systex | 73bb1bf2b071518ffea401d8e17c90acddbba5e05e16c38199fb4efab1e8a3c6

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 01:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260720-byr1nsd161
SHA256 73bb1bf2b071518ffea401d8e17c90acddbba5e05e16c38199fb4efab1e8a3c6
MD5 481fd01e96c8d59e77c7d013c9dd9654
SHA1 5615ef074468f7b9b1c71a3a9cff46158f79e822
SHA512 19b93ce5b587a5673d60a946d2e420499cbabfbc437370be2d9a7a522d146bb5c81b8e0f7285702c670c05ea925dbd90ce4ccd8785dec3c6d56b7163996734ff
SSDEEP 6144:QflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:QflfAsiVGjSGecvX
TLSH
T16B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5532	trljdbvtrljdbytq.exe
3636	trljdbvtrljdbytq.sys
3208	CreateProcess.exe
956	bwtgdyvtnl.exe
2788	CreateProcess.exe
1032	CreateProcess.exe
3040	i_bwtgdyvtnl.exe
4752	gaytqljday.sys
668	CreateProcess.exe
2112	vtqligaysq.exe
4724	CreateProcess.exe
5548	CreateProcess.exe
1224	i_vtqligaysq.exe
5824	snlfdxvtqk.sys
52	CreateProcess.exe
3248	sqnigayspn.exe
2104	CreateProcess.exe
5412	CreateProcess.exe
2564	i_sqnigayspn.exe
1188	qkifzxvpnk.sys
5848	CreateProcess.exe
2400	pnhfzxspkh.exe
5908	CreateProcess.exe
2520	CreateProcess.exe
2120	i_pnhfzxspkh.exe
4640	smkfcausqk.sys
2176	CreateProcess.exe
4852	hecauspjhc.exe
1532	CreateProcess.exe
4868	CreateProcess.exe
2544	i_hecauspjhc.exe
4400	pnheczxrpm.sys
4280	CreateProcess.exe
1452	pnhezxrpkh.exe
3348	CreateProcess.exe
2064	CreateProcess.exe
464	i_pnhezxrpkh.exe
3500	ojhbzurmke.sys
3984	CreateProcess.exe
2808	gecwuomjhb.exe
5992	CreateProcess.exe
4648	CreateProcess.exe
4884	i_gecwuomjhb.exe
3084	geywqoljeb.sys
3928	CreateProcess.exe
5652	jheywtoljg.exe
5252	CreateProcess.exe
4236	CreateProcess.exe
5808	i_jheywtoljg.exe
5092	wuomgeywqo.sys
260	CreateProcess.exe
5576	bwtolgeywq.exe
5488	CreateProcess.exe
1728	CreateProcess.exe
3948	i_bwtolgeywq.exe
1564	aytqljdbvt.sys
3268	CreateProcess.exe
2516	tqoigaytql.exe
3084	CreateProcess.exe
5788	CreateProcess.exe
5588	i_tqoigaytql.exe
2668	tnkidayvqo.sys
3128	CreateProcess.exe
3416	nlidavtnlf.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_1730339673\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_167339769\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_167339769\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_167339769\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_1738660056\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_611451656\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_611451656\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_1730339673\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_167339769\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtolgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxuspnhfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxuspnhfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicavsnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbvtrljdbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnkeczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqligaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hecauspjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsqnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwuomgezwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqnigayspn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhezxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jheywtoljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlidavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnkeczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwuomgezwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoifdyvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoifdyvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtgdyvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqligaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jheywtoljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlidavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsqnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtgdyvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqnigayspn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hecauspjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gecwuomjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtolgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhezxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gecwuomjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2784	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3104	ipconfig.exe
4756	ipconfig.exe
3124	ipconfig.exe
2868	ipconfig.exe
3192	ipconfig.exe
4628	ipconfig.exe
1432	ipconfig.exe
5664	ipconfig.exe
6100	ipconfig.exe
4108	ipconfig.exe
2136	ipconfig.exe
2068	ipconfig.exe
4612	ipconfig.exe
3900	ipconfig.exe
5096	ipconfig.exe
3636	ipconfig.exe
4940	ipconfig.exe
5644	ipconfig.exe
2100	ipconfig.exe
2704	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289848210884863"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{99E7FA4D-2FE6-49A9-AD7C-21F4840E0F28}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5532	trljdbvtrljdbytq.exe
