systex | 2b9deeeec6feaca9b7237f83a81fd2b0fd7e8a2fa907ec7f87f8b39e4a357b11

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260712-tyjneads2j
SHA256 2b9deeeec6feaca9b7237f83a81fd2b0fd7e8a2fa907ec7f87f8b39e4a357b11
MD5 9fe9c380ff88cbfc94e04ba889fefe26
SHA1 6f6981ca5504b4c0d885ec55fd1a13f38313cb5b
SHA512 acdfc8165752d08dd533ccd455f504db96386a993336ab0647eebc158e089ecc32fdca490ce308cd9099d9e1476a0c102a727e61add48188643bbaa976492086
SSDEEP 6144:XflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:XflfAsiVGjSGecvX
TLSH
T111747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3312	zxrpjheczurpjhfz.exe
1664	zxrpjheczurpjhfz.sys
3772	CreateProcess.exe
6060	mhfzxrpjhb.exe
3448	CreateProcess.exe
3160	CreateProcess.exe
3140	i_mhfzxrpjhb.exe
2092	jgeztromhe.sys
2400	CreateProcess.exe
5940	ezwrpjgeyw.exe
1896	CreateProcess.exe
804	CreateProcess.exe
5392	i_ezwrpjgeyw.exe
4244	geywtrljdb.sys
5916	CreateProcess.exe
3864	bztrojgbzt.exe
4952	CreateProcess.exe
4804	CreateProcess.exe
868	i_bztrojgbzt.exe
6056	ztqljdbvtg.sys
3352	CreateProcess.exe
816	daywqoigay.exe
1692	CreateProcess.exe
800	CreateProcess.exe
1352	i_daywqoigay.exe
5252	bytqlidbyt.sys
2328	CreateProcess.exe
3068	kigaysqkid.exe
5712	CreateProcess.exe
564	CreateProcess.exe
4244	i_kigaysqkid.exe
2608	davtnlfdav.sys
4468	CreateProcess.exe
4176	ysqkicavsn.exe
3560	CreateProcess.exe
4812	CreateProcess.exe
2816	i_ysqkicavsn.exe
4748	usmkfcausn.sys
2964	CreateProcess.exe
4924	smkcaxvpnh.exe
4560	CreateProcess.exe
580	CreateProcess.exe
2940	i_smkcaxvpnh.exe
704	xupnhfzxsp.sys
4364	CreateProcess.exe
2408	mkhfzxspkh.exe
2912	CreateProcess.exe
1868	CreateProcess.exe
3412	i_mkhfzxspkh.exe
4244	ecwusmkhcz.sys
5488	CreateProcess.exe
6044	urmkecwurm.exe
4820	CreateProcess.exe
4672	CreateProcess.exe
5676	i_urmkecwurm.exe
4512	cwuomhezwr.sys
5356	CreateProcess.exe
3368	ztrpmjebzw.exe
1064	CreateProcess.exe
1628	CreateProcess.exe
3480	i_ztrpmjebzw.exe
5328	rljdbwuolj.sys
1720	CreateProcess.exe
2228	geywuomgey.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5664_885112054\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5664_885112054\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5664_1171362698\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5664_1077771711\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5664_1077771711\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5664_1292402829\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5664_1292402829\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5664_885112054\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5664_885112054\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhfzxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrpjgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkcaxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrpmjebzw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigbytqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurmkhczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkcaxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrpmjebzw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnlfdaysqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnlfdaysqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kigaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkecwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigbytqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurmkhczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwrpjgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_daywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhfzxspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhfzxspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausnkfdxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebztrljdbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebztrljdbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjheczurpjhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kigaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlidaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlidaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upnhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upnhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhezurmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhezurmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhfzxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausnkfdxsp.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5668	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2328	ipconfig.exe
1528	ipconfig.exe
4576	ipconfig.exe
2744	ipconfig.exe
4192	ipconfig.exe
3748	ipconfig.exe
1944	ipconfig.exe
4060	ipconfig.exe
1436	ipconfig.exe
3388	ipconfig.exe
868	ipconfig.exe
2968	ipconfig.exe
3816	ipconfig.exe
3516	ipconfig.exe
1500	ipconfig.exe
5364	ipconfig.exe
3344	ipconfig.exe
2828	ipconfig.exe
5756	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283472840663462"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{B057EA07-76B9-41D2-AB50-B56CF7D6DC12}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3312	zxrpjheczurpjhfz.exe
