systex | 70ee8b4502ebee14d0cdfa641e1b86b2f51d1a60f823aa21646ccccecbee87ad

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 01:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260720-bjbedaa12q
SHA256 70ee8b4502ebee14d0cdfa641e1b86b2f51d1a60f823aa21646ccccecbee87ad
MD5 7f09956dfc6643d164c8fe6703697547
SHA1 c03c22018e7eaa7b985aa04df268a70b847b147a
SHA512 b20279acc8c55d5b1b2897c0b692a076682940c2213222d7f45efc582fd773cff9ef36beb1a593c3b5874784428892f3a25e84676381df7b7af0a24994ee8ae5
SSDEEP 6144:BflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:BflfAsiVGjSGecvX
TLSH
T19F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2640	dbytrljdbvtrljgb.exe
1912	dbytrljdbvtrljgb.sys
1740	CreateProcess.exe
5952	omgebwtomg.exe
5836	CreateProcess.exe
5816	CreateProcess.exe
5200	i_omgebwtomg.exe
3384	vtnlfdyvqn.sys
2092	CreateProcess.exe
2960	tnlidbvtnl.exe
704	CreateProcess.exe
5920	CreateProcess.exe
3392	i_tnlidbvtnl.exe
4916	kifdxvqnig.sys
5272	CreateProcess.exe
584	lidaysqkig.exe
5264	CreateProcess.exe
5064	CreateProcess.exe
2944	i_lidaysqkig.exe
1744	favsnkiday.sys
6028	CreateProcess.exe
4572	vpnhfzxspk.exe
4968	CreateProcess.exe
3640	CreateProcess.exe
1472	i_vpnhfzxspk.exe
972	vpnhfzxspk.sys
2776	CreateProcess.exe
4084	pnhfzxspkh.exe
5700	CreateProcess.exe
2156	CreateProcess.exe
4756	i_pnhfzxspkh.exe
5072	kfcausmkec.sys
2536	CreateProcess.exe
3436	fzxrpmhecx.exe
2492	CreateProcess.exe
4228	CreateProcess.exe
5060	i_fzxrpmhecx.exe
3256	zxrpjhbztr.sys
3316	CreateProcess.exe
6012	zwuomhecwu.exe
4472	CreateProcess.exe
5580	CreateProcess.exe
4644	i_zwuomhecwu.exe
2756	hbztrpjgez.sys
2892	CreateProcess.exe
5508	wqojgbzwro.exe
5988	CreateProcess.exe
1928	CreateProcess.exe
4064	i_wqojgbzwro.exe
2900	rljdbwtrmj.sys
1744	CreateProcess.exe
4940	jgbztrojgb.exe
4464	CreateProcess.exe
4708	CreateProcess.exe
2920	i_jgbztrojgb.exe
4200	jdbytrljdb.sys
4960	CreateProcess.exe
3536	dbvtqoigay.exe
6132	CreateProcess.exe
2004	CreateProcess.exe
4860	i_dbvtqoigay.exe
2604	idavtnlida.sys
1384	CreateProcess.exe
948	gdbvtnlfdx.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_1352877325\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_666792275\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_1633463347\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_1633463347\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_666792275\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_666792275\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_666792275\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_1568319118\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_1352877325\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdbvtnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbytrljdbvtrljgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidaysqkig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwuomhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icausmkicx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhczusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpmhecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqojgbzwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrmjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avtqlidxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpmhecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgebwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwuomhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbztrojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausmkicx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidaysqkig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdbvtnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztromjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgebwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbztrojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gayvtqliga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqojgbzwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhczusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztromjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gayvtqliga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrmjeb.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
992	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1752	ipconfig.exe
4344	ipconfig.exe
908	ipconfig.exe
3164	ipconfig.exe
1600	ipconfig.exe
2396	ipconfig.exe
4652	ipconfig.exe
5936	ipconfig.exe
708	ipconfig.exe
908	ipconfig.exe
3756	ipconfig.exe
5896	ipconfig.exe
4148	ipconfig.exe
5480	ipconfig.exe
1164	ipconfig.exe
4144	ipconfig.exe
6104	ipconfig.exe
1564	ipconfig.exe
4200	ipconfig.exe
3472	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289834093339116"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{DAA0E83C-6A76-4C8A-AFD9-628255EFD1F2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2640	dbytrljdbvtrljgb.exe
2640	dbytrljdbvtrljgb.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2640	dbytrljdbvtrljgb.exe
2640	dbytrljdbvtrljgb.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2640	dbytrljdbvtrljgb.exe
2640	dbytrljdbvtrljgb.exe
2640	dbytrljdbvtrljgb.exe
2640	dbytrljdbvtrljgb.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5200	i_omgebwtomg.exe
Token: SeDebugPrivilege	3392	i_tnlidbvtnl.exe
Token: SeDebugPrivilege	2944	i_lidaysqkig.exe
Token: SeDebugPrivilege	1472	i_vpnhfzxspk.exe
Token: SeDebugPrivilege	4756	i_pnhfzxspkh.exe
Token: SeDebugPrivilege	5060	i_fzxrpmhecx.exe
Token: SeDebugPrivilege	4644	i_zwuomhecwu.exe
Token: SeDebugPrivilege	4064	i_wqojgbzwro.exe
Token: SeDebugPrivilege	2920	i_jgbztrojgb.exe
Token: SeDebugPrivilege	4860	i_dbvtqoigay.exe
Token: SeDebugPrivilege	908	i_gdbvtnlfdx.exe
Token: SeDebugPrivilege	4844	i_kicavsnlfd.exe
Token: SeDebugPrivilege	2852	i_icausmkicx.exe
Token: SeDebugPrivilege	5536	i_czxrpkhcau.exe
Token: SeDebugPrivilege	3120	i_jhczusmkec.exe
Token: SeDebugPrivilege	1164	i_hbztromjeb.exe
Token: SeDebugPrivilege	2972	i_jhbztrmjeb.exe
Token: SeDebugPrivilege	1612	i_dbztrljdbw.exe