5532	trljdbvtrljdbytq.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5532	trljdbvtrljdbytq.exe
5532	trljdbvtrljdbytq.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5532	trljdbvtrljdbytq.exe
5532	trljdbvtrljdbytq.exe
5532	trljdbvtrljdbytq.exe
5532	trljdbvtrljdbytq.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3040	i_bwtgdyvtnl.exe
Token: SeDebugPrivilege	1224	i_vtqligaysq.exe
Token: SeDebugPrivilege	2564	i_sqnigayspn.exe
Token: SeDebugPrivilege	2120	i_pnhfzxspkh.exe
Token: SeDebugPrivilege	2544	i_hecauspjhc.exe
Token: SeDebugPrivilege	464	i_pnhezxrpkh.exe
Token: SeDebugPrivilege	4884	i_gecwuomjhb.exe
Token: SeDebugPrivilege	5808	i_jheywtoljg.exe
Token: SeDebugPrivilege	3948	i_bwtolgeywq.exe
Token: SeDebugPrivilege	5588	i_tqoigaytql.exe
Token: SeDebugPrivilege	1732	i_nlidavtnlf.exe
Token: SeDebugPrivilege	1512	i_faxsqnifay.exe
Token: SeDebugPrivilege	2120	i_cxuspnhfcx.exe
Token: SeDebugPrivilege	4564	i_pnkeczusmk.exe
Token: SeDebugPrivilege	3444	i_wuomkecwuo.exe
Token: SeDebugPrivilege	4208	i_zwuomgezwu.exe
Token: SeDebugPrivilege	2532	i_ztrljdbvto.exe
Token: SeDebugPrivilege	5092	i_vtolgeywqo.exe
Token: SeDebugPrivilege	5012	i_qoifdyvtnl.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4616	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5596 wrote to memory of 5532	5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 5596 wrote to memory of 4672	5596	2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	91
PID 4672 wrote to memory of 4616	4672	iexplore.exe	92
PID 4616 wrote to memory of 2180	4616	msedge.exe	93
PID 4616 wrote to memory of 2856	4616	msedge.exe	95
PID 4616 wrote to memory of 2784	4616	msedge.exe	96
PID 4616 wrote to memory of 2856	4616	msedge.exe	95
PID 4616 wrote to memory of 2856	4616	msedge.exe	95
PID 4616 wrote to memory of 4076	4616	msedge.exe	97
PID 4616 wrote to memory of 4076	4616	msedge.exe	97
PID 4616 wrote to memory of 2752	4616	msedge.exe	98
PID 4616 wrote to memory of 2752	4616	msedge.exe	98
PID 4616 wrote to memory of 2752	4616	msedge.exe	98
PID 4616 wrote to memory of 5236	4616	msedge.exe	99
PID 4616 wrote to memory of 5236	4616	msedge.exe	99
PID 4616 wrote to memory of 5236	4616	msedge.exe	99
PID 4616 wrote to memory of 5380	4616	msedge.exe	100
PID 4616 wrote to memory of 4608	4616	msedge.exe	101
PID 4616 wrote to memory of 5380	4616	msedge.exe	100
PID 4616 wrote to memory of 5380	4616	msedge.exe	100
PID 4616 wrote to memory of 4608	4616	msedge.exe	101
PID 4616 wrote to memory of 4608	4616	msedge.exe	101
PID 4616 wrote to memory of 2460	4616	msedge.exe	102
PID 4616 wrote to memory of 2460	4616	msedge.exe	102
PID 5532 wrote to memory of 3208	5532	trljdbvtrljdbytq.exe	106
PID 4616 wrote to memory of 5228	4616	msedge.exe	109
PID 4616 wrote to memory of 4708	4616	msedge.exe	110
PID 4616 wrote to memory of 5228	4616	msedge.exe	109
PID 4616 wrote to memory of 4708	4616	msedge.exe	110
PID 956 wrote to memory of 2788	956	bwtgdyvtnl.exe	111
PID 4616 wrote to memory of 4600	4616	msedge.exe	115
PID 4616 wrote to memory of 6024	4616	msedge.exe	116
PID 4616 wrote to memory of 6024	4616	msedge.exe	116
PID 4616 wrote to memory of 3776	4616	msedge.exe	117
PID 4616 wrote to memory of 3776	4616	msedge.exe	117
PID 5532 wrote to memory of 1032	5532	trljdbvtrljdbytq.exe	120
PID 5532 wrote to memory of 668	5532	trljdbvtrljdbytq.exe	124
PID 2112 wrote to memory of 4724	2112	vtqligaysq.exe	126
PID 5532 wrote to memory of 5548	5532	trljdbvtrljdbytq.exe	129
PID 5532 wrote to memory of 52	5532	trljdbvtrljdbytq.exe	133
PID 3248 wrote to memory of 2104	3248	sqnigayspn.exe	135
PID 5532 wrote to memory of 5412	5532	trljdbvtrljdbytq.exe	138
PID 5532 wrote to memory of 5848	5532	trljdbvtrljdbytq.exe	142
PID 2400 wrote to memory of 5908	2400	pnhfzxspkh.exe	145
PID 5532 wrote to memory of 2520	5532	trljdbvtrljdbytq.exe	148
PID 4616 wrote to memory of 5936	4616	msedge.exe	150
PID 4616 wrote to memory of 5588	4616	msedge.exe	151
PID 4616 wrote to memory of 5132	4616	msedge.exe	152
PID 5532 wrote to memory of 2176	5532	trljdbvtrljdbytq.exe	155
PID 4852 wrote to memory of 1532	4852	hecauspjhc.exe	157
PID 5532 wrote to memory of 4868	5532	trljdbvtrljdbytq.exe	160
PID 5532 wrote to memory of 4280	5532	trljdbvtrljdbytq.exe	164
PID 1452 wrote to memory of 3348	1452	pnhezxrpkh.exe	166
PID 5532 wrote to memory of 2064	5532	trljdbvtrljdbytq.exe	169
PID 5532 wrote to memory of 3984	5532	trljdbvtrljdbytq.exe	173
PID 2808 wrote to memory of 5992	2808	gecwuomjhb.exe	175
PID 5532 wrote to memory of 4648	5532	trljdbvtrljdbytq.exe	178
PID 5532 wrote to memory of 3928	5532	trljdbvtrljdbytq.exe	182
PID 5652 wrote to memory of 5252	5652	jheywtoljg.exe	184
PID 5532 wrote to memory of 4236	5532	trljdbvtrljdbytq.exe	187
PID 4616 wrote to memory of 1932	4616	msedge.exe	189
PID 4616 wrote to memory of 1932	4616	msedge.exe	189
PID 5532 wrote to memory of 260	5532	trljdbvtrljdbytq.exe	195
PID 5576 wrote to memory of 5488	5576	bwtolgeywq.exe	197

