systex | 5e0442831dec114b03fe6daceb7eeae209de197119a7e22144573acb58c71b10

Analysis

max time kernel
81s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 20:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260813-y5jdfaxtes
SHA256 5e0442831dec114b03fe6daceb7eeae209de197119a7e22144573acb58c71b10
MD5 8fe60d4504245b8707c8dd5908a1b6a2
SHA1 717de8845a5fa7d9ed740c8c84d8e4c318108ec1
SHA512 6e3e6379c83fdf8816c7f8f91a7c6dcb507171b81446639c12276f959ad0eeb6640557f64f02fc71411a6c62831d4483f93957dbf4b652115f3958f1e48f5dd9
SSDEEP 6144:3flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:3flfAsiVGjSGecvX
TLSH
T15B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4588	sqkicavtnlfdxvsn.exe
4468	sqkicavtnlfdxvsn.sys
1484	CreateProcess.exe
3032	ysqkicavqk.exe
932	CreateProcess.exe
5976	CreateProcess.exe
4396	i_ysqkicavqk.exe
3124	nkidavtnlf.sys
3636	CreateProcess.exe
2664	causpkhcax.exe
748	CreateProcess.exe
668	CreateProcess.exe
4296	i_causpkhcax.exe
5824	smkicausmk.sys
5816	CreateProcess.exe
1416	smkfcaxsmc.exe
460	CreateProcess.exe
3052	CreateProcess.exe
4324	i_smkfcaxsmc.exe
4612	urpkhczxrp.sys
1228	CreateProcess.exe
3180	rpjhczxrpk.exe
5748	CreateProcess.exe
1396	CreateProcess.exe
2500	i_rpjhczxrpk.exe
912	zurmjecwuo.sys
5292	CreateProcess.exe
4364	urmjebztrm.exe
6060	CreateProcess.exe
1324	CreateProcess.exe
3728	i_urmjebztrm.exe
3360	cztrmjebzw.sys
4688	CreateProcess.exe
5244	rojgebwtro.exe
5656	CreateProcess.exe
4612	CreateProcess.exe
3516	i_rojgebwtro.exe
4100	gebztomgey.sys
4896	CreateProcess.exe
1140	jhbztrljeb.exe
924	CreateProcess.exe
4396	CreateProcess.exe
1372	i_jhbztrljeb.exe
4308	qoigaywqol.sys
1536	CreateProcess.exe
4260	qligbytrlj.exe
6040	CreateProcess.exe
4880	CreateProcess.exe
2384	i_qligbytrlj.exe
3000	sqoigaysqn.sys
2420	CreateProcess.exe
5000	qoidaytqli.exe
4924	CreateProcess.exe
4064	CreateProcess.exe
1016	i_qoidaytqli.exe
5964	sqkidavtql.sys
5400	CreateProcess.exe
4856	faysqkicau.exe
5640	CreateProcess.exe
1772	CreateProcess.exe
5464	i_faysqkicau.exe
2200	hfaxspkica.sys
2752	CreateProcess.exe
1868	kifaxspnki.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojgebwtro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qligbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkicavqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhczxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmjebztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojgebwtro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qligbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoidaytqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkicavqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkfcaxsmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkfcaxsmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoidaytqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faysqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faysqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causpkhcax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhczxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifaxspnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicavtnlfdxvsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causpkhcax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmjebztrm.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
824	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4932	ipconfig.exe
944	ipconfig.exe
4932	ipconfig.exe
4820	ipconfig.exe
2452	ipconfig.exe
4704	ipconfig.exe
2440	ipconfig.exe
3700	ipconfig.exe
1056	ipconfig.exe
1644	ipconfig.exe
2916	ipconfig.exe
4564	ipconfig.exe
5308	ipconfig.exe
2316	ipconfig.exe
5872	ipconfig.exe
3260	ipconfig.exe
4368	ipconfig.exe
2228	ipconfig.exe
780	ipconfig.exe
6032	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311261351561809"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{E8DF28E4-1175-401F-9925-2EE7F6A3D7F0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4588	sqkicavtnlfdxvsn.exe
4588	sqkicavtnlfdxvsn.exe
4588	sqkicavtnlfdxvsn.exe
4588	sqkicavtnlfdxvsn.exe
4588	sqkicavtnlfdxvsn.exe
4588	sqkicavtnlfdxvsn.exe
4588	sqkicavtnlfdxvsn.exe
4588	sqkicavtnlfdxvsn.exe
4588	sqkicavtnlfdxvsn.exe
4588	sqkicavtnlfdxvsn.exe
4588	sqkicavtnlfdxvsn.exe
4588	sqkicavtnlfdxvsn.exe
4588	sqkicavtnlfdxvsn.exe
4588	sqkicavtnlfdxvsn.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Suspicious behavior: LoadsDriver 11 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4396	i_ysqkicavqk.exe
Token: SeDebugPrivilege	4296	i_causpkhcax.exe
Token: SeDebugPrivilege	4324	i_smkfcaxsmc.exe
Token: SeDebugPrivilege	2500	i_rpjhczxrpk.exe
Token: SeDebugPrivilege	3728	i_urmjebztrm.exe
Token: SeDebugPrivilege	3516	i_rojgebwtro.exe
Token: SeDebugPrivilege	1372	i_jhbztrljeb.exe
Token: SeDebugPrivilege	2384	i_qligbytrlj.exe
Token: SeDebugPrivilege	1016	i_qoidaytqli.exe
Token: SeDebugPrivilege	5464	i_faysqkicau.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1288	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6080 wrote to memory of 4588	6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 6080 wrote to memory of 4876	6080	2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4876 wrote to memory of 1288	4876	iexplore.exe	90
PID 1288 wrote to memory of 3432	1288	msedge.exe	91
PID 1288 wrote to memory of 5364	1288	msedge.exe	92
PID 1288 wrote to memory of 824	1288	msedge.exe	93
PID 1288 wrote to memory of 5364	1288	msedge.exe	92
PID 1288 wrote to memory of 5364	1288	msedge.exe	92
PID 1288 wrote to memory of 1116	1288	msedge.exe	95
PID 1288 wrote to memory of 1116	1288	msedge.exe	95
PID 1288 wrote to memory of 5980	1288	msedge.exe	96
PID 1288 wrote to memory of 4376	1288	msedge.exe	97
PID 1288 wrote to memory of 5980	1288	msedge.exe	96
PID 1288 wrote to memory of 5980	1288	msedge.exe	96
PID 1288 wrote to memory of 4376	1288	msedge.exe	97
PID 1288 wrote to memory of 4376	1288	msedge.exe	97
PID 1288 wrote to memory of 5724	1288	msedge.exe	98
PID 1288 wrote to memory of 2192	1288	msedge.exe	99
PID 1288 wrote to memory of 5724	1288	msedge.exe	98
PID 1288 wrote to memory of 5724	1288	msedge.exe	98
PID 1288 wrote to memory of 2192	1288	msedge.exe	99
PID 1288 wrote to memory of 2192	1288	msedge.exe	99
PID 1288 wrote to memory of 2448	1288	msedge.exe	100
PID 1288 wrote to memory of 2448	1288	msedge.exe	100
PID 4588 wrote to memory of 1484	4588	sqkicavtnlfdxvsn.exe	104
PID 1288 wrote to memory of 3468	1288	msedge.exe	105
PID 1288 wrote to memory of 2792	1288	msedge.exe	106
PID 1288 wrote to memory of 3468	1288	msedge.exe	105
PID 1288 wrote to memory of 2792	1288	msedge.exe	106
PID 3032 wrote to memory of 932	3032	ysqkicavqk.exe	109
PID 1288 wrote to memory of 3476	1288	msedge.exe	113
PID 1288 wrote to memory of 4580	1288	msedge.exe	114
PID 1288 wrote to memory of 4580	1288	msedge.exe	114
PID 1288 wrote to memory of 2784	1288	msedge.exe	116
PID 1288 wrote to memory of 2784	1288	msedge.exe	116
PID 4588 wrote to memory of 5976	4588	sqkicavtnlfdxvsn.exe	119
PID 4588 wrote to memory of 3636	4588	sqkicavtnlfdxvsn.exe	123
PID 2664 wrote to memory of 748	2664	causpkhcax.exe	125
PID 4588 wrote to memory of 668	4588	sqkicavtnlfdxvsn.exe	128
PID 4588 wrote to memory of 5816	4588	sqkicavtnlfdxvsn.exe	132
PID 1416 wrote to memory of 460	1416	smkfcaxsmc.exe	134
PID 4588 wrote to memory of 3052	4588	sqkicavtnlfdxvsn.exe	137
PID 4588 wrote to memory of 1228	4588	sqkicavtnlfdxvsn.exe	141
PID 3180 wrote to memory of 5748	3180	rpjhczxrpk.exe	144
PID 4588 wrote to memory of 1396	4588	sqkicavtnlfdxvsn.exe	147
PID 1288 wrote to memory of 5792	1288	msedge.exe	149
PID 1288 wrote to memory of 4932	1288	msedge.exe	184
PID 1288 wrote to memory of 2424	1288	msedge.exe	151