Token: SeDebugPrivilege	2228	i_gayvtqliga.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4616	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5308 wrote to memory of 2640	5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 5308 wrote to memory of 4880	5308	2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 4880 wrote to memory of 4616	4880	iexplore.exe	91
PID 4616 wrote to memory of 5996	4616	msedge.exe	92
PID 4616 wrote to memory of 992	4616	msedge.exe	94
PID 4616 wrote to memory of 572	4616	msedge.exe	95
PID 4616 wrote to memory of 572	4616	msedge.exe	95
PID 4616 wrote to memory of 572	4616	msedge.exe	95
PID 4616 wrote to memory of 2508	4616	msedge.exe	96
PID 4616 wrote to memory of 2508	4616	msedge.exe	96
PID 4616 wrote to memory of 1696	4616	msedge.exe	98
PID 4616 wrote to memory of 3424	4616	msedge.exe	97
PID 4616 wrote to memory of 1696	4616	msedge.exe	98
PID 4616 wrote to memory of 1696	4616	msedge.exe	98
PID 4616 wrote to memory of 3424	4616	msedge.exe	97
PID 4616 wrote to memory of 3424	4616	msedge.exe	97
PID 4616 wrote to memory of 4384	4616	msedge.exe	99
PID 4616 wrote to memory of 4384	4616	msedge.exe	99
PID 4616 wrote to memory of 4384	4616	msedge.exe	99
PID 4616 wrote to memory of 3240	4616	msedge.exe	100
PID 4616 wrote to memory of 3240	4616	msedge.exe	100
PID 4616 wrote to memory of 3240	4616	msedge.exe	100
PID 4616 wrote to memory of 2144	4616	msedge.exe	101
PID 4616 wrote to memory of 2144	4616	msedge.exe	101
PID 2640 wrote to memory of 1740	2640	dbytrljdbvtrljgb.exe	105
PID 5952 wrote to memory of 5836	5952	omgebwtomg.exe	108
PID 4616 wrote to memory of 1440	4616	msedge.exe	111
PID 4616 wrote to memory of 1928	4616	msedge.exe	112
PID 4616 wrote to memory of 1440	4616	msedge.exe	111
PID 4616 wrote to memory of 1928	4616	msedge.exe	112
PID 4616 wrote to memory of 1944	4616	msedge.exe	114
PID 4616 wrote to memory of 3340	4616	msedge.exe	115
PID 4616 wrote to memory of 3340	4616	msedge.exe	115
PID 4616 wrote to memory of 4940	4616	msedge.exe	118
PID 4616 wrote to memory of 4940	4616	msedge.exe	118
PID 2640 wrote to memory of 5816	2640	dbytrljdbvtrljgb.exe	119
PID 2640 wrote to memory of 2092	2640	dbytrljdbvtrljgb.exe	123
PID 2960 wrote to memory of 704	2960	tnlidbvtnl.exe	125
PID 2640 wrote to memory of 5920	2640	dbytrljdbvtrljgb.exe	128
PID 2640 wrote to memory of 5272	2640	dbytrljdbvtrljgb.exe	132
PID 584 wrote to memory of 5264	584	lidaysqkig.exe	134
PID 2640 wrote to memory of 5064	2640	dbytrljdbvtrljgb.exe	137
PID 2640 wrote to memory of 6028	2640	dbytrljdbvtrljgb.exe	142
PID 4572 wrote to memory of 4968	4572	vpnhfzxspk.exe	144
PID 2640 wrote to memory of 3640	2640	dbytrljdbvtrljgb.exe	147
PID 4616 wrote to memory of 6088	4616	msedge.exe	149
PID 4616 wrote to memory of 2164	4616	msedge.exe	150
PID 4616 wrote to memory of 5216	4616	msedge.exe	151
PID 2640 wrote to memory of 2776	2640	dbytrljdbvtrljgb.exe	154
PID 4084 wrote to memory of 5700	4084	pnhfzxspkh.exe	156
PID 2640 wrote to memory of 2156	2640	dbytrljdbvtrljgb.exe	159
PID 2640 wrote to memory of 2536	2640	dbytrljdbvtrljgb.exe	163
PID 3436 wrote to memory of 2492	3436	fzxrpmhecx.exe	165
PID 2640 wrote to memory of 4228	2640	dbytrljdbvtrljgb.exe	168
PID 2640 wrote to memory of 3316	2640	dbytrljdbvtrljgb.exe	172
PID 6012 wrote to memory of 4472	6012	zwuomhecwu.exe	174
PID 2640 wrote to memory of 5580	2640	dbytrljdbvtrljgb.exe	177
PID 2640 wrote to memory of 2892	2640	dbytrljdbvtrljgb.exe	181
PID 5508 wrote to memory of 5988	5508	wqojgbzwro.exe	183
PID 2640 wrote to memory of 1928	2640	dbytrljdbvtrljgb.exe	186
PID 4616 wrote to memory of 6064	4616	msedge.exe	188
PID 4616 wrote to memory of 6064	4616	msedge.exe	188
PID 2640 wrote to memory of 1744	2640	dbytrljdbvtrljgb.exe	194
PID 4940 wrote to memory of 4464	4940	jgbztrojgb.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_7f09956dfc6643d164c8fe6703697547_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5308
- C:\Temp\dbytrljdbvtrljgb.exe
  C:\Temp\dbytrljdbvtrljgb.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgebwtomg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1740
  - - C:\Temp\omgebwtomg.exe
      C:\Temp\omgebwtomg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5952
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5836
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgebwtomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5816
  - - C:\Temp\i_omgebwtomg.exe
      C:\Temp\i_omgebwtomg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnlidbvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2092
  - - C:\Temp\tnlidbvtnl.exe
      C:\Temp\tnlidbvtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:704
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnlidbvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5920
  - - C:\Temp\i_tnlidbvtnl.exe
      C:\Temp\i_tnlidbvtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lidaysqkig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5272
  - - C:\Temp\lidaysqkig.exe
      C:\Temp\lidaysqkig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:584
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5264
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lidaysqkig.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5064
  - - C:\Temp\i_lidaysqkig.exe
      C:\Temp\i_lidaysqkig.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnhfzxspk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6028
  - - C:\Temp\vpnhfzxspk.exe
      C:\Temp\vpnhfzxspk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4572
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4968
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnhfzxspk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3640
  - - C:\Temp\i_vpnhfzxspk.exe
      C:\Temp\i_vpnhfzxspk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfzxspkh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2776
  - - C:\Temp\pnhfzxspkh.exe
      C:\Temp\pnhfzxspkh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4084
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfzxspkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2156
  - - C:\Temp\i_pnhfzxspkh.exe
      C:\Temp\i_pnhfzxspkh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxrpmhecx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2536