C:\Users\Admin\AppData\Local\Temp\2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_481fd01e96c8d59e77c7d013c9dd9654_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5596
- C:\Temp\trljdbvtrljdbytq.exe
  C:\Temp\trljdbvtrljdbytq.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtgdyvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3208
  - - C:\Temp\bwtgdyvtnl.exe
      C:\Temp\bwtgdyvtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:956
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2788
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwtgdyvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1032
  - - C:\Temp\i_bwtgdyvtnl.exe
      C:\Temp\i_bwtgdyvtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtqligaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:668
  - - C:\Temp\vtqligaysq.exe
      C:\Temp\vtqligaysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2112
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4724
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtqligaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5548
  - - C:\Temp\i_vtqligaysq.exe
      C:\Temp\i_vtqligaysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1224
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqnigayspn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:52
  - - C:\Temp\sqnigayspn.exe
      C:\Temp\sqnigayspn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2104
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqnigayspn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5412
  - - C:\Temp\i_sqnigayspn.exe
      C:\Temp\i_sqnigayspn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfzxspkh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5848
  - - C:\Temp\pnhfzxspkh.exe
      C:\Temp\pnhfzxspkh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2400
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5908
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3636
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfzxspkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2520
  - - C:\Temp\i_pnhfzxspkh.exe
      C:\Temp\i_pnhfzxspkh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hecauspjhc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2176
  - - C:\Temp\hecauspjhc.exe
      C:\Temp\hecauspjhc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4852
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1532
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hecauspjhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4868
  - - C:\Temp\i_hecauspjhc.exe
      C:\Temp\i_hecauspjhc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhezxrpkh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4280
  - - C:\Temp\pnhezxrpkh.exe
      C:\Temp\pnhezxrpkh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1452
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3348
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhezxrpkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2064
  - - C:\Temp\i_pnhezxrpkh.exe
      C:\Temp\i_pnhezxrpkh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gecwuomjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3984
  - - C:\Temp\gecwuomjhb.exe
      C:\Temp\gecwuomjhb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2808
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5992
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gecwuomjhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4648
  - - C:\Temp\i_gecwuomjhb.exe
      C:\Temp\i_gecwuomjhb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jheywtoljg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3928
  - - C:\Temp\jheywtoljg.exe
      C:\Temp\jheywtoljg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5652
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5252
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jheywtoljg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4236
  - - C:\Temp\i_jheywtoljg.exe
      C:\Temp\i_jheywtoljg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtolgeywq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:260
  - - C:\Temp\bwtolgeywq.exe
      C:\Temp\bwtolgeywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5576
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5488
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwtolgeywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1728
  - - C:\Temp\i_bwtolgeywq.exe
      C:\Temp\i_bwtolgeywq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqoigaytql.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3268
  - - C:\Temp\tqoigaytql.exe
      C:\Temp\tqoigaytql.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2516
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3084
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqoigaytql.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5788
  - - C:\Temp\i_tqoigaytql.exe
      C:\Temp\i_tqoigaytql.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlidavtnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3128
  - - C:\Temp\nlidavtnlf.exe
      C:\Temp\nlidavtnlf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3416
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2540
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlidavtnlf.exe ups_ins
    3⤵
    PID:5260
  - - C:\Temp\i_nlidavtnlf.exe
      C:\Temp\i_nlidavtnlf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faxsqnifay.exe ups_run
    3⤵
    PID:5924
  - - C:\Temp\faxsqnifay.exe
      C:\Temp\faxsqnifay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5636
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2692
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faxsqnifay.exe ups_ins
    3⤵
    PID:2708
  - - C:\Temp\i_faxsqnifay.exe
      C:\Temp\i_faxsqnifay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxuspnhfcx.exe ups_run
    3⤵
    PID:4540
  - - C:\Temp\cxuspnhfcx.exe
      C:\Temp\cxuspnhfcx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1764
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5580
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxuspnhfcx.exe ups_ins
    3⤵
    PID:5700
  - - C:\Temp\i_cxuspnhfcx.exe
      C:\Temp\i_cxuspnhfcx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnkeczusmk.exe ups_run
    3⤵
    PID:1736
  - - C:\Temp\pnkeczusmk.exe
      C:\Temp\pnkeczusmk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4180
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnkeczusmk.exe ups_ins
    3⤵
    PID:4888
  - - C:\Temp\i_pnkeczusmk.exe
      C:\Temp\i_pnkeczusmk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomkecwuo.exe ups_run
    3⤵
    PID:3192
  - - C:\Temp\wuomkecwuo.exe
      C:\Temp\wuomkecwuo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6072
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5808
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomkecwuo.exe ups_ins
    3⤵
    PID:3632
  - - C:\Temp\i_wuomkecwuo.exe
      C:\Temp\i_wuomkecwuo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwuomgezwu.exe ups_run
    3⤵
    PID:3948
  - - C:\Temp\zwuomgezwu.exe
      C:\Temp\zwuomgezwu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6012
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4108
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwuomgezwu.exe ups_ins
    3⤵
    PID:4140
  - - C:\Temp\i_zwuomgezwu.exe
      C:\Temp\i_zwuomgezwu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrljdbvto.exe ups_run
    3⤵
    PID:5080
  - - C:\Temp\ztrljdbvto.exe
      C:\Temp\ztrljdbvto.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5492
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4220
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrljdbvto.exe ups_ins
    3⤵
    PID:5964
  - - C:\Temp\i_ztrljdbvto.exe
      C:\Temp\i_ztrljdbvto.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtolgeywqo.exe ups_run
    3⤵
    PID:5396
  - - C:\Temp\vtolgeywqo.exe
      C:\Temp\vtolgeywqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5052
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1264
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtolgeywqo.exe ups_ins
    3⤵
    PID:5512
  - - C:\Temp\i_vtolgeywqo.exe
      C:\Temp\i_vtolgeywqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoifdyvtnl.exe ups_run
    3⤵
    PID:1336
  - - C:\Temp\qoifdyvtnl.exe
      C:\Temp\qoifdyvtnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2752
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoifdyvtnl.exe ups_ins
    3⤵
    PID:464
  - - C:\Temp\i_qoifdyvtnl.exe
      C:\Temp\i_qoifdyvtnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5012
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkicavsnkf.exe ups_run
    3⤵
    PID:4660
  - - C:\Temp\qkicavsnkf.exe
      C:\Temp\qkicavsnkf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4604
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5112
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3900
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x31c,0x7ffa4631c188,0x7ffa4631c194,0x7ffa4631c1a0
      4⤵
      PID:2180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2000,i,3038426527724945069,339150187433081078,262144 --field-trial-handle=2528,i,5865235338397895338,9419713161381815323,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:2
      4⤵
      PID:2856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,6880173235774015345,5858740594779322344,524288 --field-trial-handle=2528,i,5865235338397895338,9419713161381815323,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:11
      4⤵
      System Time Discovery
      PID:2784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2688,i,16910555856944326800,2565150321692199115,524288 --field-trial-handle=2528,i,5865235338397895338,9419713161381815323,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:13
      4⤵
      PID:4076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,3590804686393750950,16826471076208277340,2097152 --field-trial-handle=2528,i,5865235338397895338,9419713161381815323,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:2752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,11979505094458897546,15666011622706489937,2097152 --field-trial-handle=2528,i,5865235338397895338,9419713161381815323,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,2076052668886064250,1791831479820846617,2097152 --field-trial-handle=2528,i,5865235338397895338,9419713161381815323,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:1
      4⤵
      PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,2751552887428917474,11231295492418538301,2097152 --field-trial-handle=2528,i,5865235338397895338,9419713161381815323,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:9
      4⤵
      PID:4608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,3385324141046796735,957027195590489652,524288 --field-trial-handle=2528,i,5865235338397895338,9419713161381815323,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
      4⤵
      PID:2460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,10851373048008362609,10302314043286311288,524288 --field-trial-handle=2528,i,5865235338397895338,9419713161381815323,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:5228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,12578994856855598798,12427936613420285333,524288 --field-trial-handle=2528,i,5865235338397895338,9419713161381815323,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,6991197339717833677,10727911498803978498,524288 --field-trial-handle=2528,i,5865235338397895338,9419713161381815323,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
      4⤵
      PID:3268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,6991197339717833677,10727911498803978498,524288 --field-trial-handle=2528,i,5865235338397895338,9419713161381815323,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,17144995368947659396,17014754213822659557,524288 --field-trial-handle=2528,i,5865235338397895338,9419713161381815323,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:6024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,196214603477451738,15960377454747159417,524288 --field-trial-handle=2528,i,5865235338397895338,9419713161381815323,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
      4⤵
      PID:3776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,5355071711155918411,2012700341969595526,524288 --field-trial-handle=2528,i,5865235338397895338,9419713161381815323,262144 --variations-seed-version --mojo-platform-channel-handle=1304 /prefetch:14
      4⤵
      PID:5936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,17777025564304397158,9792909794446373421,524288 --field-trial-handle=2528,i,5865235338397895338,9419713161381815323,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:14
      4⤵
      PID:5588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,8468362885413043299,7230310596697144737,524288 --field-trial-handle=2528,i,5865235338397895338,9419713161381815323,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:14
      4⤵
      PID:5132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,10180272383008025652,6118942420914081939,524288 --field-trial-handle=2528,i,5865235338397895338,9419713161381815323,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
      4⤵
      PID:1932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,16276779270705519234,4053229650630468161,524288 --field-trial-handle=2528,i,5865235338397895338,9419713161381815323,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
      4⤵
      PID:2896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,11091030493632442640,15001149771767695293,524288 --field-trial-handle=2528,i,5865235338397895338,9419713161381815323,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
      4⤵
      PID:4116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,12141423202260625306,17740661745857192066,524288 --field-trial-handle=2528,i,5865235338397895338,9419713161381815323,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:14
      4⤵
      PID:6036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,4151837839899792334,15755967958037350637,524288 --field-trial-handle=2528,i,5865235338397895338,9419713161381815323,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:14
      4⤵
      PID:4872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6928,i,16310428170508480065,1508062673643766465,262144 --field-trial-handle=2528,i,5865235338397895338,9419713161381815323,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:10
      4⤵
      PID:4584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,1732871758170991364,1291351885088645844,524288 --field-trial-handle=2528,i,5865235338397895338,9419713161381815323,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
      4⤵
      PID:2420