3312	zxrpjheczurpjhfz.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3312	zxrpjheczurpjhfz.exe
3312	zxrpjheczurpjhfz.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3312	zxrpjheczurpjhfz.exe
3312	zxrpjheczurpjhfz.exe
3312	zxrpjheczurpjhfz.exe
3312	zxrpjheczurpjhfz.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3312	zxrpjheczurpjhfz.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3312	zxrpjheczurpjhfz.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3312	zxrpjheczurpjhfz.exe
3312	zxrpjheczurpjhfz.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3312	zxrpjheczurpjhfz.exe
3312	zxrpjheczurpjhfz.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3140	i_mhfzxrpjhb.exe
Token: SeDebugPrivilege	5392	i_ezwrpjgeyw.exe
Token: SeDebugPrivilege	868	i_bztrojgbzt.exe
Token: SeDebugPrivilege	1352	i_daywqoigay.exe
Token: SeDebugPrivilege	4244	i_kigaysqkid.exe
Token: SeDebugPrivilege	2816	i_ysqkicavsn.exe
Token: SeDebugPrivilege	2940	i_smkcaxvpnh.exe
Token: SeDebugPrivilege	3412	i_mkhfzxspkh.exe
Token: SeDebugPrivilege	5676	i_urmkecwurm.exe
Token: SeDebugPrivilege	3480	i_ztrpmjebzw.exe
Token: SeDebugPrivilege	5744	i_geywuomgey.exe
Token: SeDebugPrivilege	620	i_qoigbytqoi.exe
Token: SeDebugPrivilege	5788	i_qlidaysqli.exe
Token: SeDebugPrivilege	3768	i_pnlfdaysqn.exe
Token: SeDebugPrivilege	3576	i_ausnkfdxsp.exe
Token: SeDebugPrivilege	1260	i_upnhfzxrpk.exe
Token: SeDebugPrivilege	3760	i_pmhezurmjh.exe
Token: SeDebugPrivilege	4808	i_wurmkhczur.exe
Token: SeDebugPrivilege	5736	i_ebztrljdbz.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 3312	4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 4240 wrote to memory of 2356	4240	2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 2356 wrote to memory of 5664	2356	iexplore.exe	89
PID 5664 wrote to memory of 1148	5664	msedge.exe	90
PID 5664 wrote to memory of 2548	5664	msedge.exe	91
PID 5664 wrote to memory of 5668	5664	msedge.exe	92
PID 5664 wrote to memory of 2548	5664	msedge.exe	91
PID 5664 wrote to memory of 2548	5664	msedge.exe	91
PID 5664 wrote to memory of 5320	5664	msedge.exe	93
PID 5664 wrote to memory of 5320	5664	msedge.exe	93
PID 5664 wrote to memory of 5644	5664	msedge.exe	95
PID 5664 wrote to memory of 5644	5664	msedge.exe	95
PID 5664 wrote to memory of 5644	5664	msedge.exe	95
PID 5664 wrote to memory of 5876	5664	msedge.exe	96
PID 5664 wrote to memory of 5876	5664	msedge.exe	96
PID 5664 wrote to memory of 5876	5664	msedge.exe	96
PID 5664 wrote to memory of 1672	5664	msedge.exe	97
PID 5664 wrote to memory of 1672	5664	msedge.exe	97
PID 5664 wrote to memory of 1672	5664	msedge.exe	97
PID 5664 wrote to memory of 2628	5664	msedge.exe	98
PID 5664 wrote to memory of 2628	5664	msedge.exe	98
PID 5664 wrote to memory of 2628	5664	msedge.exe	98
PID 5664 wrote to memory of 940	5664	msedge.exe	99
PID 5664 wrote to memory of 940	5664	msedge.exe	99
PID 3312 wrote to memory of 3772	3312	zxrpjheczurpjhfz.exe	103
PID 5664 wrote to memory of 4848	5664	msedge.exe	106
PID 5664 wrote to memory of 1260	5664	msedge.exe	107
PID 5664 wrote to memory of 4848	5664	msedge.exe	106
PID 5664 wrote to memory of 1260	5664	msedge.exe	107
PID 6060 wrote to memory of 3448	6060	mhfzxrpjhb.exe	108
PID 5664 wrote to memory of 2652	5664	msedge.exe	112
PID 5664 wrote to memory of 5920	5664	msedge.exe	115
PID 5664 wrote to memory of 5920	5664	msedge.exe	115
PID 5664 wrote to memory of 2916	5664	msedge.exe	116
PID 5664 wrote to memory of 2916	5664	msedge.exe	116
PID 3312 wrote to memory of 3160	3312	zxrpjheczurpjhfz.exe	117
PID 3312 wrote to memory of 2400	3312	zxrpjheczurpjhfz.exe	121
PID 5940 wrote to memory of 1896	5940	ezwrpjgeyw.exe	123
PID 3312 wrote to memory of 804	3312	zxrpjheczurpjhfz.exe	126
PID 3312 wrote to memory of 5916	3312	zxrpjheczurpjhfz.exe	130
PID 3864 wrote to memory of 4952	3864	bztrojgbzt.exe	132
PID 3312 wrote to memory of 4804	3312	zxrpjheczurpjhfz.exe	135
PID 5664 wrote to memory of 3436	5664	msedge.exe	137
PID 5664 wrote to memory of 3436	5664	msedge.exe	137
PID 5664 wrote to memory of 3436	5664	msedge.exe	137
PID 5664 wrote to memory of 3704	5664	msedge.exe	140
PID 5664 wrote to memory of 3704	5664	msedge.exe	140
PID 5664 wrote to memory of 3704	5664	msedge.exe	140
PID 3312 wrote to memory of 3352	3312	zxrpjheczurpjhfz.exe	142
PID 816 wrote to memory of 1692	816	daywqoigay.exe	144
PID 3312 wrote to memory of 800	3312	zxrpjheczurpjhfz.exe	147
PID 5664 wrote to memory of 4488	5664	msedge.exe	148
PID 5664 wrote to memory of 3484	5664	msedge.exe	149
PID 5664 wrote to memory of 6008	5664	msedge.exe	150
PID 3312 wrote to memory of 2328	3312	zxrpjheczurpjhfz.exe	154
PID 3068 wrote to memory of 5712	3068	kigaysqkid.exe	156
PID 3312 wrote to memory of 564	3312	zxrpjheczurpjhfz.exe	159
PID 3312 wrote to memory of 4468	3312	zxrpjheczurpjhfz.exe	163
PID 4176 wrote to memory of 3560	4176	ysqkicavsn.exe	165
PID 3312 wrote to memory of 4812	3312	zxrpjheczurpjhfz.exe	168
PID 5664 wrote to memory of 2184	5664	msedge.exe	170
PID 5664 wrote to memory of 2184	5664	msedge.exe	170
PID 5664 wrote to memory of 2184	5664	msedge.exe	170
PID 5664 wrote to memory of 2448	5664	msedge.exe	171