  - - C:\Temp\fzxrpmhecx.exe
      C:\Temp\fzxrpmhecx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3436
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2492
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1600
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxrpmhecx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4228
  - - C:\Temp\i_fzxrpmhecx.exe
      C:\Temp\i_fzxrpmhecx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwuomhecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3316
  - - C:\Temp\zwuomhecwu.exe
      C:\Temp\zwuomhecwu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6012
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4472
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwuomhecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5580
  - - C:\Temp\i_zwuomhecwu.exe
      C:\Temp\i_zwuomhecwu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqojgbzwro.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2892
  - - C:\Temp\wqojgbzwro.exe
      C:\Temp\wqojgbzwro.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5508
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5988
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqojgbzwro.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1928
  - - C:\Temp\i_wqojgbzwro.exe
      C:\Temp\i_wqojgbzwro.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgbztrojgb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1744
  - - C:\Temp\jgbztrojgb.exe
      C:\Temp\jgbztrojgb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4940
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4464
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgbztrojgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4708
  - - C:\Temp\i_jgbztrojgb.exe
      C:\Temp\i_jgbztrojgb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtqoigay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4960
  - - C:\Temp\dbvtqoigay.exe
      C:\Temp\dbvtqoigay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3536
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6132
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtqoigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2004
  - - C:\Temp\i_dbvtqoigay.exe
      C:\Temp\i_dbvtqoigay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdbvtnlfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1384
  - - C:\Temp\gdbvtnlfdx.exe
      C:\Temp\gdbvtnlfdx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:948
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1560
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdbvtnlfdx.exe ups_ins
    3⤵
    PID:1824
  - - C:\Temp\i_gdbvtnlfdx.exe
      C:\Temp\i_gdbvtnlfdx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicavsnlfd.exe ups_run
    3⤵
    PID:4308
  - - C:\Temp\kicavsnlfd.exe
      C:\Temp\kicavsnlfd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1968
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2552
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kicavsnlfd.exe ups_ins
    3⤵
    PID:608
  - - C:\Temp\i_kicavsnlfd.exe
      C:\Temp\i_kicavsnlfd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icausmkicx.exe ups_run
    3⤵
    PID:5372
  - - C:\Temp\icausmkicx.exe
      C:\Temp\icausmkicx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4332
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3808
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icausmkicx.exe ups_ins
    3⤵
    PID:5548
  - - C:\Temp\i_icausmkicx.exe
      C:\Temp\i_icausmkicx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czxrpkhcau.exe ups_run
    3⤵
    PID:3852
  - - C:\Temp\czxrpkhcau.exe
      C:\Temp\czxrpkhcau.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4596
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5748
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czxrpkhcau.exe ups_ins
    3⤵
    PID:1912
  - - C:\Temp\i_czxrpkhcau.exe
      C:\Temp\i_czxrpkhcau.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhczusmkec.exe ups_run
    3⤵
    PID:2628
  - - C:\Temp\jhczusmkec.exe
      C:\Temp\jhczusmkec.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4116
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3180
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhczusmkec.exe ups_ins
    3⤵
    PID:2160
  - - C:\Temp\i_jhczusmkec.exe
      C:\Temp\i_jhczusmkec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbztromjeb.exe ups_run
    3⤵
    PID:4716
  - - C:\Temp\hbztromjeb.exe
      C:\Temp\hbztromjeb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1520
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3740
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbztromjeb.exe ups_ins
    3⤵
    PID:3192
  - - C:\Temp\i_hbztromjeb.exe
      C:\Temp\i_hbztromjeb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbztrmjeb.exe ups_run
    3⤵
    PID:4868
  - - C:\Temp\jhbztrmjeb.exe
      C:\Temp\jhbztrmjeb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:480
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1444
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbztrmjeb.exe ups_ins
    3⤵
    PID:5976
  - - C:\Temp\i_jhbztrmjeb.exe
      C:\Temp\i_jhbztrmjeb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbztrljdbw.exe ups_run
    3⤵
    PID:5060
  - - C:\Temp\dbztrljdbw.exe
      C:\Temp\dbztrljdbw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4376
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4252
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbztrljdbw.exe ups_ins
    3⤵
    PID:5584
  - - C:\Temp\i_dbztrljdbw.exe
      C:\Temp\i_dbztrljdbw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gayvtqliga.exe ups_run
    3⤵
    PID:5628
  - - C:\Temp\gayvtqliga.exe
      C:\Temp\gayvtqliga.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4388
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:240
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gayvtqliga.exe ups_ins
    3⤵
    PID:2464
  - - C:\Temp\i_gayvtqliga.exe