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1688

C:\Temp\trljdbvtrljdbytq.sys
C:\Temp\trljdbvtrljdbytq.sys
1⤵
- Executes dropped EXE
PID:3636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4528

C:\Temp\gaytqljday.sys
C:\Temp\gaytqljday.sys
1⤵
- Executes dropped EXE
PID:4752

C:\Temp\snlfdxvtqk.sys
C:\Temp\snlfdxvtqk.sys
1⤵
- Executes dropped EXE
PID:5824

C:\Temp\qkifzxvpnk.sys
C:\Temp\qkifzxvpnk.sys
1⤵
- Executes dropped EXE
PID:1188

C:\Temp\smkfcausqk.sys
C:\Temp\smkfcausqk.sys
1⤵
- Executes dropped EXE
PID:4640

C:\Temp\pnheczxrpm.sys
C:\Temp\pnheczxrpm.sys
1⤵
- Executes dropped EXE
PID:4400

C:\Temp\ojhbzurmke.sys
C:\Temp\ojhbzurmke.sys
1⤵
- Executes dropped EXE
PID:3500

C:\Temp\geywqoljeb.sys
C:\Temp\geywqoljeb.sys
1⤵
- Executes dropped EXE
PID:3084

C:\Temp\wuomgeywqo.sys
C:\Temp\wuomgeywqo.sys
1⤵
- Executes dropped EXE
PID:5092

C:\Temp\aytqljdbvt.sys
C:\Temp\aytqljdbvt.sys
1⤵
- Executes dropped EXE
PID:1564

C:\Temp\tnkidayvqo.sys
C:\Temp\tnkidayvqo.sys
1⤵
- Executes dropped EXE
PID:2668

C:\Temp\icayvpnifa.sys
C:\Temp\icayvpnifa.sys
1⤵
PID:5408

C:\Temp\kfcxvpnkfc.sys
C:\Temp\kfcxvpnkfc.sys
1⤵
PID:5644

C:\Temp\pnhfcxusmk.sys
C:\Temp\pnhfcxusmk.sys
1⤵
PID:2980

C:\Temp\zxrpjhbzxr.sys
C:\Temp\zxrpjhbzxr.sys
1⤵
PID:4880

C:\Temp\ztrljebwur.sys
C:\Temp\ztrljebwur.sys
1⤵
PID:1364

C:\Temp\jhbztrojgb.sys
C:\Temp\jhbztrojgb.sys
1⤵
PID:4632

C:\Temp\vtolgdbvtr.sys
C:\Temp\vtolgdbvtr.sys
1⤵
PID:900

C:\Temp\qoljdbvtnl.sys
C:\Temp\qoljdbvtnl.sys
1⤵
PID:2016

C:\Temp\vtnlfdxvqn.sys
C:\Temp\vtnlfdxvqn.sys
1⤵
PID:4208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bwtgdyvtnl.exe