PID 4588 wrote to memory of 5292	4588	sqkicavtnlfdxvsn.exe	154
PID 4364 wrote to memory of 6060	4364	urmjebztrm.exe	156
PID 4588 wrote to memory of 1324	4588	sqkicavtnlfdxvsn.exe	159
PID 4588 wrote to memory of 4688	4588	sqkicavtnlfdxvsn.exe	163
PID 5244 wrote to memory of 5656	5244	rojgebwtro.exe	165
PID 4588 wrote to memory of 4612	4588	sqkicavtnlfdxvsn.exe	168
PID 4588 wrote to memory of 4896	4588	sqkicavtnlfdxvsn.exe	172
PID 1140 wrote to memory of 924	1140	jhbztrljeb.exe	174
PID 4588 wrote to memory of 4396	4588	sqkicavtnlfdxvsn.exe	177
PID 4588 wrote to memory of 1536	4588	sqkicavtnlfdxvsn.exe	181
PID 4260 wrote to memory of 6040	4260	qligbytrlj.exe	183
PID 4588 wrote to memory of 4880	4588	sqkicavtnlfdxvsn.exe	186
PID 1288 wrote to memory of 4648	1288	msedge.exe	188
PID 1288 wrote to memory of 4648	1288	msedge.exe	188
PID 4588 wrote to memory of 2420	4588	sqkicavtnlfdxvsn.exe	194
PID 5000 wrote to memory of 4924	5000	qoidaytqli.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_8fe60d4504245b8707c8dd5908a1b6a2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6080
- C:\Temp\sqkicavtnlfdxvsn.exe
  C:\Temp\sqkicavtnlfdxvsn.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqkicavqk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1484
  - - C:\Temp\ysqkicavqk.exe
      C:\Temp\ysqkicavqk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3032
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:932
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqkicavqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5976
  - - C:\Temp\i_ysqkicavqk.exe
      C:\Temp\i_ysqkicavqk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causpkhcax.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3636
  - - C:\Temp\causpkhcax.exe
      C:\Temp\causpkhcax.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2664
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:748
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causpkhcax.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:668
  - - C:\Temp\i_causpkhcax.exe
      C:\Temp\i_causpkhcax.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkfcaxsmc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5816
  - - C:\Temp\smkfcaxsmc.exe
      C:\Temp\smkfcaxsmc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1416
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:460
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkfcaxsmc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3052
  - - C:\Temp\i_smkfcaxsmc.exe
      C:\Temp\i_smkfcaxsmc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhczxrpk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1228
  - - C:\Temp\rpjhczxrpk.exe
      C:\Temp\rpjhczxrpk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3180
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5748
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhczxrpk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1396
  - - C:\Temp\i_rpjhczxrpk.exe
      C:\Temp\i_rpjhczxrpk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmjebztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5292
  - - C:\Temp\urmjebztrm.exe
      C:\Temp\urmjebztrm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4364
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6060
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmjebztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1324
  - - C:\Temp\i_urmjebztrm.exe
      C:\Temp\i_urmjebztrm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rojgebwtro.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4688
  - - C:\Temp\rojgebwtro.exe
      C:\Temp\rojgebwtro.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5244
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5656
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rojgebwtro.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4612
  - - C:\Temp\i_rojgebwtro.exe
      C:\Temp\i_rojgebwtro.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbztrljeb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4896
  - - C:\Temp\jhbztrljeb.exe
      C:\Temp\jhbztrljeb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1140
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:924
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbztrljeb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4396
  - - C:\Temp\i_jhbztrljeb.exe
      C:\Temp\i_jhbztrljeb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qligbytrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1536
  - - C:\Temp\qligbytrlj.exe
      C:\Temp\qligbytrlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4260
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6040
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qligbytrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4880
  - - C:\Temp\i_qligbytrlj.exe
      C:\Temp\i_qligbytrlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoidaytqli.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2420
  - - C:\Temp\qoidaytqli.exe
      C:\Temp\qoidaytqli.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5000
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4924
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoidaytqli.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4064
  - - C:\Temp\i_qoidaytqli.exe
      C:\Temp\i_qoidaytqli.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faysqkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5400
  - - C:\Temp\faysqkicau.exe
      C:\Temp\faysqkicau.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4856
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5640
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faysqkicau.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1772
  - - C:\Temp\i_faysqkicau.exe
      C:\Temp\i_faysqkicau.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kifaxspnki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2752
  - - C:\Temp\kifaxspnki.exe
      C:\Temp\kifaxspnki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1868
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5016
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kifaxspnki.exe ups_ins
    3⤵
    PID:4112
  - - C:\Temp\i_kifaxspnki.exe
      C:\Temp\i_kifaxspnki.exe ups_ins
      4⤵
      PID:3456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmhecxupnh.exe ups_run
    3⤵
    PID:5204
  - - C:\Temp\pmhecxupnh.exe
      C:\Temp\pmhecxupnh.exe ups_run
      4⤵
      PID:3420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmhecxupnh.exe ups_ins
    3⤵
    PID:2352
  - - C:\Temp\i_pmhecxupnh.exe
      C:\Temp\i_pmhecxupnh.exe ups_ins
      4⤵
      PID:4580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmheczuomk.exe ups_run
    3⤵
    PID:3160
  - - C:\Temp\pmheczuomk.exe
      C:\Temp\pmheczuomk.exe ups_run
      4⤵
      PID:2012
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4748
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmheczuomk.exe ups_ins
    3⤵
    PID:4572
  - - C:\Temp\i_pmheczuomk.exe
      C:\Temp\i_pmheczuomk.exe ups_ins
      4⤵
      PID:5084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmgeywrpjh.exe ups_run
    3⤵
    PID:1460
  - - C:\Temp\pmgeywrpjh.exe
      C:\Temp\pmgeywrpjh.exe ups_run
      4⤵
      PID:3096
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5864
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmgeywrpjh.exe ups_ins
    3⤵
    PID:3056
  - - C:\Temp\i_pmgeywrpjh.exe
      C:\Temp\i_pmgeywrpjh.exe ups_ins
      4⤵
      PID:4392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomgeywqol.exe ups_run
    3⤵
    PID:6104