C:\Users\Admin\AppData\Local\Temp\2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_9fe9c380ff88cbfc94e04ba889fefe26_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Temp\zxrpjheczurpjhfz.exe
  C:\Temp\zxrpjheczurpjhfz.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhfzxrpjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3772
  - - C:\Temp\mhfzxrpjhb.exe
      C:\Temp\mhfzxrpjhb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6060
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhfzxrpjhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3160
  - - C:\Temp\i_mhfzxrpjhb.exe
      C:\Temp\i_mhfzxrpjhb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezwrpjgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2400
  - - C:\Temp\ezwrpjgeyw.exe
      C:\Temp\ezwrpjgeyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5940
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1896
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezwrpjgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:804
  - - C:\Temp\i_ezwrpjgeyw.exe
      C:\Temp\i_ezwrpjgeyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrojgbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5916
  - - C:\Temp\bztrojgbzt.exe
      C:\Temp\bztrojgbzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4952
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrojgbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4804
  - - C:\Temp\i_bztrojgbzt.exe
      C:\Temp\i_bztrojgbzt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\daywqoigay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3352
  - - C:\Temp\daywqoigay.exe
      C:\Temp\daywqoigay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:816
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1692
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3388
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_daywqoigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:800
  - - C:\Temp\i_daywqoigay.exe
      C:\Temp\i_daywqoigay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kigaysqkid.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2328
  - - C:\Temp\kigaysqkid.exe
      C:\Temp\kigaysqkid.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3068
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5712
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kigaysqkid.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:564
  - - C:\Temp\i_kigaysqkid.exe
      C:\Temp\i_kigaysqkid.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqkicavsn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4468
  - - C:\Temp\ysqkicavsn.exe
      C:\Temp\ysqkicavsn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4176
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3560
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqkicavsn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4812
  - - C:\Temp\i_ysqkicavsn.exe
      C:\Temp\i_ysqkicavsn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkcaxvpnh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2964
  - - C:\Temp\smkcaxvpnh.exe
      C:\Temp\smkcaxvpnh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4924
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4560
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkcaxvpnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:580
  - - C:\Temp\i_smkcaxvpnh.exe
      C:\Temp\i_smkcaxvpnh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkhfzxspkh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4364
  - - C:\Temp\mkhfzxspkh.exe
      C:\Temp\mkhfzxspkh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2408
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2912
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkhfzxspkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1868
  - - C:\Temp\i_mkhfzxspkh.exe
      C:\Temp\i_mkhfzxspkh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmkecwurm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5488
  - - C:\Temp\urmkecwurm.exe
      C:\Temp\urmkecwurm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6044
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4820
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmkecwurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4672
  - - C:\Temp\i_urmkecwurm.exe
      C:\Temp\i_urmkecwurm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrpmjebzw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5356
  - - C:\Temp\ztrpmjebzw.exe
      C:\Temp\ztrpmjebzw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3368
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1064
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrpmjebzw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1628
  - - C:\Temp\i_ztrpmjebzw.exe
      C:\Temp\i_ztrpmjebzw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywuomgey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1720
  - - C:\Temp\geywuomgey.exe
      C:\Temp\geywuomgey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2228
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2472
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywuomgey.exe ups_ins
    3⤵
    PID:2892
  - - C:\Temp\i_geywuomgey.exe
      C:\Temp\i_geywuomgey.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigbytqoi.exe ups_run
    3⤵
    PID:3100
  - - C:\Temp\qoigbytqoi.exe
      C:\Temp\qoigbytqoi.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4496
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5828
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigbytqoi.exe ups_ins
    3⤵
    PID:3324
  - - C:\Temp\i_qoigbytqoi.exe
      C:\Temp\i_qoigbytqoi.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qlidaysqli.exe ups_run
    3⤵
    PID:6012
  - - C:\Temp\qlidaysqli.exe
      C:\Temp\qlidaysqli.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2932
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6008
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qlidaysqli.exe ups_ins
    3⤵
    PID:1208
  - - C:\Temp\i_qlidaysqli.exe
      C:\Temp\i_qlidaysqli.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnlfdaysqn.exe ups_run
    3⤵
    PID:2960
  - - C:\Temp\pnlfdaysqn.exe
      C:\Temp\pnlfdaysqn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3180
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5484
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnlfdaysqn.exe ups_ins
    3⤵
    PID:1828
  - - C:\Temp\i_pnlfdaysqn.exe
      C:\Temp\i_pnlfdaysqn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ausnkfdxsp.exe ups_run
    3⤵
    PID:2744
  - - C:\Temp\ausnkfdxsp.exe
      C:\Temp\ausnkfdxsp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3620
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1536
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ausnkfdxsp.exe ups_ins
    3⤵
    PID:4100
  - - C:\Temp\i_ausnkfdxsp.exe
      C:\Temp\i_ausnkfdxsp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upnhfzxrpk.exe ups_run
    3⤵
    PID:4760
  - - C:\Temp\upnhfzxrpk.exe
      C:\Temp\upnhfzxrpk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5264
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1300
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upnhfzxrpk.exe ups_ins
    3⤵
    PID:4576
  - - C:\Temp\i_upnhfzxrpk.exe
      C:\Temp\i_upnhfzxrpk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmhezurmjh.exe ups_run
    3⤵
    PID:2756
  - - C:\Temp\pmhezurmjh.exe
      C:\Temp\pmhezurmjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2516
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1676
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmhezurmjh.exe ups_ins
    3⤵
    PID:3820
  - - C:\Temp\i_pmhezurmjh.exe
      C:\Temp\i_pmhezurmjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wurmkhczur.exe ups_run
    3⤵
    PID:6020
  - - C:\Temp\wurmkhczur.exe
      C:\Temp\wurmkhczur.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3660
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2208