      C:\Temp\i_gayvtqliga.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\avtqlidxvq.exe ups_run
    3⤵
    PID:3420
  - - C:\Temp\avtqlidxvq.exe
      C:\Temp\avtqlidxvq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1200
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1084
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2396
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffadf55c188,0x7ffadf55c194,0x7ffadf55c1a0
      4⤵
      PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2180,i,10797343576675010696,1289934104582624826,524288 --field-trial-handle=2512,i,1918936626426469235,17253547093312686199,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:11
      4⤵
      System Time Discovery
      PID:992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1952,i,6304641888159980750,12192851748371055975,262144 --field-trial-handle=2512,i,1918936626426469235,17253547093312686199,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:2
      4⤵
      PID:572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,5647379116247550978,7310115651358696511,524288 --field-trial-handle=2512,i,1918936626426469235,17253547093312686199,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:13
      4⤵
      PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,7065779116267504187,16858633787575987274,2097152 --field-trial-handle=2512,i,1918936626426469235,17253547093312686199,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:3424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,4620149571288649228,652273029095443355,2097152 --field-trial-handle=2512,i,1918936626426469235,17253547093312686199,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:1696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,9012374073485743084,10027944226068423801,2097152 --field-trial-handle=2512,i,1918936626426469235,17253547093312686199,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:1
      4⤵
      PID:4384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,9425980700817566033,15607445135717425461,2097152 --field-trial-handle=2512,i,1918936626426469235,17253547093312686199,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:9
      4⤵
      PID:3240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,302940797263006723,4669076306384727763,524288 --field-trial-handle=2512,i,1918936626426469235,17253547093312686199,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
      4⤵
      PID:2144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,6088897508839799428,5150828249575398057,524288 --field-trial-handle=2512,i,1918936626426469235,17253547093312686199,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
      4⤵
      PID:1440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,7430225965976148206,13122072919544975294,524288 --field-trial-handle=2512,i,1918936626426469235,17253547093312686199,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
      4⤵
      PID:1928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,4361255527886639976,9491378663681843401,524288 --field-trial-handle=2512,i,1918936626426469235,17253547093312686199,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
      4⤵
      PID:5048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,4361255527886639976,9491378663681843401,524288 --field-trial-handle=2512,i,1918936626426469235,17253547093312686199,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
      4⤵
      PID:1944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,15972849582106942676,16261284915009937370,524288 --field-trial-handle=2512,i,1918936626426469235,17253547093312686199,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:3340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,2151709499414122801,3054160426321281727,524288 --field-trial-handle=2512,i,1918936626426469235,17253547093312686199,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1304,i,1595179665709417376,16395391608251218935,524288 --field-trial-handle=2512,i,1918936626426469235,17253547093312686199,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
      4⤵
      PID:6088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1308,i,3570913185875427279,17636441443084951469,524288 --field-trial-handle=2512,i,1918936626426469235,17253547093312686199,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
      4⤵
      PID:2164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1312,i,1611946060548718732,10957943654633502072,524288 --field-trial-handle=2512,i,1918936626426469235,17253547093312686199,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:14
      4⤵
      PID:5216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,12509605261916159335,11211518517881557480,524288 --field-trial-handle=2512,i,1918936626426469235,17253547093312686199,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
      4⤵
      PID:6064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,8271633527731030815,17195741336770355730,524288 --field-trial-handle=2512,i,1918936626426469235,17253547093312686199,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
      4⤵
      PID:5256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,15656938049281567630,7145722431543616122,524288 --field-trial-handle=2512,i,1918936626426469235,17253547093312686199,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
      4⤵
      PID:3584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,12104852551143077280,14714854532684420688,524288 --field-trial-handle=2512,i,1918936626426469235,17253547093312686199,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
      4⤵
      PID:204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6724,i,4134369200632433564,2320061972513708667,262144 --field-trial-handle=2512,i,1918936626426469235,17253547093312686199,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:10
      4⤵
      PID:5452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1404,i,15551446168477994159,2765775595548183616,524288 --field-trial-handle=2512,i,1918936626426469235,17253547093312686199,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
      4⤵
      PID:356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:532