Path C:\Temp\bwtgdyvtnl.exe
Size 361KB
SHA256 6d6d8f6fd039515bd1ca9a7684a487e9edd9417697bf9f6faf2d607ff12a1ecb
MD5 e6bfb0d277198359f4c07f9937566c0e
SHA1 26887e05a966e9b4d68348b938d88539206b667d
SHA512 45b19e547d0706d3777234145321f0ecff34825defa3031254bc949d4f9ae8705db395af0ef36c8634479bccc33a730716618319f1787535bd01562f184aa2b6
SSDEEP 6144:sflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:sflfAsiVGjSGecvX
TLSH
T167747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaytqljday.sys

Path C:\Temp\gaytqljday.sys
Size 293KB
SHA256 f5bdf08d75e6c1392cd464244ad72c26e0c4b47826b05da0db17950467d1d737
MD5 301356f6b2c9b5152a58bd5bee016f71
SHA1 222c355d263925f329613c81a9d95397a96d90bd
SHA512 f97229425814b48e2cd3e6a65e8e4f8f768f9ce1344243baf78c1db4172128d3f0b278f798fbf087a51fc0e3169bcd88eec639c33ce6d28e246909028417d5cf
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T168545B44AAA4B0F6D9D5043C00EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hecauspjhc.exe

Path C:\Temp\hecauspjhc.exe
Size 361KB
SHA256 0446bfffaebdb4a19dfb3f34a0691152d66087edc6cc9017f9c3bcca12f5f34e
MD5 82add2e64ccae6deeb1a6b46b1f658f3
SHA1 638179daa246dda895313066d824202ba1138c19
SHA512 fa2085d7a4ef4704a37d3d762a04212f7aa1f98b9691ec1517c11c100252e0b50dd7ec7c36c2f229e89b9240b5199a9fedc6421ca7cd584f37ac6c5c1e21f67b
SSDEEP 6144:jflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:jflfAsiVGjSGecvX
TLSH
T1ED747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bwtgdyvtnl.exe

Path C:\Temp\i_bwtgdyvtnl.exe
Size 361KB
SHA256 332bb8332a82f001b59671a3e0106377d037cc666777078007ee691b29c58d71
MD5 d839dd1929ddada6e779bd02300fbaa4
SHA1 59dc25c3cd71b66f8fb92fab2a9f5dc14b2db005
SHA512 ad88a7ce0f056de34e327c15f16a9c9cf7267dd1ce9665cbf70f529b43d13d2eae535b42b55f1de5e3d13d0dab564d1c86532bccce5c7a596748bc4d6287e9b5
SSDEEP 6144:HflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:HflfAsiVGjSGecvX
TLSH
T1E7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hecauspjhc.exe

Path C:\Temp\i_hecauspjhc.exe
Size 361KB
SHA256 df553e873c2fa25c172d8d3f7170d5d372ef96c01020568dde9b9b057e04376d
MD5 ac3987d97ea9cf4f46ccae8035d5a6d9
SHA1 0575c89d8697a4049c11f69159297b9290826f4f
SHA512 74c76366e7032407f21be30b386b93737856fc60a18a69dff3512d38932f48be641d6f49712638956471f7979bdf65d5c1ff365470cfcb2c68710311ce498b22
SSDEEP 6144:8flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:8flfAsiVGjSGecvX
TLSH
T145747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnhezxrpkh.exe

Path C:\Temp\i_pnhezxrpkh.exe
Size 361KB
SHA256 e74779afaa55c1e4561b9bde2dfca8089bcab2d4ac7b07aef39376f7ad525dd8
MD5 678f892060d444ab5048112e65cd800a
SHA1 d98b7bb32d5dfc2130e6f371288806edcdf4ea74
SHA512 2f18c1881a4041266f34929517723faf489db630143e45b62358375a409ee9251ff05727d53aa671e1966ca2ff4f64cd54110d81c95f752b793c25d5fabe7ff0
SSDEEP 6144:XflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:XflfAsiVGjSGecvX
TLSH
T170747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnhfzxspkh.exe

Path C:\Temp\i_pnhfzxspkh.exe
Size 361KB
SHA256 4ed360a760d297d33c539544376fa5e17e0ccbed309e635dee651d738ca4eee8
MD5 146ce980893f4c33d4415054cfdc0afe
SHA1 b24acc6543019e626eb50e9f7a0aca7670d4fce5
SHA512 710647ea810f882530a6875425c3c91c9d6b4df1f9baaba5d6c7008844ac0f9f1973d7f27393fd47701092154abcae94e388fb93754ae58c229926ac2784b536
SSDEEP 6144:aflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:aflfAsiVGjSGecvX
TLSH
T12C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqnigayspn.exe

Path C:\Temp\i_sqnigayspn.exe
Size 361KB
SHA256 385f0b88786d74b0db9e7830fdabc4da27ccf2c3d323ec17427d3aa3cd46dce2
MD5 6d3215b890d8aaed1302c07b7d447390
SHA1 5e14b600c05af9df08a4b8a43b0c415388a0d54b
SHA512 188405f5eb9f2009d7f30cbc0244780145e2112813e25f9a2b29f8f75ef559046fbf5d44b4133ab691ff6b141b5c2c7e5c22e6ae4e2d7f0bc8b8d342f4cded29
SSDEEP 6144:RflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:RflfAsiVGjSGecvX
TLSH
T1D6747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtqligaysq.exe