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wurmkhczur.exe ups_ins
    3⤵
    PID:2504
  - - C:\Temp\i_wurmkhczur.exe
      C:\Temp\i_wurmkhczur.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebztrljdbz.exe ups_run
    3⤵
    PID:3012
  - - C:\Temp\ebztrljdbz.exe
      C:\Temp\ebztrljdbz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5060
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2012
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebztrljdbz.exe ups_ins
    3⤵
    PID:5048
  - - C:\Temp\i_ebztrljdbz.exe
      C:\Temp\i_ebztrljdbz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5736
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff89711c188,0x7ff89711c194,0x7ff89711c1a0
      4⤵
      PID:1148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,16988562574743630334,2049705742006514671,262144 --field-trial-handle=2568,i,15811002658325477412,13622191007324966693,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:2
      4⤵
      PID:2548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,17821597725374385646,5852743203572857472,524288 --field-trial-handle=2568,i,15811002658325477412,13622191007324966693,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:11
      4⤵
      System Time Discovery
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,17300135663382587245,740646553216178887,524288 --field-trial-handle=2568,i,15811002658325477412,13622191007324966693,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:13
      4⤵
      PID:5320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,16085711732915084078,4587973144180551538,2097152 --field-trial-handle=2568,i,15811002658325477412,13622191007324966693,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:5644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,8807716226637533432,2254570214281782944,2097152 --field-trial-handle=2568,i,15811002658325477412,13622191007324966693,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:5876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,7413883321637264733,16059305923588248480,2097152 --field-trial-handle=2568,i,15811002658325477412,13622191007324966693,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:9
      4⤵
      PID:1672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,11353150694007569421,11633042022833001652,2097152 --field-trial-handle=2568,i,15811002658325477412,13622191007324966693,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:1
      4⤵
      PID:2628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,11666619924416905894,11529245065181096256,524288 --field-trial-handle=2568,i,15811002658325477412,13622191007324966693,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14
      4⤵
      PID:940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,17484096722622287037,13335203502491280337,524288 --field-trial-handle=2568,i,15811002658325477412,13622191007324966693,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
      4⤵
      PID:4848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,12579756335550322048,11426052124298104690,524288 --field-trial-handle=2568,i,15811002658325477412,13622191007324966693,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
      4⤵
      PID:1260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,6420234757710190130,13453487355956511943,524288 --field-trial-handle=2568,i,15811002658325477412,13622191007324966693,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:3768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,6420234757710190130,13453487355956511943,524288 --field-trial-handle=2568,i,15811002658325477412,13622191007324966693,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:2652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,3236640527190480527,8896055331122737345,524288 --field-trial-handle=2568,i,15811002658325477412,13622191007324966693,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
      4⤵
      PID:5920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,17516482746822022681,11971050352691653562,524288 --field-trial-handle=2568,i,15811002658325477412,13622191007324966693,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
      4⤵
      PID:2916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4396,i,9518233826250327127,9011744287004209622,2097152 --field-trial-handle=2568,i,15811002658325477412,13622191007324966693,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
      4⤵
      PID:3436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3812,i,4547291422585171006,2717799183439350131,2097152 --field-trial-handle=2568,i,15811002658325477412,13622191007324966693,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
      4⤵
      PID:3704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,16365061610103746102,4400928883423551953,524288 --field-trial-handle=2568,i,15811002658325477412,13622191007324966693,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:14
      4⤵
      PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,4115803960841480545,15555246729202277680,524288 --field-trial-handle=2568,i,15811002658325477412,13622191007324966693,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:14
      4⤵
      PID:3484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,8056536890993768951,13087443467792920120,524288 --field-trial-handle=2568,i,15811002658325477412,13622191007324966693,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6392,i,6342769680781025731,5211337363233363057,2097152 --field-trial-handle=2568,i,15811002658325477412,13622191007324966693,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
      4⤵
      PID:2184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6452,i,1338643103816282373,18029709429555545347,2097152 --field-trial-handle=2568,i,15811002658325477412,13622191007324966693,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
      4⤵
      PID:2448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,14384794551706280627,5210508414200196339,524288 --field-trial-handle=2568,i,15811002658325477412,13622191007324966693,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
      4⤵
      PID:5588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,16667838574224980248,12133532466933084768,524288 --field-trial-handle=2568,i,15811002658325477412,13622191007324966693,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:14
      4⤵
      PID:3080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5280,i,2494546070518353706,8361838117005419631,2097152 --field-trial-handle=2568,i,15811002658325477412,13622191007324966693,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
      4⤵
      PID:2784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,7994660193844336640,6300590452817959953,524288 --field-trial-handle=2568,i,15811002658325477412,13622191007324966693,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
      4⤵
      PID:4140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3884,i,18044104501951657005,5513328734629630684,524288 --field-trial-handle=2568,i,15811002658325477412,13622191007324966693,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
      4⤵
      PID:5648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3904,i,7786223973429664185,5933596293632699477,262144 --field-trial-handle=2568,i,15811002658325477412,13622191007324966693,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:10
      4⤵
      PID:464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=3876,i,18246822648406978333,15223257499147202320,2097152 --field-trial-handle=2568,i,15811002658325477412,13622191007324966693,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:1
      4⤵
      PID:1996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,14505291659158500816,7551627358792773451,524288 --field-trial-handle=2568,i,15811002658325477412,13622191007324966693,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:14
      4⤵
      PID:5948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2864

