFF411B7C5C91E4CE9EE6F0D068764C5B13812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ee918d17868cd35c259cc7082c6479c33f5090636b4c033a4fda2317dc28069e
MD5 0b4a99702734b2ed0a58a50af6008053
SHA1 7713bf1581f6792de0ca85ff33a1865578345494
SHA512 30b8e1a220810492ac843cb5667b095e269d8b11a77f0a19f792050aad12f952df8c05407149b9004e925c407705e19df13a6740c9b4b26bdeb655852fd49b83
SSDEEP 768:trv+4UNbdi3SI315LBEq93XVGRh9zb3bm5TeVH1S7E:tbsbE3SK99nVG1zKEH15
TLSH
T11603BE3298B899339CF68684B10B3A077FB84167D6C90688D8EE1F4D839F58D6707967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 00c77beb5a90753d3fcf68ccdea1cc1f38d198d4e9c835624712711b07f2f79a
MD5 b0f3ab3e26b76971606a4ffef2758875
SHA1 6cc2bc6d7dfbf0538eb9b076ee3b4dfec383fd6c
SHA512 6395cba49050a0a8ce9c1e44cebfb41afe398e9ff070b54c3bc6b577aaba8902d75119e8f4065d9ef44c55bceb2fb35c4842e8caeb8b71416b0b4271e2177a93
SSDEEP 768:Wj+9k34IMj5LBE1tB93XVGRh9zb3bml7b9MD:F9k349M9nVG1zub+D
TLSH
T1D2F2BF31A8669D73CCE686D4B20B3A86BFF411B7C5C91E4CE9EE6F0D068764C5B13816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 b137e057eddb86ddf2bcafb23a2c210ef718f891571ffa600922743e7e87ba7d
MD5 6a8008950f8f22e2ff32ee09bbbc5e4d
SHA1 071f9f6fa8a173aa29eb46f2c2a538155f05195a
SHA512 cce255a2abdbad9a33b494a42b7acef0bd2e21ac4b8e772030d802c30c176c01532fad28917fc0429475e20abf8396445e6c324cf28c50e60c8d825b0e83b6b8
SSDEEP 768:gF1j+963Gwg/IMMGE1tQ93XVGRh9zb3bml7b9MD:t9632h9nVG1zub+D
TLSH
T1D8038D76D865CE77ECE287D4B20A3A86EFE001B7C5CD69C8EAD95E4D018729D4B07C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 dede6198ffcebf5b6c78ec779693d003a1a02982295cfc1f7caa137ce68cbd56
MD5 5ade839092e4a03c65656b6a990a602e
SHA1 328543a17c1885cac9222872dccbd4c80b17e2b7
SHA512 13657138169ba1b5459211336047e47a1629e0d5cfc163b95180899300158e5680e3c85f34bafb83f908548469792b51ccba5cd04e86232da189ccfd41aacd03
SSDEEP 768:Orv+4UNbdO3CITj5LBE1tB93XVGRh9zb3bml7p:ObsbY3C0M9nVG1zup
TLSH
T14603C031A879DD73DCF68284B10B3A837FB81167C5C94A58E9EE5B4D428B68D2B07853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

ca895354-78c8-4630-a894-d2b0fbc80bc1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ca895354-78c8-4630-a894-d2b0fbc80bc1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2280_1857569374\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 1f56de073c5105057449012a6749dc9d59b18ce7a22bfc96df9d382be78678d8
MD5 bed3e8dc98aae180806ce8c7114a3aaf
SHA1 e30114292335cb91752bdf4cc3842cca517aa53a
SHA512 ec55364754767f66ab57aac3879ed732fa87a4b3381d3e6ed7cf018be71c6a6f59c95ca184c5ca99cf6776bb715e7a98d03ea327503dfe9ee802e8a92e49c2d7
TLSH
T13371008366ADD9B3C29A5BF002835244F5BB22380B3320204B515986AB34A3A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1068-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1844-338-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1992-496-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2172-467-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2228-195-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2356-323-0x00000000006B0000-0x000000000070F000-memory.dmp

Download

memory/2764-242-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2876-446-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3200-391-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3328-431-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3408-471-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3496-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3696-442-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4280-267-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4284-308-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4864-363-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4956-379-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5288-279-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5896-411-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5916-322-0x0000000000010000-0x00000000000AB000-memory.dmp

Download