C:\Temp\dbytrljdbvtrljgb.sys
C:\Temp\dbytrljdbvtrljgb.sys
1⤵
- Executes dropped EXE
PID:1912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1604

C:\Temp\vtnlfdyvqn.sys
C:\Temp\vtnlfdyvqn.sys
1⤵
- Executes dropped EXE
PID:3384

C:\Temp\kifdxvqnig.sys
C:\Temp\kifdxvqnig.sys
1⤵
- Executes dropped EXE
PID:4916

C:\Temp\favsnkiday.sys
C:\Temp\favsnkiday.sys
1⤵
- Executes dropped EXE
PID:1744

C:\Temp\vpnhfzxspk.sys
C:\Temp\vpnhfzxspk.sys
1⤵
- Executes dropped EXE
PID:972

C:\Temp\kfcausmkec.sys
C:\Temp\kfcausmkec.sys
1⤵
- Executes dropped EXE
PID:5072

C:\Temp\zxrpjhbztr.sys
C:\Temp\zxrpjhbztr.sys
1⤵
- Executes dropped EXE
PID:3256

C:\Temp\hbztrpjgez.sys
C:\Temp\hbztrpjgez.sys
1⤵
- Executes dropped EXE
PID:2756

C:\Temp\rljdbwtrmj.sys
C:\Temp\rljdbwtrmj.sys
1⤵
- Executes dropped EXE
PID:2900

C:\Temp\jdbytrljdb.sys
C:\Temp\jdbytrljdb.sys
1⤵
- Executes dropped EXE
PID:4200

C:\Temp\idavtnlida.sys
C:\Temp\idavtnlida.sys
1⤵
- Executes dropped EXE
PID:2604

C:\Temp\qnlfdavsqn.sys
C:\Temp\qnlfdavsqn.sys
1⤵
PID:560

C:\Temp\pnkfcavsni.sys
C:\Temp\pnkfcavsni.sys
1⤵
PID:2844

C:\Temp\fcxupmkecz.sys
C:\Temp\fcxupmkecz.sys
1⤵
PID:3228

C:\Temp\hbzxrpmhfz.sys
C:\Temp\hbzxrpmhfz.sys
1⤵
PID:4188

C:\Temp\omhezwromh.sys
C:\Temp\omhezwromh.sys
1⤵
PID:4780

C:\Temp\jebztromge.sys
C:\Temp\jebztromge.sys
1⤵
PID:5596

C:\Temp\jgbywqoigb.sys
C:\Temp\jgbywqoigb.sys
1⤵
PID:2532

C:\Temp\dyvtqljday.sys
C:\Temp\dyvtqljday.sys
1⤵
PID:2232

C:\Temp\oigaytqlid.sys
C:\Temp\oigaytqlid.sys
1⤵
PID:3712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CreateProcess.exe

Path C:\Temp\CreateProcess.exe
Size 3KB
SHA256 db4c9d8e420b9289c7aa4456cb4499e94499912d91d1a993fd0d82d2849f41a7
MD5 28424098ca643b4a9653d1fe5b9478bc
SHA1 8aebf5a9434b22e01de3723e04cb6ade7e1ee24b
SHA512 4b8c2aa98b378b8fbdc9bc9c3afa27858dee3e5b73292b18c3b9188d57c4649c845fbef9a5ff8ca7a9073a4ea5872a00a6a717450a42b7608472659de6e8e0af
TLSH
T15371238357A8D5F2C1DE9BF102835644F5FB2238072330200BA1598BEB30A7A58B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

dbytrljdbvtrljgb.exe

Path C:\Temp\dbytrljdbvtrljgb.exe
Size 361KB
SHA256 54c0c565bfa5439af42c264ac0f3f3cf863b593e227713911155f9e6e0029594
MD5 ad5da9ff79f304f4e80a9ccb9194631f
SHA1 a0bf9f9292728741af1077a1d38eab5f8c6b5506
SHA512 372262ff0113414b4c2a0da1ac64aa49186ad0ad22620c88f644958c126aaf4f6c8f2d197c75da1b14cf8d161cb9b9fc00527eb565a68f11ea20534207a8717d
SSDEEP 6144:iflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:iflfAsiVGjSGecvX
TLSH
T183747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbytrljdbvtrljgb.sys

Path C:\Temp\dbytrljdbvtrljgb.sys
Size 293KB
SHA256 aa8e18fe86bfd91cf8a0dad8c496104c1fcb7938d86593b443daa6ed9473200c
MD5 44c23396b6e4a508e53c707f994a4500
SHA1 c7bccaa8c571bb7f2748ed5eba7b0eb1914e0ec7
SHA512 fdce4e0c5cc2322313cccf899946bbb664082c15672529b96ba9d187bbd4bc04f75553b5f8356dfca56ba46e4ffcbb5b365d733850cab4b683dec29561c358f9
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T11D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favsnkiday.sys

Path C:\Temp\favsnkiday.sys
Size 293KB
SHA256 fb219ac162e9817bd6f1755f0ff4b0471dfbea6909504383d18e37083bb5c88c
MD5 9b451c64bfc6edd7587db48190c08014
SHA1 a2aa13e6c7a6d3ba726f6b3cb3132703f7304539
SHA512 63b5585c6653fbc16d3c1f23c54f7b3224dc9604a2b74a0c64820e3c11063cec1ccd49413c77e05b583689e98ef42a0a5a1d19012cf01af696d3f9cc56cf7879
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C0545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxrpmhecx.exe

Path C:\Temp\fzxrpmhecx.exe
Size 361KB
SHA256 c31a77249a9fa69ee98e5010c9689f874d90b2ef8e8b88e8e030e1aa21a91875
MD5 cb66ab87ca3e4f687684bd2604cdc5d4
SHA1 bff62a89b06a69b8dc7a2a1a88982550ccd24af0
SHA512 f13eaa7f0ad7117a565bd90321b94026cfa5aa0783d2d399167fed9672dc257fdbdbaaf28c258609e04ed87144f2ea93fd9b6edbd4289a429e261022e7645ed3
SSDEEP 6144:pflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:pflfAsiVGjSGecvX
TLSH
T1D0747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxrpmhecx.exe

Path C:\Temp\i_fzxrpmhecx.exe
Size 361KB
SHA256 c24f69126fdc48b911c0dea8bde2fae36ec6439d92709e78a101afb597b21a56
MD5 f157a48c85fee227b5a31cef51f3a387
SHA1 5d3ea846d1f69944515e0a257bebe8a4bbabdd23
SHA512 b98ff075aafbf9f51d652df1afa3653f7987a88955f3f7827bd6a79b791b4bac56902eaa53728e0a3165897a52ae88874f22780e28085884f30307d3cfaa8dd2
SSDEEP 6144:7flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:7flfAsiVGjSGecvX
TLSH
T1D4747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lidaysqkig.exe

Path C:\Temp\i_lidaysqkig.exe
Size 361KB
SHA256 6aa590040421c4af3fdb15a61e160283ca6637744bcd7fe12f161380057c0635
MD5 e917f83d22b20d374c31a032f53e8aba
SHA1 a5539f6591fd0e5d6764be448c47ff097c0a7171
SHA512 bef6837a1258fd20aa7297466c4ca513e5686a2d64f93e8ea23faee93c216a0692363a2749a6106e65daa099e42ac46e139a8e9ba3fd73106043fc2fcfbd2408
SSDEEP 6144:/flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:/flfAsiVGjSGecvX
TLSH
T1F2747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omgebwtomg.exe