  - - C:\Temp\uomgeywqol.exe
      C:\Temp\uomgeywqol.exe ups_run
      4⤵
      PID:2748
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomgeywqol.exe ups_ins
    3⤵
    PID:2944
  - - C:\Temp\i_uomgeywqol.exe
      C:\Temp\i_uomgeywqol.exe ups_ins
      4⤵
      PID:3496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljgbytro.exe ups_run
    3⤵
    PID:4440
  - - C:\Temp\trljgbytro.exe
      C:\Temp\trljgbytro.exe ups_run
      4⤵
      PID:4212
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4420
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljgbytro.exe ups_ins
    3⤵
    PID:4032
  - - C:\Temp\i_trljgbytro.exe
      C:\Temp\i_trljgbytro.exe ups_ins
      4⤵
      PID:1628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdyvqnlfd.exe ups_run
    3⤵
    PID:5056
  - - C:\Temp\lgdyvqnlfd.exe
      C:\Temp\lgdyvqnlfd.exe ups_run
      4⤵
      PID:3688
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1120
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgdyvqnlfd.exe ups_ins
    3⤵
    PID:1500
  - - C:\Temp\i_lgdyvqnlfd.exe
      C:\Temp\i_lgdyvqnlfd.exe ups_ins
      4⤵
      PID:944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nifaysqkic.exe ups_run
    3⤵
    PID:2684
  - - C:\Temp\nifaysqkic.exe
      C:\Temp\nifaysqkic.exe ups_run
      4⤵
      PID:6096
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2384
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nifaysqkic.exe ups_ins
    3⤵
    PID:4168
  - - C:\Temp\i_nifaysqkic.exe
      C:\Temp\i_nifaysqkic.exe ups_ins
      4⤵
      PID:3496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnhfaxvpni.exe ups_run
    3⤵
    PID:1380
  - - C:\Temp\qnhfaxvpni.exe
      C:\Temp\qnhfaxvpni.exe ups_run
      4⤵
      PID:5856
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1792
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnhfaxvpni.exe ups_ins
    3⤵
    PID:3844
  - - C:\Temp\i_qnhfaxvpni.exe
      C:\Temp\i_qnhfaxvpni.exe ups_ins
      4⤵
      PID:3288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnkfcxvsm.exe ups_run
    3⤵
    PID:6064
  - - C:\Temp\vpnkfcxvsm.exe
      C:\Temp\vpnkfcxvsm.exe ups_run
      4⤵
      PID:5916
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4308
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5872
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x30c,0x7ff90119c188,0x7ff90119c194,0x7ff90119c1a0
      4⤵
      PID:3432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,17775197624883443009,11544514798312402458,262144 --field-trial-handle=2320,i,608278807754998138,10963721746027727160,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
      4⤵
      PID:5364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,6177281631870993435,4086738711937623955,524288 --field-trial-handle=2320,i,608278807754998138,10963721746027727160,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:11
      4⤵
      System Time Discovery
      PID:824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,10812213823429687366,7351685516972911928,524288 --field-trial-handle=2320,i,608278807754998138,10963721746027727160,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:13
      4⤵
      PID:1116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,8251900036717290959,2983248915850451104,2097152 --field-trial-handle=2320,i,608278807754998138,10963721746027727160,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:5980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,9544493594647489690,1336201486788148310,2097152 --field-trial-handle=2320,i,608278807754998138,10963721746027727160,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:4376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,11811364191542888544,2582222468256534866,2097152 --field-trial-handle=2320,i,608278807754998138,10963721746027727160,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
      4⤵
      PID:5724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,13916274445994694569,6524975034700696610,2097152 --field-trial-handle=2320,i,608278807754998138,10963721746027727160,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:9
      4⤵
      PID:2192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,7217151938532184332,17513492744863999340,524288 --field-trial-handle=2320,i,608278807754998138,10963721746027727160,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
      4⤵
      PID:2448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,10139191297534195712,5714187076729712711,524288 --field-trial-handle=2320,i,608278807754998138,10963721746027727160,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
      4⤵
      PID:3468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,5395579154630886419,13482140903073006642,524288 --field-trial-handle=2320,i,608278807754998138,10963721746027727160,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:14
      4⤵
      PID:2792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,6832635139813415024,1516766773257106838,524288 --field-trial-handle=2320,i,608278807754998138,10963721746027727160,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:2280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,6832635139813415024,1516766773257106838,524288 --field-trial-handle=2320,i,608278807754998138,10963721746027727160,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:3476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,3623706315748901732,13579386979283950819,524288 --field-trial-handle=2320,i,608278807754998138,10963721746027727160,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
      4⤵
      PID:4580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,9068788385321679007,4706100817386300061,524288 --field-trial-handle=2320,i,608278807754998138,10963721746027727160,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
      4⤵
      PID:2784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,3957750067151350368,6981309228158983426,524288 --field-trial-handle=2320,i,608278807754998138,10963721746027727160,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
      4⤵
      PID:5792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,12920593477966915224,10284597752384039107,524288 --field-trial-handle=2320,i,608278807754998138,10963721746027727160,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
      4⤵
      PID:4932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,17389847494789131735,895396802674995233,524288 --field-trial-handle=2320,i,608278807754998138,10963721746027727160,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:14
      4⤵
      PID:2424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,10153030787834196246,2848843030643231251,524288 --field-trial-handle=2320,i,608278807754998138,10963721746027727160,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
      4⤵
      PID:4648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,8456103614148661746,581733891239618262,524288 --field-trial-handle=2320,i,608278807754998138,10963721746027727160,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
      4⤵
      PID:2860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5276,i,12431714701251750279,6510194562694104215,262144 --field-trial-handle=2320,i,608278807754998138,10963721746027727160,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:10
      4⤵
      PID:4428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,6799604827500549087,11315383972332912742,524288 --field-trial-handle=2320,i,608278807754998138,10963721746027727160,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
      4⤵
      PID:5468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2668