C:\Temp\zxrpjheczurpjhfz.sys
C:\Temp\zxrpjheczurpjhfz.sys
1⤵
- Executes dropped EXE
PID:1664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4968

C:\Temp\jgeztromhe.sys
C:\Temp\jgeztromhe.sys
1⤵
- Executes dropped EXE
PID:2092

C:\Temp\geywtrljdb.sys
C:\Temp\geywtrljdb.sys
1⤵
- Executes dropped EXE
PID:4244

C:\Temp\ztqljdbvtg.sys
C:\Temp\ztqljdbvtg.sys
1⤵
- Executes dropped EXE
PID:6056

C:\Temp\bytqlidbyt.sys
C:\Temp\bytqlidbyt.sys
1⤵
- Executes dropped EXE
PID:5252

C:\Temp\davtnlfdav.sys
C:\Temp\davtnlfdav.sys
1⤵
- Executes dropped EXE
PID:2608

C:\Temp\usmkfcausn.sys
C:\Temp\usmkfcausn.sys
1⤵
- Executes dropped EXE
PID:4748

C:\Temp\xupnhfzxsp.sys
C:\Temp\xupnhfzxsp.sys
1⤵
- Executes dropped EXE
PID:704

C:\Temp\ecwusmkhcz.sys
C:\Temp\ecwusmkhcz.sys
1⤵
- Executes dropped EXE
PID:4244

C:\Temp\cwuomhezwr.sys
C:\Temp\cwuomhezwr.sys
1⤵
- Executes dropped EXE
PID:4512

C:\Temp\rljdbwuolj.sys
C:\Temp\rljdbwuolj.sys
1⤵
- Executes dropped EXE
PID:5328

C:\Temp\wtolgeywqo.sys
C:\Temp\wtolgeywqo.sys
1⤵
PID:3192

C:\Temp\igaytqljdb.sys
C:\Temp\igaytqljdb.sys
1⤵
PID:5520

C:\Temp\vqoigaysqk.sys
C:\Temp\vqoigaysqk.sys
1⤵
PID:1744

C:\Temp\usqkicaysq.sys
C:\Temp\usqkicaysq.sys
1⤵
PID:2512

C:\Temp\xupnhfcxup.sys
C:\Temp\xupnhfcxup.sys
1⤵
PID:5676

C:\Temp\wupmhecaus.sys
C:\Temp\wupmhecaus.sys
1⤵
PID:4964

C:\Temp\hfzxrpjhcz.sys
C:\Temp\hfzxrpjhcz.sys
1⤵
PID:1096

C:\Temp\jgeywromge.sys
C:\Temp\jgeywromge.sys
1⤵
PID:1592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bytqlidbyt.sys

Path C:\Temp\bytqlidbyt.sys
Size 293KB
SHA256 832d367a8dcc84dfbbfd7c0c27a6f1f8eaf132e6a248f5db06dc2b227ead0f42
MD5 cecc0e926f1b6daf92b01e12c266d3f8
SHA1 502a71202985e36ebe6e4c80c3d23b539d15559f
SHA512 c4d706eb9224502bfd15154c86a20da929054b375de37f1ab519415ad80511ca3c7a97149bf128e90c40aaf5f8651e9a22e4abf140acfaf22a6bf1f8352e25d4
SSDEEP 3072:MtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:MIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrojgbzt.exe

Path C:\Temp\bztrojgbzt.exe
Size 361KB
SHA256 835112d8d6f94ed9cf088f93034736729cceb007fe5af3cdf068372ac13a25f8
MD5 0fb67215050ededf96be84d280adc83e
SHA1 d0b7938b49adbec3559874664b81ee804767f259
SHA512 cde66dc091f8ef98e6c03b6067acdaad305367c84cda0be6b66b11bc57d9244172ab6842f91237ee56fd26a90fea56e75122d70290c67173b4dc8349b4259b6a
SSDEEP 6144:JflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:JflfAsiVGjSGecvX
TLSH
T185747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

davtnlfdav.sys

Path C:\Temp\davtnlfdav.sys
Size 293KB
SHA256 2d402ae1c8498879199cd13323a68cb6f713b902c3055b8de03e577fdf4241ac
MD5 9150dc979285fda633de29bb845addfe
SHA1 2d7dd4c474c38ae5b4b1ace5b22f1e14a8af7730
SHA512 4cb245c479259b164ed1155c00a169d5ab2c7d02536d8f68982bc8b595e930fe3694944c0f12755850f94db2168d76434596c2b1ab534f6511f90cd5ac4d63d3
SSDEEP 3072:8tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:8IJjiJcbI03GBc3ucY5DCSj
TLSH
T176545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

daywqoigay.exe

Path C:\Temp\daywqoigay.exe
Size 361KB
SHA256 d90873190fb0d95db9e1b33ff7a386c3cc558242b5cb8d49962c40541b756369
MD5 956eafcab250517fae446dd9d7a465fe
SHA1 12ad2097be6fe4271ff09a7ae13a6ada6d03beff
SHA512 cbfc2a577e441425c4f841aab039cbb059f07b7306f166f1c354879d09906a26f8aadf7f9e9b9bef1a36262e25b437efdba997afdd1e1d91cd3d5485266b9061
SSDEEP 6144:uflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:uflfAsiVGjSGecvX
TLSH
T1D1747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezwrpjgeyw.exe

Path C:\Temp\ezwrpjgeyw.exe
Size 361KB
SHA256 97ff1b7c08b490a29fc5b04cc55e2a191b726dbed1719f14ca7d6a427de247a3
MD5 43096a953da47e52eaa1c8a4ba0bc21c
SHA1 9a13b8aa13c27783f6e8ab557556713550407418
SHA512 4e484843f771f2eef52164096f224e8d57c0e1d411fa73cb21c92784c77b487d252c0e7ef81bd260b1e250caca2e2b7c4287d8a798532a89b01792c661aaf399
SSDEEP 6144:DflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:DflfAsiVGjSGecvX
TLSH
T171747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywtrljdb.sys

Path C:\Temp\geywtrljdb.sys
Size 293KB
SHA256 654bc17a91954db8ea8af14dc409477e6c86989e19c610d57ea600a52209ceee
MD5 a3ae9eaa871b5cc832b11acd2ab44930
SHA1 460eb6f4818c036ecbe5f1399486c2bfa9358deb
SHA512 f2b4fdc777f0cdfde2ab23e9edbb1823400a0da1ba615b781a3ef726da9507b9b4bfb69c02b09cab718178760f241dde290e4fcbf7913336c22df499f035b981
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T12A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bztrojgbzt.exe

Path C:\Temp\i_bztrojgbzt.exe
Size 361KB
SHA256 2838a9929834692f1706e7595b6cd61d4056abe734b804964df8f112ca66d1de
MD5 be2742b72278e1958462304e5723e37a
SHA1 31caed22a130b9236efad82be6e5764f9eb18ec4
SHA512 63d64241898fe3b516c23f89c915d2f2cc04fdeb1c8ef87fe58b9d225771f3252c95946b4b1bfb7aeda2b0acc6c07431ff493741742cb5a67ba1fe5185cc0211
SSDEEP 6144:AflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:AflfAsiVGjSGecvX
TLSH
T1E6747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_daywqoigay.exe