Path C:\Temp\i_vtqligaysq.exe
Size 361KB
SHA256 861bcf80c64308d43d386833c7f0216d1d75f14f6fee8bbeeccf3e27611ce3c7
MD5 bbb50eb8e4e2f31d14386a073aa7eabd
SHA1 45abda1d06217df9efe3ebcc1ae81d21563d07aa
SHA512 7cce647cf0c79acd20a30bfd295b9c98004184b697032c1b98c4fa1b0664ba2551b11400cb4107e8946bb96494fe9f41db0f4c3f00146e57eee06da5b54a4a8e
SSDEEP 6144:JflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:JflfAsiVGjSGecvX
TLSH
T15B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnheczxrpm.sys

Path C:\Temp\pnheczxrpm.sys
Size 293KB
SHA256 e45b6f08332cccb608b51c67f462a7c09e690a487cc08482422d4eb3b08aea6b
MD5 6695bb041fb872418eb707d1f03194e8
SHA1 9b229cc44f1b07bd7f791a4b70a8c2ae582f46b2
SHA512 404190255175ce8a4e7578baf59d6146f785880cd96503a2cdb0094bfe38b9aab057c826a6bdbe16902ae8f9bd8ff65e100231fdcd95988ad80998820d52b38b
SSDEEP 3072:KtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:KIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhezxrpkh.exe

Path C:\Temp\pnhezxrpkh.exe
Size 361KB
SHA256 2ace31c59b82b5eee0bdc1792a6969cce2b492f659aae8c5d8f132061ef72fff
MD5 6e52614d062e17beb4e907908956c156
SHA1 f670a3adb5c314af11a4dfa9176dff112ea1e2c3
SHA512 23291312e4d7bdeb85156f1554be89aa7adb1b9f1fd07effe5bbabfe02b697c2a75d31784177428678099fbaffa4ca23bc90f73a9d11c781335656bac975716f
SSDEEP 6144:IflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:IflfAsiVGjSGecvX
TLSH
T15D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfzxspkh.exe

Path C:\Temp\pnhfzxspkh.exe
Size 361KB
SHA256 aea96d9140dd28d0356636ddf1977f7cc72f4f4abec47e7da11e73d303c4c439
MD5 7d7e93a9ae74323950589de085b96e2e
SHA1 30d936481ddfb8cdee940e2dfabc6da528e693e1
SHA512 fd03804e2290a31f351cb89db04028da109bf25ef2c74b67436e7050415f116e3fad1cc10fd7c0844d2c673845e559ad981ca66f35475bd1fbc5159910a5028c
SSDEEP 6144:UflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:UflfAsiVGjSGecvX
TLSH
T19E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkifzxvpnk.sys

Path C:\Temp\qkifzxvpnk.sys
Size 293KB
SHA256 a65dfbe5a29506120d783007ffbd987270b4b8c00fc8b1b604d461f2e47a165e
MD5 b42ba02d92e3659f76c4fe659699edbd
SHA1 21564fcf3bae660691617c8a68f4d1998ae03509
SHA512 4f14e66081b18d4b51da6fb0e0abb4a706ad795b89ba0a5a85a74c8af51f196f0039b6029b1718a25d661ef9a33c51a53d9e85c3be4cacceb5ebe946d109b5ce
SSDEEP 3072:MtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:MIJjiJcbI03GBc3ucY5DCSj
TLSH
T176545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkfcausqk.sys

Path C:\Temp\smkfcausqk.sys
Size 293KB
SHA256 5b96096ab0303c1c7a85dfa160e01fb4656c6a998d91d589265cfde018124cd8
MD5 39b1cf819e2a026bbb6cd1e3d3ec7d08
SHA1 9651661dd20c1a8fe1eb3f325cbc999970cecd84
SHA512 b3f732e265aba6e5395e34777f968246422cd295a636b69d30fddcd938d0b095abb6818d3d8249950ace98c5cfeb5070aead1a2f184440af954309a4a879c647
SSDEEP 3072:vtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:vIJjiJcbI03GBc3ucY5DCSj
TLSH
T130545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snlfdxvtqk.sys

Path C:\Temp\snlfdxvtqk.sys
Size 293KB
SHA256 18e32e790bb26104c5a303aef66fe3a48571c0894fcfd90ccaf96c05c3cb59b0
MD5 012fa26a5f98dde23fe882f0df3153cc
SHA1 4afb7af3e186e6a8cc3b213b36d59064fdcdf9dd
SHA512 3d60559fc49db46ad49d2747ea3a58efb32e2c5738d699a1be14fdd17bbb610e1d86f54c8368895903cb34f71b63f901abdbc563e4177476e5edaeea70a08444
SSDEEP 3072:2tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:2IJjiJcbI03GBc3ucY5DCSj
TLSH
T1D1545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqnigayspn.exe

Path C:\Temp\sqnigayspn.exe
Size 361KB
SHA256 f66bd4bffa05eafd59f2b34d900d391db9d559f86f6bd57c3791f04c96e2b293
MD5 d55631d08c3eb8a7640c5fd09df9c2fb
SHA1 ac0af8aaa21924343a064eb7c9ea69bd8c34fd3a
SHA512 82234193d6bc2645430c940310d753aeca1e21fa905de57fc99a450aa3d8f0066a69d01e2c570c8ad10ee090c2a8bd2310aff309aa0e826c4d9379338eb234eb
SSDEEP 6144:JflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:JflfAsiVGjSGecvX
TLSH
T1D9747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbvtrljdbytq.exe

Path C:\Temp\trljdbvtrljdbytq.exe
Size 361KB
SHA256 cf45b9f0b9b4d6a8a7d6e8986becd5d3ebb527ac4782adbcd9c118f1fd982aa9
MD5 a368e2793543527534b424525e824568
SHA1 b951aa03ed110f0998a6505be8b20b0b251c0fd1
SHA512 06e4cd34a48ea71ae55a96475392ad7271965ceff07ada9c35eb713c1f8eebe27f55c56325b32b7a6b4658da4658c45614ed11e1107fb9dbd7064b15c3849e89
SSDEEP 6144:DflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:DflfAsiVGjSGecvX
TLSH
T187747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbvtrljdbytq.sys