C:\Temp\sqkicavtnlfdxvsn.sys
C:\Temp\sqkicavtnlfdxvsn.sys
1⤵
- Executes dropped EXE
PID:4468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5972

C:\Temp\nkidavtnlf.sys
C:\Temp\nkidavtnlf.sys
1⤵
- Executes dropped EXE
PID:3124

C:\Temp\smkicausmk.sys
C:\Temp\smkicausmk.sys
1⤵
- Executes dropped EXE
PID:5824

C:\Temp\urpkhczxrp.sys
C:\Temp\urpkhczxrp.sys
1⤵
- Executes dropped EXE
PID:4612

C:\Temp\zurmjecwuo.sys
C:\Temp\zurmjecwuo.sys
1⤵
- Executes dropped EXE
PID:912

C:\Temp\cztrmjebzw.sys
C:\Temp\cztrmjebzw.sys
1⤵
- Executes dropped EXE
PID:3360

C:\Temp\gebztomgey.sys
C:\Temp\gebztomgey.sys
1⤵
- Executes dropped EXE
PID:4100

C:\Temp\qoigaywqol.sys
C:\Temp\qoigaywqol.sys
1⤵
- Executes dropped EXE
PID:4308

C:\Temp\sqoigaysqn.sys
C:\Temp\sqoigaysqn.sys
1⤵
- Executes dropped EXE
PID:3000

C:\Temp\sqkidavtql.sys
C:\Temp\sqkidavtql.sys
1⤵
- Executes dropped EXE
PID:5964

C:\Temp\hfaxspkica.sys
C:\Temp\hfaxspkica.sys
1⤵
- Executes dropped EXE
PID:2200

C:\Temp\spkhczxspk.sys
C:\Temp\spkhczxspk.sys
1⤵
PID:3176

C:\Temp\omhecwusmj.sys
C:\Temp\omhecwusmj.sys
1⤵
PID:4828

C:\Temp\zxrpjhezwr.sys
C:\Temp\zxrpjhezwr.sys
1⤵
PID:1372

C:\Temp\trljebwtrm.sys
C:\Temp\trljebwtrm.sys
1⤵
PID:2624

C:\Temp\tomgdbywqo.sys
C:\Temp\tomgdbywqo.sys
1⤵
PID:3416

C:\Temp\ytqgaywqoi.sys
C:\Temp\ytqgaywqoi.sys
1⤵
PID:3648

C:\Temp\xvqnifdysq.sys
C:\Temp\xvqnifdysq.sys
1⤵
PID:2624

C:\Temp\qkicaysqki.sys
C:\Temp\qkicaysqki.sys
1⤵
PID:3692

C:\Temp\spkicaxspk.sys
C:\Temp\spkicaxspk.sys
1⤵
PID:1760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