Path C:\Temp\i_omgebwtomg.exe
Size 361KB
SHA256 43208a31bd4c9e8b851e3e8677553ee91c254946c24272f7adbf78f0a26c9af1
MD5 0131bc6200c6d9beed2a9ab067a7d184
SHA1 2450201cd9d8229eb40a64e1eb880cbed691e718
SHA512 4788e0ab05a0fc9b1d0214ec7b19f6c856a5b6f40ea7a4fede2ff090119e8d5ae08edff3ba6aecb04b8d30bc18f5453c9cde1c0d57f0a344014c9d9cbc3814b7
SSDEEP 6144:bflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:bflfAsiVGjSGecvX
TLSH
T17F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnhfzxspkh.exe

Path C:\Temp\i_pnhfzxspkh.exe
Size 361KB
SHA256 ed1a71aa369c2c44c73595d3e7e9f3cefbcb58f2dc472f97c02182eeccd52976
MD5 e98c5e28b183855dd9289990bcb56655
SHA1 14b08441904cfd1c36604e3943c5f7c1245bf723
SHA512 56a5070e2c83cc8e12cee85f7c31ab423cc27c94727b4ab65e612a6f23972455c5e361f60e53a32bce7ac24fea7544afa046e583631fa70939a404e8d524226c
SSDEEP 6144:aflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:aflfAsiVGjSGecvX
TLSH
T1EC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnlidbvtnl.exe

Path C:\Temp\i_tnlidbvtnl.exe
Size 361KB
SHA256 302bb5d94d58675e40dc6bc55480eebad51538d9499b0db99575e4449cda8cf7
MD5 184bdbe410bfad92051122945dbb76f5
SHA1 34f5505b8a9f6f96d8403b024efc52810a23f592
SHA512 05084cd4f45cb953a3c602427b93ca7bf16d81e160cc2bcadf54a07e4dc755932450eae6966151e6f9696a106787d25d89299ed4fcae89a4c12ad2266b4f9c8e
SSDEEP 6144:2flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:2flfAsiVGjSGecvX
TLSH
T126747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vpnhfzxspk.exe

Path C:\Temp\i_vpnhfzxspk.exe
Size 361KB
SHA256 887e336578fdb57814aa422f65fc04aa5e78555037fa867f98145bf7e5a5cd73
MD5 ba9e487f64847c967acae727e3bf70d7
SHA1 7962d47f6afbd846a9772f78df094df54415765c
SHA512 01bd0df3cb7cce8da35ec0285491159a318880a912c51f3375914bdb20145de3f88e8faca66a302c0ee3727d6a60784a7cb7623d7d62d871e3ba22cda3a0353d
SSDEEP 6144:1flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:1flfAsiVGjSGecvX
TLSH
T13D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcausmkec.sys

Path C:\Temp\kfcausmkec.sys
Size 293KB
SHA256 2d8968ce6b946fd38148707d53b12e541afe4ad08348f63fc4c0e3a7579fef44
MD5 65606edcd2145837d81e433f43a46bb4
SHA1 5629b6e710bd1cca512434dfcdff67c853ad3aa3
SHA512 dfe0946801238648cb6bd95e91af1f7ee999f840c72533969dfcc4d59452f4f760ba25ea5f8b026b4f052d84d3fb8a5a7f41e2e30b667fcf922e0f99632fe262
SSDEEP 3072:3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:3IJjiJcbI03GBc3ucY5DCSj
TLSH
T10A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kifdxvqnig.sys

Path C:\Temp\kifdxvqnig.sys
Size 293KB
SHA256 e784e039ce7b251636fff075abca499b817aec0da7ebfc6d5e508e0c627aebda
MD5 8fc5b560f9d59b57299e3766722d678b
SHA1 11572f9e7a98ad222d66a18f19828c6d8bda4f8b
SHA512 262c0b23e2b6786f1e26e80bb979a19826b63852cf1dc473744cb2c02e9d467ec01801adafde76cad6d14618cdef999d285d4c6e4849bc6113dd1b6f2dd637de
SSDEEP 3072:QtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:QIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidaysqkig.exe

Path C:\Temp\lidaysqkig.exe
Size 361KB
SHA256 27d76ba1279d02d311e732b10d087d38e7d5daff40a6355fbf51ebe4666de2f7
MD5 9f1d3ca8db50698ff6cad6a7a15fe232
SHA1 1dfce9ab4c11bc19684ba2b720db03c93a506ce0
SHA512 fb5b49522e29696254b3634de2c67e16495ef48a0fab225ba0ab5fa784a7075e4412f1e859a3f857c9e692068c39ad7ba015eb1cd2360eb4edbfc731c78c766c
SSDEEP 6144:GflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:GflfAsiVGjSGecvX
TLSH
T144747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgebwtomg.exe

Path C:\Temp\omgebwtomg.exe
Size 361KB
SHA256 3bdd868c04ea7e484473a4dc8c224116ec1f1f0c7408d980a1f684036d2f3c5b
MD5 d1c61c3a541cdf1cca03306091c1df36
SHA1 3630a0aec49c25f5524c04b14eace84c52860e40
SHA512 3bf4a84543219cf0db7199ac55cc0075051c878eb86cd207f10fbb3f5c466c147e4f3916127ac8c1e1ae77d1cdbad215e3d37265c828681490418ccc8c4c201b
SSDEEP 6144:JflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:JflfAsiVGjSGecvX
TLSH
T189747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfzxspkh.exe

Path C:\Temp\pnhfzxspkh.exe
Size 361KB
SHA256 b04f602e8215767b51f77d05c424f294421dfcc198f3dcec054be63402b7c55b
MD5 5c7e89b035b3c23594169b90719ae0fb
SHA1 fa9fbd36eae623c0046c194f1737287ad549bcd3
SHA512 de1cf6fcb93f21d5da9d43262fb8db20238c4d83c69ab5ae44c70c487e59d0a53c9d0f54724e789b5a1312e4fef89765ec1d4d8814f47e76396ccae95d6661c6
SSDEEP 6144:NflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:NflfAsiVGjSGecvX
TLSH
T155747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlidbvtnl.exe