Path C:\Temp\trljdbvtrljdbytq.sys
Size 293KB
SHA256 681003239568f31b5fcbd8984010a419cfc753adaa40ecdac246ac69f65caa59
MD5 11e2c301aad627456afacd6a06ee8adf
SHA1 18a41c4f6b409f4e6f68b377a274dae7156053f4
SHA512 ad00dd9c7552194d78d5048222988cebdcefd1755df025d27e8d21e41378a4290d8fa43d7ea7251a39005cbd7f2ab1fc7500d5560814308402dfa25b27a08328
SSDEEP 3072:FtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:FIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtqligaysq.exe

Path C:\Temp\vtqligaysq.exe
Size 361KB
SHA256 125e8a35ac09aec08c19bae2a491084ab29670e1137e1bdc9bc0f6f9c3b984f4
MD5 015f936fab0b38185f5551c2e40dd79a
SHA1 1d724604ef1ed81cc44f9e71a25f8861f7acf0ba
SHA512 d551a6bd56e15e3eb8b577ed726204ff9163263668dcea12182aa79083cc76ea3feac49b7105af868bc7ae09ea312caef1382f42a73935d6d2c374944c095f89
SSDEEP 6144:YflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:YflfAsiVGjSGecvX
TLSH
T14E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 166fa3dc89de1a5232c055d929ef0d034fe632dbfbcc8d11355cbf577df45c3c
MD5 113c86678774681e15a51dc86337687d
SHA1 caf29f928e48affed25902cf3ca5397cb741a07b
SHA512 7fd5b55a6c7846a4540bd3daa80c0e2fd90471eb1759220076d414918f32ea8ed9e636e9974652f7c406cd13e53377d31edf2c7732c38a41d54fd9db9081af83
TLSH
T1BBE0209404C4C6FDD105658B82B5930C8190370A92C8AA4E270D8C497043480F7BA5F4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 66408f9e586084f02317a989c9d63a096a5986802ae9b0da40b7177dc3fddd1d
MD5 91fd25cab986ff668d2e8738ed0f32d1
SHA1 dfe25f6ab616de1c2be2072dbeccb55cb6ccc86a
SHA512 41b7cf3b6a404f17eb7cd1a50c5e585bf5d7f50c7d33e238f58ee33f183c466c4a4df70a444f3b619ee3949a0b6ff7d24db65500d3258d25ab0a22b1ffff2819
TLSH
T1904193125BB2CAD6DBA244F693D367A9F2F5C4090E17AE30C25CAC302582FE771C001B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d42504585a800189207d41c6431c1bb083ac72575740d24d684f3c0b96e316e9
MD5 7cd82b37d9ca2e2bf254462494b23e7f
SHA1 abf3c8f4026d1fe11124988a63594c6f0fd824fb
SHA512 9704335c5e84611f814239a81cc83f8aaaabb86dfc6b25b585db796b03aaa93d08c547ea353cc5b79b77232a97b34358055c0c126ff60821416fe53bc1e40c32
TLSH
T1BC41DEF3C3E8866E890156F0AB187E2BCE1D0914832C3D5AC9E4AF1B93F2471E14295F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3136d0b21000157e4753dc83455438ea835b0fae11cfb0c0d22543808a2f9118
MD5 aaa73f0815477b4740ba3636c0c5b0ef
SHA1 be7a73bc05b39904f9bc7189dce45aae4cca136a
SHA512 264c313c64e2496eb09bd75d9c91360ca78d4a6e387a81123093f9a42c8f5cbe1e7f13e7b23a0f20cfb400f72e3b7354a8e7bcb1be089aeb98221227a4ff3801
SSDEEP 192:sxRjRxCJ/frs2hk25ZsRzoA8p9c/g6+WNCcT/YohCYrGxgIgtJ:sxRjiJ/frs2hk2XsM+/5p/Ew3
TLSH
T12532A5166A28AD3B5CC7D21DBA65BF93D6F95032A1E51E48F7FC8B0C04E66DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 eac98bd8eef1269fdfcf0046fe29455aba95fac4351aedacf0809ee8524c099d
MD5 b75a3ac07c000618469fd506a94fd20e
SHA1 a7c6ed88d7da1b3f71bb4d7253c47a6c3081cf9f
SHA512 07370233d4769a9a7579cf93cb9ba73953690a0b5ca50dc48c8ed354adcf101eabd508ceeb62fe7ad06270a27a9d54641d5454e1356da096cf9cfd3c7dec0666
SSDEEP 192:sxRARxCJ/frsxhk25ZsRzoA8p9c/g6+WNCcT/YohCYrGxgIgDDJ:sxRAiJ/frsxhk2XsM+/5p/EwZ
TLSH
T1C042A6166E28AD3B5CC7D21DBA65BF93D6F95032A1E51E48B7FC870C04E66DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b88fefb7568ef9e743bfdb926c9911a68840ba8d7ff8670131fdab500276b9ea
MD5 5a010f02a500e3403615e18345727d8a
SHA1 318d898e8df1ad250ae617d298a0a103fb419634
SHA512 13646bf2c885f30d1fdbe97d279f54aa2c267a7d43e3f56ca202d92c56dc0d916783194af2b90699b9b6da89777c1ee13b52d5ae0bb74eaa13264d8b5105c9c8
SSDEEP 192:sxRARxCJ/frsxhka5ZsRzoA8p9c/g6+WNCcT/YosCYrGxgIgDJJ:sxRAiJ/frsxhkaXsM+/5p/7w3
TLSH
T1A242A6166E289D3B5CC7E21DBA56BF93D6F95032A1E51E48B7FC8B0C04E66DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 f8e33efd98f664ef8e569e72af92a290a5d31a9550e36aa361f7ae7c9028bc3b
MD5 c1da9ef00870aab349e4c413dbd9a2ae
SHA1 c74814eb8921497807addc478c8ca41323a2e369
SHA512 d6a2e1ea5a32f793df7a1cc29d2e61c66fd77e3a851d649d54822580c23d94c0fd8be18808dbd2af5df1fe079a7f4fddb48fe4c375f4aad74a93729a7f05c26b
SSDEEP 768:j26HRo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVCGBVuwOro93e07:j26HRUE7MRWgs2f02u1japGB4wF2s
TLSH
T1B6D2DB7B640DCBBF4F804ADDEC197E9F6D6802CB9698CD8047FE851C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 43e2cd1adf9b6cbd3d127ce4b0c8cceb9762892135f7bdefc53c8451da17b121
MD5 8d8105afe68df7b53ccb248f559fd785
SHA1 6b3dfa03e021062b075b4d482674a6f2b32893f2