causpkhcax.exe

Path C:\Temp\causpkhcax.exe
Size 361KB
SHA256 d3284702e57ac1e4c6a818e0e122704766de22a69270afa2129dcc6ac682cc12
MD5 f156144ee7d3b57188c5e3737411d084
SHA1 87c6eba7b7e908ba47d3b058addf9588e476e068
SHA512 b6497be2628f60b7c0685e9d6e7c597a5f287b9b315dde0d4dc6b671c6e957a24ac19d80bc8b782fab4e15c87e2c79810a1b7dde095b794a58ff32425b596532
SSDEEP 6144:YflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:YflfAsiVGjSGecvX
TLSH
T129747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cztrmjebzw.sys

Path C:\Temp\cztrmjebzw.sys
Size 293KB
SHA256 552bcdecbdae4864b52a2826b5f7bb76792856a9f8822d0a3eb48c9745fa5ac0
MD5 e53dfddeb90d154a02ea46c23369b444
SHA1 f6ea9e38b0eb8b677a872902ded13476a6e5ce16
SHA512 00f311701935efc43ce8794e0719199502ec3550961406574df1d06fe0503295410ebc4c51e21951b347cc9c90f32d166c3b3206ffe5c71dd0a2552ee784f3b0
SSDEEP 3072:2tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:2IJjiJcbI03GBc3ucY5DCSj
TLSH
T103545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_causpkhcax.exe

Path C:\Temp\i_causpkhcax.exe
Size 361KB
SHA256 b13d1c0edfe9251c14c614c64f33f3a0913027d772cd179575c55178aba3e283
MD5 767c0a1f41dd20b18516d8828c5139bd
SHA1 0bf5a16bcb7895bae584ce8ceee65404d46191b5
SHA512 867628d8d427e3ab8d3f84bdaf3882cd36fe041d42970f6895a5e61568639ee6ead7a8df8830c9f7f7a4933b5a7152225e7af125bfb8079adb0ced1573159933
SSDEEP 6144:UflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:UflfAsiVGjSGecvX
TLSH
T1BC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpjhczxrpk.exe

Path C:\Temp\i_rpjhczxrpk.exe
Size 361KB
SHA256 dc3bf73c1b498ce3e0cc098c3f00a5bc92b91d4c7bb2e1402561ad4b7dc3c3d7
MD5 1985be6e11a9a3df37c4aba9b3b0a7ec
SHA1 10e480c12222137d80c40b65dad999dcdb83a8a2
SHA512 1dc11234924281ad7c6ab2876dba27d712daa9dc25ae7ef26735b11e4aef18bf5bea54f2a1fa85e6376991fe02221d1c32f9f33a51a429f03e3ddb56bc5e48fb
SSDEEP 6144:vflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:vflfAsiVGjSGecvX
TLSH
T198747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_smkfcaxsmc.exe

Path C:\Temp\i_smkfcaxsmc.exe
Size 361KB
SHA256 31cbb3fa39b2c35e50d7a9d2da2e7cdf4f5c960075c57d7b2225967e00556bcb
MD5 a39464fd7b6d1fdc79cbd179e9549049
SHA1 45a3f68fc0399169d0f0dfa53fbd01a8835e4c1a
SHA512 6bdc0872c8c62249d16a980bdc6d199619d482920579493c97fa00933c6897abf338f77607809b2a0668c9eade72818427feadc31e74d84468768b155560063f
SSDEEP 6144:KflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:KflfAsiVGjSGecvX
TLSH
T197747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urmjebztrm.exe

Path C:\Temp\i_urmjebztrm.exe
Size 361KB
SHA256 3dbb376e879a37567c44e5f118b37509678523f75082f92828eab5ad1f364570
MD5 a1c6554fd81c6e4ba686f9bf9e179e61
SHA1 8a5c9427127dfdd41404df41b33a56aecae8d8e5
SHA512 4b6e99bb32fc7e2625915c9e46cd83b14e85accfc3d7e583228a75b2b1c31ccff59009bb045bdcbda5ba22e248256dd89cea5a3a129be178d24fa1fd22a16960
SSDEEP 6144:NflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:NflfAsiVGjSGecvX
TLSH
T1C1747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqkicavqk.exe

Path C:\Temp\i_ysqkicavqk.exe
Size 361KB
SHA256 f5aeeae8ea870c13e5a920f92c0981f80226c714557c36ca9fdd25325d95ed58
MD5 8ff08d2af82b7f2c586a1830ef35c811
SHA1 4e338fa151b975084f7de439c432156fa0b68d2f
SHA512 bce900a7fe78834171cdb2882dcc2aab66c1da587b2daa54f1e03103e0208244322a5508dc4753e2c1e5fbc3ede54f4da22ffc0530797c7bf82a620ac38b410c
SSDEEP 6144:4flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:4flfAsiVGjSGecvX
TLSH
T16D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkidavtnlf.sys