Path C:\Temp\tnlidbvtnl.exe
Size 361KB
SHA256 73ed05e6d8721b8523294e2f87526a30eacc2346897e3a1d7ca40ebc9f707d80
MD5 dc6bc16e6c618db4556c8ae51d4fa8c9
SHA1 54b0812629b32bb7720b4d4f804991e477c03a52
SHA512 d76151f9b00af21b7e4101ebde023b2236e8a7656b5f12454f55a9b2d9ecbec7450715d070dd2c12530bb7fd691b65a855f3a8f0051029a30926cbe68f1ef1b1
SSDEEP 6144:RflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:RflfAsiVGjSGecvX
TLSH
T1BA747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnhfzxspk.exe

Path C:\Temp\vpnhfzxspk.exe
Size 361KB
SHA256 17831c85179e568932271217cb254637857ada6c29c53498a59997e457bb0639
MD5 e25206864053b87caf57c7d20033cf50
SHA1 3774047a809ea755cec4e271b06fdcd675f3dbb7
SHA512 d92952674e5a06927083b7572e27e9eccb04f2640c65908b7b640aca7982ec504f403d13b3faf93510d124da81df64074913c8d424124f3f42120870e5353ec2
SSDEEP 6144:eflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:eflfAsiVGjSGecvX
TLSH
T15D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnhfzxspk.sys

Path C:\Temp\vpnhfzxspk.sys
Size 293KB
SHA256 3ce20eeeaf87b3b8d2e3c8aa05c26a0a6342b142495c02f69c050c81425d20f9
MD5 49d8ee50a22ba966272ea6ab04529ce0
SHA1 45be0dbb8bf6e5d5b9a352818d91e413a73390de
SHA512 2b3d16b4543ec7d8b941817ed1a6096d63b7fcd3f67f5d1f7d6923018a2822f6c4ad6d33b8a0682ba473ba64633aa0c5d35789aca1456f7f2767fbeb91d97796
SSDEEP 3072:8tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:8IJjiJcbI03GBc3ucY5DCSj
TLSH
T18F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdyvqn.sys