Path C:\Temp\i_daywqoigay.exe
Size 361KB
SHA256 e7541d8457df6d3b4ab4c7598f7dde2aa8a6b09d1ab0007d077d83919092cb25
MD5 f38854a18a21ce5c2113ad981670b34e
SHA1 0f727d0c3867ed0978d9a606d3bcb2fb869abba3
SHA512 10f3e13d30883cf72ca4a8204fadb2ec967353c958069f8cd725dad3f1ca9a2a2480d99c48c4ec756c58594257472114211a1df0e2b458cebbda1404318562aa
SSDEEP 6144:kflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:kflfAsiVGjSGecvX
TLSH
T1D9747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ezwrpjgeyw.exe

Path C:\Temp\i_ezwrpjgeyw.exe
Size 361KB
SHA256 d60794c509f9f9c5c026a8aeee267ab3aaad5fc227d6c70bdad231310ad8f8ef
MD5 3782a522302a0b264a8dc68a8a8ee9eb
SHA1 58e290c4c8cf615ae686066ef6daa0a31e04cc48
SHA512 e8f8302581961be601680b21dac3007735929cc217c05d985fce078087b6795fb919fa3bbf8ea1a0c692f8be73dc69eb1c1877036c11e3522587394e8aacaefa
SSDEEP 6144:aflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:aflfAsiVGjSGecvX
TLSH
T102747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kigaysqkid.exe

Path C:\Temp\i_kigaysqkid.exe
Size 361KB
SHA256 856e4c12bee23af9979d0e9301b396a173dfb98c353fe75b25c9a8841c3d39be
MD5 7bb89d8a84b6d1b7a8533770cef4cfe2
SHA1 a6d34e48491f7be4e156b3648a79a1e3911347d5
SHA512 5aa314828933ca1af1bfbc4ea70d7f22e11ae09cf9f95d52bd735a678abeb90c5eee22c636596f3063e95337e4f7efc4eba1778ed86d75511b1979554f66d914
SSDEEP 6144:KflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:KflfAsiVGjSGecvX
TLSH
T129747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mhfzxrpjhb.exe

Path C:\Temp\i_mhfzxrpjhb.exe
Size 361KB
SHA256 eec4fee1082ad8b13e5e7c375713c27be8aab670c9a4dd1f614908e23fa92208
MD5 385b5cfc07bde8ed63751c97129446e0
SHA1 1eb5e9622471c6cda5c91772b2b0b410058525c3
SHA512 304543e4a4ea7e299b76173f8b142ec9120dc00f4f8124ab48f7723ab434f7d50c9272ddafe1814c1ecd636337be59e0777806aa8e0943d77b1f6480e23374c3
SSDEEP 6144:kflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:kflfAsiVGjSGecvX
TLSH
T1FE747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgeztromhe.sys

Path C:\Temp\jgeztromhe.sys
Size 293KB
SHA256 ce47b2aa2fafe88aff11d7e9ddda9000051c1246aa11af3ce1e58d67197373ce
MD5 c823ca975c308c088d47fce74f2a83d3
SHA1 241a7cf116abf65b826d48ce3f92699925a7ce3a
SHA512 83158cc7dc1b2b332c9edd254d383d3c03130b271fb1abfabf0afbac04e16e59e49bff6ae7854cda335ce7e20670e8a90b49d5ea0d0c4020d0343cc8d988c271
SSDEEP 3072:htKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:hIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kigaysqkid.exe

Path C:\Temp\kigaysqkid.exe
Size 361KB
SHA256 70c8dc7b5d957668fc541295be932f44f8e5a34c86fd463900bfb1af471e6531
MD5 0054e788d202ff5d63b6ef08b96c362f
SHA1 130d167cd353e78eccd1b8c767c51b0649ffd9e4
SHA512 5d5243306f6890f6aafbb2b0f3bdb730c761d83ed4c82a8500e0a5e5940b3fc460e5086f5e59aa5d87967f2c1e75584074b30b14abf9eb94a937ca9aaeb9f68f
SSDEEP 6144:3flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:3flfAsiVGjSGecvX
TLSH
T14B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhfzxrpjhb.exe

Path C:\Temp\mhfzxrpjhb.exe
Size 361KB
SHA256 270cd9d89cd7ff850784ec71f7c868dd8f2b8e1f19577503fae97f9f5dde4825
MD5 28bc413115be54a0c226d5c16742e98c
SHA1 73112df42059fd444bb40497c695465f15dc8435
SHA512 003bc8211fff5c0c6a5b3f43f485c56f68277b02b50c06d335797ac36fdee410761f92a931e74be9e06a45656aec9e794b80f934478d8e1f585b3eb90ce84320
SSDEEP 6144:RflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:RflfAsiVGjSGecvX
TLSH
T100747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqkicavsn.exe

Path C:\Temp\ysqkicavsn.exe
Size 361KB
SHA256 c6cb1c6322da6216b95fbdf76a9d65358f914913f6e94acb1962484b81f62346
MD5 4305411506fdb6196b94991e5eacdf20
SHA1 78da7f3178c9571a88fb32eb691251068b393dc9
SHA512 7b20ae7498ada9fa61f1e482d587e971f7e5feb0febd455aa8b734c1ff9894365d239838d6f74892f008e40f7bb3532756377d7c06b4908f8c66068ed745a041
SSDEEP 6144:mflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:mflfAsiVGjSGecvX
TLSH
T19D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztqljdbvtg.sys

Path C:\Temp\ztqljdbvtg.sys
Size 293KB
SHA256 681ed27d08da35ebc2cc62f274aaf93e75256ec7f7fd9c08e0ae20b1a7132305
MD5 208a52e3a14a9486e249cbeb98b827b6
SHA1 6f527f9649dd686fb4150b44023062ec11357095
SHA512 fbe853eb76af72d60d42887cc5db4cb82260d047978429f431215689b14a6b4a18e7e1b7c1e59e6a32cf975d4f5499d0c199452e53e125f7e5cdf9172af5c5c5
SSDEEP 3072:htKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:hIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpjheczurpjhfz.exe