Path C:\Temp\nkidavtnlf.sys
Size 293KB
SHA256 06438e3cb306cf89f700f2b418b59d6e40e5472605425b10e7493ed72affe847
MD5 3fcf3abc1d599ecd46f43bec2af3e4b1
SHA1 c22a635c14ae9ed929b8a3d8f3565b865b498645
SHA512 797ca4f0952329187d803550c3903623f3e3f4d953f3ae01f59e027b30420a49aaf6ad201415a4f107b8654cea1a49a889a8121e497a9a3f25eb45c16e71644f
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojgebwtro.exe

Path C:\Temp\rojgebwtro.exe
Size 361KB
SHA256 82f5f773b47ffdec418ebf8175e0ffa6b401107904ad2e99cd3e03baa1e3adb4
MD5 956beb791748a9c694767ccf9d67610c
SHA1 a9ac30e31c89599067b0c7d65ddc2fa31d216d93
SHA512 7c7b86672ca42bc5bfa50677f6606ed0088895d62e2500713304cb55fff0d5355ca0be2d3e2696feb1033966840c1feac16485513ca8ae488bbbc29b48b00460
SSDEEP 6144:qflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:qflfAsiVGjSGecvX
TLSH
T1FB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhczxrpk.exe

Path C:\Temp\rpjhczxrpk.exe
Size 361KB
SHA256 f386625fadf5c589a25c85566c3f7d0eb903a185b6b73c75f505b9910840dda9
MD5 f22565f433b6179232fc56423b5c5849
SHA1 7f220309397f542ca9f4511bbfcea5757a7fb475
SHA512 d3dbbc468a69d803d50babf6fe2b432333ad1b233f2c31f0eecb48a1cc06cb3e706e63efca2243c76432e7b19c6c2ff74186f1feafff3c29b98ff7899ebc980e
SSDEEP 6144:PflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:PflfAsiVGjSGecvX
TLSH
T116747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkfcaxsmc.exe

Path C:\Temp\smkfcaxsmc.exe
Size 361KB
SHA256 2b9bdc80e0f89ae1023adad3a92b8cb900c68dd4793956543da094a46bff3320
MD5 de64a22d8eddaf27be80ce72937c1d5a
SHA1 31da2f7625877ec9d9903b83a0f611a8fc89f68d
SHA512 68a14a47a1af82318675f07b2cc67cbc36518930071910cccae6f440e9ad0744a0345d1be6434bc866b5f690ec93810650b42c8e6be18ee5e3c13bc395e8721c
SSDEEP 6144:qflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:qflfAsiVGjSGecvX
TLSH
T1F7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkicausmk.sys

Path C:\Temp\smkicausmk.sys
Size 293KB
SHA256 4ec6dd57d40c480415f6458daf5695c4b984a40ebe515147bb2f6aa0aa8bacff
MD5 b696d4a28766768c5ac9f676d7240077
SHA1 5417294826365135aa90daef901ae1a20730b479
SHA512 e39ee0f8411f5a7485890c0d6f92a153c4db507636ef8dfdde1145b1c5c02369980197c7b9f18a25d535a37eb1a43644c8bd29724c94101cc0ac901166d4a28b
SSDEEP 3072:htKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:hIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkicavtnlfdxvsn.exe

Path C:\Temp\sqkicavtnlfdxvsn.exe
Size 361KB
SHA256 610ec7ab33c75e37aa38bac997e9c649726166cfc9220386164aa48ca7245475
MD5 2f62bac61779a3ff507ebe09a6d33fb6
SHA1 ddfc32bc923f509cc9e100fc611bd0ce01b81b88
SHA512 ff5d48febf87f6c758ff1db1b45e37c6f4cc287df6e4e69fab38d5708ec3e853df471b4637b8f108c56d681a1a5b0b6f906e322d8aeee781283fc3267826a6a8
SSDEEP 6144:gflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:gflfAsiVGjSGecvX
TLSH
T12F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkicavtnlfdxvsn.sys

Path C:\Temp\sqkicavtnlfdxvsn.sys
Size 293KB
SHA256 bc131a0acfe960f623fa7e4a23fa3b5dacf65a5d17cecbfb4d46d8266848f47d
MD5 644d564955f3989da3650ebbe4f66ef6
SHA1 239c1ed41b1035ad1636ddb7a47b5daf11f268c4
SHA512 73a0649c5c366bd53771ff773882497c3a013e92a9b39949f0959db463f2e989c8dde8fdf8935fd5f0050cdf0ed17e88bac74590d041a0e54af1c620fcb821a1
SSDEEP 3072:2tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:2IJjiJcbI03GBc3ucY5DCSj
TLSH
T147545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmjebztrm.exe

Path C:\Temp\urmjebztrm.exe
Size 361KB
SHA256 761f66f377ff431a0c257ac646d34bd3575e3cf17939f597de4d6baf21cf5efd
MD5 e094a6f992303e35f47a7a15fd736258
SHA1 8d8f2178de6006c8ebe485ed3c88e2ab02ed3013
SHA512 c5b9e01c0e4b1cf358bb02f0257030c092b336ddca6da2a012298aa8182e2732475b997420babba9b1f324e6cac771db60038df1933aa8b481bba3400915ecb8
SSDEEP 6144:SflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:SflfAsiVGjSGecvX
TLSH
T13F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urpkhczxrp.sys

Path C:\Temp\urpkhczxrp.sys
Size 293KB
SHA256 1640767437c8d19c011dee13b17dcb7ae45a3b8fdce3cf8f9cc159d6beebc5ba
MD5 d3f2061ce1efaec0fc6c400e54b52231
SHA1 2d96791d4fea429541a34e8d06c85f955afba3f3
SHA512 9add3da35fff603d3db7bffb8c2642a998e9454f0ad0a564b80ee57abf4a81a85f8a773d859e02ad055ba61a1acebf90451ec1f6faafd261c0bced96d8613426
SSDEEP 3072:ctKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:cIJjiJcbI03GBc3ucY5DCSj
TLSH
T168545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqkicavqk.exe