Path C:\Temp\vtnlfdyvqn.sys
Size 293KB
SHA256 fcdb46257609012f4739b7e96e769920d3257d1971196c02fa17d931d1a36221
MD5 8d47d69e3652bc46dc0f8528cdf2b309
SHA1 3ab277e519a4acbf98e192c0a96ab9f5889fb883
SHA512 7392bd2c824a1237780a09c6313b99954f77bf8f49fa4e48ccb5b8cfc651bba5e7177fb73af89a572e8f219c4654e7ab4f0972c300b22b05adca9f0cb9829b9a
SSDEEP 3072:JtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:JIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 0aae4bf456f4a707fda6335fccdfd18ef4ce2b5102314eae8047fa3aed2b3ebc
MD5 c5c756530e56a1bd8283157004b20207
SHA1 0006c1399f64c7dc7ec528091534ffb34f30555c
SHA512 08b3e3a85c711ac50daa8abcb11d5f8979092c443fe7198a24592dec063e06c6fc562aee8f1b62e45340249741688cb5fdc27a8e280fc66d6935e2ad169f32d5
TLSH
T1145163D4872FDBD2E72456BE25E148CA36709E572A07AB3113BA62B65CC2F4D34F0214
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c039.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c039.TMP
Size 2KB
SHA256 8c4f90f386807d8b0486e42e7a7c39a241495e55425ad0df1e958939a09b4429
MD5 f410d1afeacb45fc39b696cb7f311082
SHA1 aa55fd134fab384777d1100d0d7e047a6c2bc65d
SHA512 0fc0ea47b8fd2c4a7d8e8f0edc837bebfb7cb206ee1fae1a30b903fc74751a34ca4d3809d928aa27ee267ab44ebefaf986cbf5e774e4196e2cafd82d0eb5a4f3
TLSH
T1E65163D4872FDBD2E72456BE25E148CA36709E57290BAB3113BA52B65CC2F0D34F0214
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0ba0d0a4d26c905c5f419ceb0e4cae341d803d853868d1a34a472f7ee089c7c8
MD5 d02388fac2b5669b245e39a8c9077db0
SHA1 6effffdd168e437a03521a18048b472ee8aa5a20
SHA512 ce7c8ef6122b800a43e0d4c12065f457719bb05a92223c7397b4c9a18f42a16e292df555222f8fa7c02a99244848a3d94640e7bfb4e4e2629321d8a483d4002e
TLSH
T1A8518CF3C3E8856E890156F0AB186E1BCE2D0955832C7D5AC9E4AF1FA3E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 286574bece11a49b5fb7d7fefbaf79c454d906b2a18cc56658e5af39a57206e6
MD5 a928b36680b19f6d2d86be90556929d7
SHA1 82a3acd58f2ae56d304675b51041fc90f5e292bc
SHA512 4541f9aee96d91ef66f9d1df9ccb031c7aa5f56345f1d6699e19f2f73da693e35eb1aa9cb7dbeef52716949a55b7ab806c82befee58c2177ca95e95066afdb54
SSDEEP 192:sxRTBR4CS5/fnsDd6Cp/8tDzoA8p9z/g6+WNCPA/YZ78KsPGMIgVmJ:sxRFx0/fnsDdxpUtyd/57/9dY
TLSH
T1FA42A6167968993B9CC7D21DFB657F53E2F95032A1D15E48ABFC8A0C04E76CD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6ba73eaf9a61ca49c7d23afaf1888f6eb3238bbda972e2c3665654a25fc6a00d
MD5 640c246dff65dc03edfb9258bc801a84
SHA1 b61e14803676156370cd0d8b6ba660f7b21bb2d1
SHA512 63fc3d5c85c70a0b895f4f17772118ac4a5c8650e000cdaf25d4a7722c61e6feb0615f3702d13fc91c1faf324d5ce86694bb45368539653168908b6026a36714
SSDEEP 192:sxRCBR4CS5/fns/d6Cp/8tDzoA8p9z/g6+WNCPA/YZ78KsPGMIgDxmJ:sxROx0/fns/dxpUtyd/57/9dI
TLSH
T18542B6166968993B9CC7D21DFB657F93E2F95022A1D15E48ABFC8B0C04E76CD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 66fd7de478e0887ded9f8e55f4897cb64c24ac65623774f520abdc0d5baded54
MD5 6480a975cf32f10497e7daa7e22a5c58
SHA1 b6a0d192b974405f471a45ff18ff15e9cfbed7ad
SHA512 98b6554646d818ad808a41b32eea0053942f4738b0d17169a63e157c78969043bef76a87b56fbcb618e24d819c8937f6d51212590738d999fd4f4572f683bb29
SSDEEP 192:sxRCBR4CS5/fns/d6CVbZztDzoA8p9z/g6+WNCPA/YZ78XsPGMIgDbmJ:sxROx0/fns/dxVVztyd/57/YdK
TLSH
T10F42A7166D28993B9CC7D21DBB657F93E2F95022A1D15E48ABFC8B0C05E76CD2213C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 2cfbaf91ff96353865641124fd7c2bc105e0c414d0f1790af5dfcc8f6f2b992b
MD5 d794238814b9c659bc907d34de4ec984
SHA1 ae4f21dd8879e8c8f4cf79f95cdd16f8160a205e
SHA512 039477f398c5c0f81b27ade7e05e754fc899a9c3272161a603b4fc5c898bf9a613876f4a0e7d8b7973d1359f39381a0e95e402407e2ddfe404eef023b7886b11
SSDEEP 768:ky2SoS7pLuL7evWgd5f/b8F1+UoAYDCx9Tuqh0VfUC9xbog/OVE6uSV40ro7+k:ky2SoqE7evWgd5f/bu1jar6uU4fqk
TLSH
T1A6D2DA3B640DCB7F4F804ADDAC197E9E6DA802CB96D8C98047FA951C03C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac9449b0-b355-49e9-821f-3eb6a82a27ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ac9449b0-b355-49e9-821f-3eb6a82a27ad.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 1f28be5c7625d52446125fad8c92913f6bf9252691a2f7efe66fe72272df0ad0
MD5 4f6979792a7947aca5435fc4b34434d3
SHA1 e123e89065941598609f490a53554f1960d1c32f
SHA512 af438508f0d58e65ccede2b4913257809c088ef7b4acbac7fbbe5867bfa4151d08c98984379ac250074c3319b53d2b3b3aa72423272ec499d4948826ac07823c
SSDEEP 768:/rv+4UNbdq3+3q8AAam6aQMGdjWca4GhfBVPeU/:/bsbc3EKmaME6p9H
TLSH
T171F2AE31A87C9973DDB79A99F21B6687BEB421A384D40E80DAD91B0D439708E3307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 526a0e6d3746d3508776a5798a95123b16942dfd025b36f182f7ba4064781a94
MD5 900195c97b5225d4e8f1e9c046de4716
SHA1 66e15bd4e7771b41bc811702753573bd210e4bd9
SHA512 622ef963f7da85413c60b58180185b0cc9385e450ff9f91be2ed562327c1af5dae09ff97dc6ec844e86b8e3f7c4c8979ea2bb4eb0ab8b021321f61ee0cd73567
SSDEEP 768:fj+9C34xrHKqLYAam6aQMGdjWca4Ghf91lOl:S9C38zymaME6p1y
TLSH
T1FED29D316869DD779CE69695F22B37C3BDB012B388C41E44D9D96F0D029728E270BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 740a9828ddb22abb54351de991b45f8503659c297168d3a3990a92036f8db38f
MD5 781f4cec31029b22514006ea1c9d4497
SHA1 7d8476eda79392a9f7f8f5c27d80f4d2de1c943b
SHA512 57ded09440256137e9e76a563768462f1b52dbb59268455bfafdbec06493c2ca844be80309ec2c5b63f9b7afd1528ae68040facad84dab7ff2c6575394ac0bc2
SSDEEP 768:2F1j+9934wgWxrJK0Aam6aQMGdjWca4Ghf91lOl:D993HVmaME6p1y
TLSH
T12F03F7F598D78937D8AE4797A33E2E86A9BCC16374885984F7C45E0CCD821BFD207816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 df641deaa25f06af4e3976d63254afa09ca9164c68a4cf01b13f401c630a10fd
MD5 8c7f803c6f0358454ec6a8b168d72b97
SHA1 61afa2c9887fe73fd46cf2635fc9f4dd101cc47e
SHA512 1276196828e447a51f9f9eacefe6e9cd82e6617d7d202ee163b546e13eba9910a3acb9621cd5f0ec5a0fc732efda1c23f85efd61d8216d624487ba976ee833a2
SSDEEP 768:Xj+9C3nxrlKqLHAam6aQMGdjWca4Ghf91lOl:a9C3xxhmaME6p1y
TLSH
T1A5D29D316869DD779CE69695F22B37C3BDB011B388C81E44D9D9AF0D029728E270BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4616_1870413723\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/560-383-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/972-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/972-279-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1744-267-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1912-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2232-478-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2532-474-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2604-371-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2756-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2844-433-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2844-411-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2900-338-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3228-415-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3256-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3384-188-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3712-495-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4188-436-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4200-342-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4780-447-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4780-469-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4916-239-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5072-300-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5596-452-0x0000000000010000-0x00000000000AB000-memory.dmp

Download