SHA512 3ae054cf9c2de2d0af8047f1ff5441f2079cf6cf5c654fb23ac7dff47996f0e5ca40095bb9fe7796f5261e196d04fcb6ba9422ca61b3cbca56159c40e326dfc8
SSDEEP 96:KREEEFEwE0EOEyE2EUWESE/EfgE8EUK4ERgE2EUcE0E0E/EuEUEJHGbqGAoouWYk:C3gFB31lERe1JDggH2vHG5FaHGbqGAoK
TLSH
T17591091471BA0290387E694894F5A85B83D2B8D33415E92B77D812FA0F6BD13CDFC9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a6708.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a6708.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1dde53f6edc8c4718560d8e6a0f8776ce4dc191f27c4b6a13c068858ef21adb4
MD5 f4eef334b987c5733806f939a04e32e7
SHA1 4698dcf8658e05dedc1304a5e61753f709f4b270
SHA512 fa1266a81b9d0f76283d60c214510bad1e38b60d6a0b06a0104e76825c245700df40678ed33c3cf0e7d7db78510fb9ae8eb7c57561e442dcd42ec85a3cbc598b
SSDEEP 768:hrv+4UNbdz3gz/TBOWCutsONXyer1IRCzniB5eVH1SK7:hbsbV3AySIqnSEH1l
TLSH
T1E903CF36A4A89E338DE2A3C6B14773037FB86057C6840790EDDA2F4E069B59D130F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0c7747e63de832ed720dbf72a9a1b5530251107c1ba9c19978d188a9fcbc532c
MD5 353f64e2bfd4622552eb7fc2dfae5542
SHA1 4f9c8758a1817916771b27a8308ade1d17977d58
SHA512 4d65500f505eda0a595d366c10f3439caa9ca8bf80bca75aae79c124c331a15f0723d90015f26debd95d5c6666e60cd8ac112813a5b792a2a3f1ae11eac43435
SSDEEP 768:Qj+9S3EcFzMI/TBOWCuttwONXyer1IRCzni9zb9Mv:v9S3/PcSIqnYb+v
TLSH
T174F2AE35A4659E234CD2A3D6B1473797BFF8207BC5C50F44EEEA5F4E0583A6D130A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 04364aabd023d3433c91b4c277fa2463b49b4cd1e436dbaa8f2ec9bf9e3605e3
MD5 8d7a2cddabc76e20e032e3b1fcdf0611
SHA1 d7eab65bf09a89db28f3d9a4efbaef56758ac0e7
SHA512 f4e72c4f8d53127b1dd969e5bf3a25dd637a41aa3f61e353ecf3a0141d13938bf18bae78f595fc9ed58798ca96ce90298ef2e432227d7dd292f8d5c5bc0c2f9c
SSDEEP 768:BF1j+9H3E/wg8FhMrxsOWCuttUONXyer1IRCzni9zb9Mv:A9H3PwRSIqnYb+v
TLSH
T1D21317F594D78A37D89E5383733D2E86AABCD067B5844984BBD55E4CCC825BFC30A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f42bbc07da34ff768db7351fa6fed70b178717ec0338fc15d0658a7677694827
MD5 772461286470dfd6da034ae7743f769b
SHA1 61ccdd609fbe86711ace01c07b51d91448c4a6c0
SHA512 c69986fce67659afbec28e978e52336303d5bba5b00039eb0ebb400ef138c7553e526f39562e893f77e075d4fa5f0e1a890288a2badab14877db35dd2dbf5b98
SSDEEP 768:Vj+9S3EjFoMI/TBOWCuttwONXyer1IRCzni9zb9Mv:g9S3ZPcSIqnYb+v
TLSH
T172F2AF35A4959E234CD2A3D6B1473797BFF4207BC5C50F44EEEA5F4E0583A6D130A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

acdfa6f7-a0d3-4722-801f-ec8a8ca99405.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\acdfa6f7-a0d3-4722-801f-ec8a8ca99405.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4616_403498264\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 9165959d614c48b7079c7d02ba0cb6f5b2cc8406eca8a8da9471334ae4571836
MD5 3d56968d7f0fa43fa40ea5492ac9acf0
SHA1 b255961e4a82c43acfb5df9c3cdc90a0209897d6
SHA512 16a30cf1b5a227e7efe0e906085db1eea125aba476fd4030042db280be0d3f0c667c26b9fc790558824e7191e51ae4243b132e9c789d3e114ff784c0131572e9
TLSH
T17071008356E9E6B2C1DE5BF012835204F1BB223C476320240BA15586EA70A7A64B8F05
MD5 SHA1 SHA512 TLSH

Submit Download

memory/900-464-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1188-256-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1364-439-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1564-335-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2016-468-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2668-364-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2980-408-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3084-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3500-313-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3636-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4208-485-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4400-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4632-444-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4640-268-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4752-184-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4880-428-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5092-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5408-384-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5644-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5824-231-0x0000000000010000-0x00000000000AB000-memory.dmp

Download