Path C:\Temp\ysqkicavqk.exe
Size 361KB
SHA256 44db23ae639cd5d1abb855f7ef8e1cb8a8e768ac41040ff58d6a73d5b35b2532
MD5 5604509b8a92b402f4fb4a79037d2d1c
SHA1 5306da4788cbaa3fb60a64db1eec121954539a60
SHA512 c8e2da5396df8aca8c96235bd91d8b7189767dbe854c17728423558b4ba1706c46fd805662db17b73c3712bd841ea13e779bf4aecdffd3ce94431110eda4af18
SSDEEP 6144:fflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:fflfAsiVGjSGecvX
TLSH
T1F2747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurmjecwuo.sys

Path C:\Temp\zurmjecwuo.sys
Size 293KB
SHA256 3d533eabff567d36ecd3691e00d4b69fe130b24776130dc9d2f15d1f6861278e
MD5 214e2d62ef6468d4239fb9d885a21f83
SHA1 696bb98fd08106347cc1e66dddabe9605c0241d8
SHA512 76dee009892497dc0cec7a163c7ea6985a799f01ad86ef50c589ac4182643670135f2794fb813ab0d4e3fce104fe913f00fc18949edf710f8d5db639427ea351
SSDEEP 3072:VtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:VIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C1545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f158bde3374bb1b7f53eaf974c5926c39d5659dd90d15f1bbfea1a88ef4e5048
MD5 1231b87a970b4cb56d5fea88c1d0815d
SHA1 fbe85c3f9b2e222e24624c00cd733890833af6b4
SHA512 23a9378315c5c2ddfe11f8e41e5ed7af525a49024d7774153c6e60780239da40c180e10c70f1738983459a3c467d9e3777624f15c0b2370dee632e435036fbc6
TLSH
T18551950F2B2589D3E771557220E6076932F9A669DBC7DE10C8001E32EA06F71C1EBC57
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ff55.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ff55.TMP
Size 2KB
SHA256 020c82b17e4706c8d3384494bd64527309d2973aa4cf56c264c6a70fe4fc79b3
MD5 2117bc3aaaa1de2559be1ec79ef2e803
SHA1 cca321dd0fccaf467846e7cb6cc2f8bf9710774d
SHA512 aed2da48eee3f6f9efb101797d17be13895e855dca88a8745e5bf2363a044ef85f1cc005794829ea9d15f694e0a5de19a3b847d6bdfee280f664e3d4decc4f95
TLSH
T14C51930F2B2589D3E771957260E6076932F9A679DBC39E10C8001E32EA06F3181EBC57
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6cf4b5f80833a857fbb207551b092143382c73fae1dfdd65055e61e31552ae51
MD5 8fee5e6dd3858001c316c575b6ac83b4
SHA1 5496a65ae1b1f78ccfc57e8e6819533f5d8f3891
SHA512 ffb09830a15e5b18dad85a42dbb761057be53ed20f6b2d55118073e582d22b35d8e74326834adc59222e6c2b19f4c801fb50d6f38e7309d74df286c708812d6f
TLSH
T190418DF3C3F4957E8A0196F0AA14AE1FCE1D0515432C7D5AC9E4AE2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 726294d8ded00a38fadc53b06bfc99e874075307fa8fc3df91b961dc08e648a9
MD5 d0d297cf7060bf970f27c96c459b4ee6
SHA1 ec0639e0b0ff56d597e735e578399336818d8d8b
SHA512 9236d69c8ae5c2f1c702a98049d360e448f73a5b06ba49e5e22d274a54b1097932ec2d3081aeb84a44802b283bddfc6fc479927eef66bd6071453e751b12d75f
SSDEEP 192:sxRmRtCo/fIswm5ZLNfUkzoA8p9K/g6+WNCKh/Yop8CY4GNIgDZIJ:sxRmKo/fIswmXJ2c/5p/ZiO
TLSH
T14342D8166E28A93B4CC7E31DFA55BF53D3F91472A1D12E48AAFC961C00E76DE221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 36cc83dac302f4225a0efcc837f317e305f101de5f13b50bf16e5de8bef61d10
MD5 150f51037c8f8b63b8318cc8dd1eb0c4
SHA1 2572f02dbac970eb8fcb0685dc8d4409606a6260
SHA512 7ee0e7a69e157e704124c01b3b98b2b780becebdf00f78ca69361a6c45df327da8705b871e5820dd7d5ec2836e69f3d631d7aee5d9d766612c61e4b19460b031
SSDEEP 192:sxRhRtCo/fIsvm5ZLNfUkzoA8p9K/g6+WNCKh/Yop8CY4GNIgVIJ:sxRhKo/fIsvmXJ2c/5p/Zi2
TLSH
T1CB42C8166E28A93B4CC7E31DFA55BF53D3F91472A1D12E48AAFC960C04E76DE221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8912c2e1d5fa2d0b5d132de2e7fd8668aa4bf8b65b6106d3c5136cb2dcf582c8
MD5 5a01c36899d187ce0d9e2c57897a988f
SHA1 fecfabfd8d72e926377d1b933325b0ecd81958e5
SHA512 ab8b0313d979382c1ab6faab774d68ffeb7f41d93d96165e60c3e18bc7508bb7dc92224eebb221788983c661b5b81c895b2fd05104ca8dd22a84276f4e0b29b7
SSDEEP 192:sxRmRtCo/fIswY5ZLNfUkzoA8p9K/g6+WNCKh/YoOSCY4GNIgDzIJ:sxRmKo/fIswYXJ2c/5p/qiM
TLSH
T17A42C8166A28A93B4CC7E31DFA557F53D3F91472A1912E48AAFCD61C00E76DE221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 e6a7040c3864dea37fb1ef0f4c2951d6320e48e22d1020cd29accf86ddf0862c
MD5 2e5340cc72c9c39c46bed3ca50aee70c
SHA1 78d2e75197e568f25e6a9f64c8c1cc661712899c
SHA512 b7ffb7dc851072a5de549d085213b33b9384f24a958a968753da4b3ade1b365c3f624469536b8769c07f857f18edf555bd6fb28077bb71fbdcb50f4ec5cf8c13
SSDEEP 768:j26H8o7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OV3dBVuwYro98e0j:j26H8UE7MRWgs2f02u1jasdB4wj30
TLSH
T14AD2DB7B640DCABE4F800ADDEC197E9F6D6802CB9698CD8047FA951C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0af5f0f1-7060-47f7-8205-5b755463e83c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0af5f0f1-7060-47f7-8205-5b755463e83c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e28e20a32c557404272f70568d59a44fa78fe71cb126559977d4f8c9e645459c