Path C:\Temp\zxrpjheczurpjhfz.exe
Size 361KB
SHA256 5369958ea1e424f1469bf00dfc98afa2d425efd8010588771eb3770a724b587f
MD5 b6d38c12de7a6460c198a015e9805d05
SHA1 84c94413f4ff7a0e8699329fbbefc32c053398cd
SHA512 1e2d3887133686225d5a315a8024f7954bb7320a4c6652f7b2d75b3ad130bb180e1941cc1eb12b742a57988a31bd10e884095740bdc179fa4cbd88906d2388f3
SSDEEP 6144:RflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:RflfAsiVGjSGecvX
TLSH
T14D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpjheczurpjhfz.sys

Path C:\Temp\zxrpjheczurpjhfz.sys
Size 293KB
SHA256 43dfd5a88bb5f3fbd9debd5bc574ea31f44f30d86ce011ae9b140a35efd12855
MD5 d79c86f585e5c7c2e2d2d905909284d2
SHA1 9d9771c5ea888b2a31ab04ac1438f4b36e98c65c
SHA512 5f385b4eb9d9708bf0d61d233deb4c94a4041d6472e3d49c9e847b055bead02e173fa09bd57e2b97a62cbd06ea021cf50412e78c7a832584789f7d2bc9877694
SSDEEP 3072:1tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:1IJjiJcbI03GBc3ucY5DCSj
TLSH
T110545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 4d4033e170ae560c749bda9e0d166f61115166bc8f08afdce0b672516c9be1d8
MD5 52026a88f8ccf88f35290446492efe4b
SHA1 a8b6e5474d526d7ca2e03b047f5331dd48082bcb
SHA512 e3a35aa26be0cab51188dbe8824720231f9e017131b8e620239aedf4d16ba494d19013abcbf5c9198a5d54f3637a9d5d87a8885ce06e4106ed631b4e63f85943
TLSH
T17F51957133263EF2DBFA497132E1625832FDC44902BB1E25B0906D345C6AF99E9D5063
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5970e1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5970e1.TMP
Size 2KB
SHA256 3a2471d5fc2b51115173ca34d4970e2ed5c3cea93556608c1f5366b236a7d396
MD5 d9b2bb93c2df25dd4aa1c50f9be1272e
SHA1 824cdd3dc9b631484d65873d88d94b9bd8ce3a2b
SHA512 65afa59589c8cf108064650d1b6c372aafab192083e2573e2a202aeffd27fe2d2fcc6757764f9aac78cdcc20548c7d594e2f2473ec3ce02f25330b4bb1b514c6
TLSH
T11651957133263EF2DBFA497132E1625832FDC44902BB1E25B0906D745C6AF99EDD5063
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1166d014493ed9ebb616dffaa0c309a07d0f3c48c45193063d3e59fae02d39ab
MD5 f8134cc7d42016dd0f82153fc50e1f7d
SHA1 0a9214ad97b9f6c2426f7bea797a2bcc1911d4a5
SHA512 38ffa72c32b24a60a869a17886c44b4f2a5afda8a582f5319225c3ef23b36b9b586c8c628b392a85a71d87212e48b4af2fb2a1bd8bb287ebb39ffbc88373f629
TLSH
T11E51CEF3C7E8863EC91156F0AB147E2BCE2D0914432C3D5A89E4AF1BA3E2871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 762653e1c3a41a2a0bd2a2655a34f7db4db8bd7aac217e42ee0531466ad710a0
MD5 5815657cc5cdfd3d78afc745bf0b9cd0
SHA1 732686bf43cc4d472cb723bf4232bb92d8c7ab3c
SHA512 15c18dd63132fb159f7aef3626dbee9101f9c88a3de24ad1cde39ad01d8d6e4edd93cdd211fee1cded856826f0a1a453840385348b3ae6e964a214175e30d4b4
SSDEEP 192:sxRARuyM/jK1Ml8wCS/fEsNQ+kZbzoD8pi/g6+WNIYCsuOS+GC/IgtJ:sxRAM8S/fEsm+aDi/5IeS0/3
TLSH
T1CB52EA156A245D3BCCDBD20CFA51BF93D6F85573A1901E44AAFCCA0C00E6AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 90abf6ca160f7543f64cdb1ed4a46fbc4c8f7eb1c064a44b938fb4cd741f16d5
MD5 cdaa407ef43102700e10b915f03b1d45
SHA1 0b37f4b0c3fec98c229365cbef8ce800c93def4c
SHA512 172059e91ab59aacfd88730179b60b449db4b05a3adfff0a8ebbbdfff4490c7cf2f26fb2886fcd489d4bd68ff66cc2e2bed8b9ecc5502c5d8db2b064c2de493f
SSDEEP 192:sxRjRuyM/jK1Ml8UQyCS/fEsSQ1kZDzoD8prx/g6+WNIYC5uOS+GC/IgD1J:sxRjMqFS/fEsf1abF/5IlS0/j
TLSH
T16962DA166A245D77DCDBD20DF651BF93D6F85473A1901E44AAFCCA0C00E6AED121382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 369e74cd1ce3b790ccffe239955447f97680ab74c8569d7f9e0f3b206643b47d
MD5 63ee8c9937c6e1de4d8ee842e9943161
SHA1 c9c5a6548ef0ca79d25ec29ec9ec36f3ecc574ec
SHA512 19d89585500e5e08fc0eaa056f1002db3e149d705562a174d95adbf2e9d6e9690499be6e7b23677cc5a96e59f655d965de2f152dbfa7f3729e358f22844fce98
SSDEEP 192:sxRjRuyM/jK1Ml8wCS/fEsSQ+kZbzoD8pi/g6+WNIYCsuOS+GC/IgDPJ:sxRjM8S/fEsf+aDi/5IeS0/l
TLSH
T1B852DA156A245D7BCCDBD20CFA51BF93D6F85563A1901E44AAFCCA0C04E6AEC121382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 b310fd9c666af23a2ef4d34e9c91fa8ddafe80e781741ae9b1f13a93550bc367
MD5 cded6b8b1985c7e1caaabbdc93055b56
SHA1 191465ae25ce2a7dc3b5da52f998ef511605e0a8
SHA512 9985d0f5eaf2ef6d2a349f27c3ff0d42c4c982454f0591f7318d3f5d17508c62f36155cfe5bd0e6da6bc2bd16bd7c00b2e6da146486d2e2d1cadb09b4cd80a3a
SSDEEP 768:j/8vNN7pLuL7tQWgQ+fB+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVx7MQqqFrov2:j/8vN7E7tQWgQ+fB+u1jaq7MVq+u
TLSH
T1E8E2FC7B680CCB7E4F804E9DEC29BD9AADE801CF5698CD5447EA840C03C57EB561A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf907c44-8083-45f2-8d54-fb0f3c0edeaf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\cf907c44-8083-45f2-8d54-fb0f3c0edeaf.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c3af29df83fff14de60549001451f36c1360afa4a4f48bd861675cb61dd8de47