MD5 a3d78e79b079fbf0e98ea43db95191ba
SHA1 d78786dd5c44c609fbca29db0ef240597b72dfd7
SHA512 0bc30cab6c17005d0693108ddeb4b1d6d6f90dc37d5a77f0080e46178a0e787ca2113a68b7fc22513eef1a823610a019426914810bd3dcea9a4152bc80ccfd41
SSDEEP 768:RS3OI0F9/TBOW1r+5ONXyer1IRCzni9SPi9PMyT:RS3OI0XwSIqnRPhyT
TLSH
T112F2BF30E1A59D634CF5E396F2476783AEF81473D4C10A94E9E9AF0E09C791E170F81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3667286df6df55f3768381d41769606378f4af780aa83965a334fafb4e831c35
MD5 8165051f1de9cd354f2605b8220e2ca6
SHA1 2846f7fdaf33eedda7b25fa3ef98f09c29c87f83
SHA512 2f36c18ba7fe5c5db6f999eff7bda10605d7db73d86adbe248e2f1387d12fe288ce50ed5fc786990b769a7332566c36e61783cf2b3438bee7c7dad1e7d87cd9c
SSDEEP 768:hrv+4UNbdz3F7/TBOW1PONXyer1IRCzniBIeVH1SK7:hbsbV3N/SIqnnEH1l
TLSH
T15C03CF32E4989E338DE2A3D6B147B6437FB86057C6800790DCDE2F4E069B99E130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a899b7917593fa97fa94ca2a4f615bb3a616ce4b9c3eca54b2f92a48ddd8fb27
MD5 666c83f41570147c79b9399c7a51e5e2
SHA1 8e4a4badea0c49d821fa59a65921375459eec400
SHA512 bbf78e4b9ae22220a50ce5e82b255bef832e45cc0485d767444feed233751cd63336421184db8590673b12e4eedad6da1dbe80e035f1dadf092775e3ee8fb562
SSDEEP 768:5S3NI0c9/TBOW1r+AONXyer1IRCzni9SPi9PMyT:5S3NI0ObSIqnRPhyT
TLSH
T18DF2AF30E1A59D634CF5F396F2476783AEF81563D5C10A94E9E9AF0E09C7A1E130F81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 bb5a8ac9eb7b8b42c629f5a10f2f121b0b91fc10d9c0947932020e1e5714f40c
MD5 d6a97bc8ebef2c475ea8f4db69d9c2f0
SHA1 041c789ad8cfb09d3d3f48458b455e8c2fbced18
SHA512 2a3ed1b31903d53bbdeabe450c4b85b3eb0a181a623f8b008982b1d6541a6eae83f129bed28078fbd69cdde088d837b40347b4a05b25b5bfe619156fbceb4d36
SSDEEP 768:8rv+4UNbdz32T/TBOW1r+fONXyer1IRCzniwSeVH1SK7:8bsbV3OQSIqn2EH1l
TLSH
T19703BF31A1A8DE334DE6A395B147B7837FB82067C5800B90EDDA2F8D099759E230F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 2b179f3cbcd293c412c75bb1884a505c5dab454e4f678298bdd789a703d7880a
MD5 649e3ad1b523677e9f2d3c77d90fbc3c
SHA1 268b9164a835724fefe86780fb2691a771ed5eb5
SHA512 61a3a1d45aa3d8827beba5616620581a0c3175f10a1a495c5207c3a6b6138166bf7371d62510c4056f7605c197cabd6a82993e6eb3ee3ac95b353c9569699c50
SSDEEP 768:SFQC3Rwg/I0wCxsOW1r+bONXyer1IRCzni9SPi9PMyT:pC3PI0BBSIqnRPhyT
TLSH
T1FB1327F194D79A37D8AE9783A33E6E429EBCD063B4844990BBD45E4DCC8257FC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

d408d7e8-6618-4ef9-bad1-60d2b6ae3ebe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d408d7e8-6618-4ef9-bad1-60d2b6ae3ebe.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1288_518331280\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 15444ec55c2c2ca78a00a4b683659ce66c336c5f7ecf06268595b0406fc34c1f
MD5 4b9e9841808b3827c19ce39b44942f45
SHA1 2cfb1a8ea962813ee15f10128ac964d4cacb53da
SHA512 55165e5fd0c12fc1b813a0ee44525b92d74769ede0cd67687123bedb6644fbe29f7bddbf74f5b67641f495b832ce9fad06d210208ef8e99ee27c1874f19f9941
TLSH
T1E171239356ADCAB2C2DE5FF102839644F6FF2238476330200B655587AB30A3A58B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/912-276-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1372-396-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1760-462-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2200-363-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2624-416-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2624-431-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3000-355-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3124-189-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3176-375-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3360-289-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3416-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3416-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3648-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3692-442-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4100-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4308-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4468-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4612-264-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4828-380-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5824-236-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5964-337-0x0000000000010000-0x00000000000AB000-memory.dmp

Download