MD5 6708b659e888484f74accc43b2fdfcf3
SHA1 b936f09a5a976fd48b77bf1457f13ae7cbcbb74e
SHA512 22d5ef6a231ff37ce2775094806d91c5ae6963a086f7361bf17976b45b0c815218d34c4c9ac3ff2c4224c0f6d2d5a2ce56ee8f0d22e0b99074ce3f5d57930849
SSDEEP 768:Arv+4UNbd13Z9FCtQEOp8+p3bd66j+4BRv86aLIWrO1:Absbn38I8+p3Z6n4yFO1
TLSH
T18C03AE72F869DD339CF6D644B18A7B837FF420A355C00EA8E9D99B4D05461AE270B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7aef8e18d87651f0d6a727949cf15a9ddcea6492776a6853e6a269eb61dd49d0
MD5 248e0653f93ce925d87f0feac18ba50c
SHA1 cb7950c250488a92a9073c10d5d885e845dea671
SHA512 49dee5ad3b4e25ccddeb470d3e2976951bcb08aea6db8768c56d8ffe5d5c06531ca2f96be8986906edee53354ba8bc26d8a8a0ba0af1616abd7d2497e411f08c
SSDEEP 768:/j+9b3p9FCtQE0p8+p3bd66j+4BRv86aLIWrb9Ma:y9b3MC8+p3Z6n4yFb+a
TLSH
T1C1F2AF72EC6ADE234CE5D68472563B837FF421B795C01E98D9DDAB0D05432AD1706836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 96db587dbbb48f79c3f037944d0dc1abfee1d4bfb72691b7474dd047a7cdc30e
MD5 8b80ea22d1d17278b2954876bc912028
SHA1 33b965b17382d218a0a0a4cdbbbc20927682a7b9
SHA512 756c1e7dfc068d7127daf490966c5a54525053ecc23954fad74bd461feebd960cf81baf2c6ce408013c56b1fe7fd9d2e7fdfe2522246beeb752c2744506cd4a8
SSDEEP 768:PF1j+9a3Pwg5SYCtQgp8+p3bd66j+4BRv86aLIWrb9Ma:m9a3G8+p3Z6n4yFb+a
TLSH
T1B8038D77E855CE679CE687C5B3567B87AFF011A386C85DD8D9D85F0D00832AD070AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3da66f780e0d352b07182220abcc316261728a6b97423856cb6b08e4c7d637d9
MD5 a056e5bbadd85f1cffc45c0b67401e82
SHA1 37d6648a30bde0eb22d9d062bbf20ea94ee65a7b
SHA512 599da9790458374238ca636a0a5b94f688837093f994c591749278ac59cedb9f5ef6d0fd665c4e9427ccaa1ee65689612b75014cbcf8bfd76025b9de0820524a
SSDEEP 768:Irv+4UNbdD3ccFCtkNp8+p3bd66j+4BRv86aLIia2bwCl1:Ibsbp3PL8+p3Z6n4yE0ww
TLSH
T1EB03BE73F96899339CF6C684B2467A837FF851A396C10AC4D5DD2B4E015A19E230BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e651aac06bfa120a3271df1aa7d1df5c42d48f8e7eb0588b1672c2f737bec5be
MD5 f2f51079af0ba828259b893b93a136c9
SHA1 314d4f9c00f9da469de775098a03cea9af7fe430
SHA512 ef138a6b5ef9137f5a196db3aaf1856d01de38468b22d5f862687ce175e5f06a3127b0f8fd12582ae7834ec4f5bcb07373aa9bf926065f46124c7616c035f5ef
SSDEEP 768:Zj+9b3a9FCtQE0p8+p3bd66j+4BRv86aLIWrb9Ma:E9b3ZC8+p3Z6n4yFb+a
TLSH
T1D4F2AF72EC6ADE234CE5C684B2563B836FF421B795C01E98D9DDAB0D05832AD170683A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5664_888821654\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 910c9a58066499f1f8bd14192b059a9ae835b1e3c9a3c971cae9e45bd327c47d
MD5 b55a1cd53f0597a3031a13939e6c56c2
SHA1 f85a615e899b4941592bda654931f099afd24a22
SHA512 5eaeba40c63063198826a328ab605989ea877f006524a2cdb5a7c77aefa60025cf0020293a9c08ee2e1ba2cbbffcbc923ff61aa9c5894efa30add77cc9790e62
TLSH
T16E7100835AB9DAF2C1AA5BF402835648F1BB2238072370210B555546AA34A7A18B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/704-328-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1096-468-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1592-481-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1664-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1744-428-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2092-195-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2512-432-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2608-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2608-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3192-396-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3312-243-0x00000000002C0000-0x000000000031F000-memory.dmp

Download

memory/4244-242-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4244-343-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4244-274-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4512-368-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4748-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4964-469-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4964-464-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5252-286-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5328-376-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5520-416-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5676-443-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6056-271-0x0000000000010000-0x00000000000AB000-memory.dmp

Download