systex | 88272201348ffd9a683bd026cf5f09ca4d3b088349e32c12c49d95d0740dc62f

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260814-vx5d6axgpg
SHA256 88272201348ffd9a683bd026cf5f09ca4d3b088349e32c12c49d95d0740dc62f
MD5 db7b7f228b5ccd4d6794370cc9608a04
SHA1 5ffcd8b67a9420bc033019dfb56df60716a2e99d
SHA512 c404ca4de4cd467f8c27c56a8062176e40852c80639a57fe6887afe18da4cd120ab5b51ae78cd858890fc78b837f04fed9ee638128ef6d83367112956b8bb4b3
SSDEEP 6144:xflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:xflfAsiVGjSGecvX
TLSH
T1B5747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4620	mjeuoljdbwtrljhb.exe
2432	mjeuoljdbwtrljhb.sys
3312	CreateProcess.exe
4984	omjebwuojg.exe
3504	CreateProcess.exe
3748	CreateProcess.exe
1824	i_omjebwuojg.exe
4112	gbytrljdby.sys
1648	CreateProcess.exe
5480	dbwigbywqo.exe
1536	CreateProcess.exe
4580	CreateProcess.exe
2072	i_dbwigbywqo.exe
2168	tqoidaywqo.sys
2604	CreateProcess.exe
5448	vtnlfdbywq.exe
1008	CreateProcess.exe
4072	CreateProcess.exe
5944	i_vtnlfdbywq.exe
2256	lidaysqnif.sys
5984	CreateProcess.exe
3912	kifdyvqnif.exe
3800	CreateProcess.exe
1388	CreateProcess.exe
3040	i_kifdyvqnif.exe
4364	sqnifaqkic.sys
1960	CreateProcess.exe
2940	fdxvpnhfzx.exe
3408	CreateProcess.exe
5044	CreateProcess.exe
4680	i_fdxvpnhfzx.exe
5940	cxvsmkhfzx.sys
4472	CreateProcess.exe
5796	fdxupmcxup.exe
5080	CreateProcess.exe
3416	CreateProcess.exe
1044	i_fdxupmcxup.exe
5000	kecxupnhfz.sys
5868	CreateProcess.exe
5224	kecwupmhez.exe
4684	CreateProcess.exe
3216	CreateProcess.exe
5216	i_kecwupmhez.exe
3316	mhezxrpmhe.sys
1860	CreateProcess.exe
5552	mjhecwurmj.exe
5128	CreateProcess.exe
3576	CreateProcess.exe
6092	i_mjhecwurmj.exe
5948	rpjhecwurp.sys
6116	CreateProcess.exe
204	jgeywuomge.exe
1856	CreateProcess.exe
1900	CreateProcess.exe
3300	i_jgeywuomge.exe
5184	zwromgeywr.sys
2516	CreateProcess.exe
2772	trljgbywqo.exe
4088	CreateProcess.exe
1148	CreateProcess.exe
3040	i_trljgbywqo.exe
5104	olgdbytqoi.sys
2884	CreateProcess.exe
5240	ljdbvtnljd.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5504_628309814\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5504_1035899950\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5504_1035899950\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5504_1236761399\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5504_1236761399\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5504_341246530\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5504_628309814\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5504_1236761399\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5504_1236761399\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifdyvqnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecwupmhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljgbywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtnljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnifaxvpnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxupmcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhecwurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnifaxvpnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwtolgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjeuoljdbwtrljhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjebwuojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljgbywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtnljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifdyvqnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeywuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgeywuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbywuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecwupmhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjebwuojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecaxrpnhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecaxrpnhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbwigbywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbwigbywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxupmcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmhbzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtolgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhecwurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmhbzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbywuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqlidb.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3440	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2872	ipconfig.exe
2324	ipconfig.exe
4064	ipconfig.exe
4124	ipconfig.exe
2524	ipconfig.exe
5312	ipconfig.exe
3316	ipconfig.exe
5588	ipconfig.exe
3116	ipconfig.exe
2852	ipconfig.exe
4416	ipconfig.exe
5560	ipconfig.exe
3032	ipconfig.exe
1936	ipconfig.exe
4696	ipconfig.exe
5056	ipconfig.exe
5736	ipconfig.exe
5540	ipconfig.exe
1940	ipconfig.exe
2324	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312017950335594"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{38F5F93A-2E23-43DA-9668-31ABBBF0F9FA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	mjeuoljdbwtrljhb.exe
4620	mjeuoljdbwtrljhb.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	mjeuoljdbwtrljhb.exe
4620	mjeuoljdbwtrljhb.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	mjeuoljdbwtrljhb.exe
4620	mjeuoljdbwtrljhb.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	mjeuoljdbwtrljhb.exe
4620	mjeuoljdbwtrljhb.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	mjeuoljdbwtrljhb.exe
4620	mjeuoljdbwtrljhb.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	mjeuoljdbwtrljhb.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	mjeuoljdbwtrljhb.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1824	i_omjebwuojg.exe
Token: SeDebugPrivilege	2072	i_dbwigbywqo.exe
Token: SeDebugPrivilege	5944	i_vtnlfdbywq.exe
Token: SeDebugPrivilege	3040	i_kifdyvqnif.exe
Token: SeDebugPrivilege	4680	i_fdxvpnhfzx.exe
Token: SeDebugPrivilege	1044	i_fdxupmcxup.exe
Token: SeDebugPrivilege	5216	i_kecwupmhez.exe
Token: SeDebugPrivilege	6092	i_mjhecwurmj.exe
Token: SeDebugPrivilege	3300	i_jgeywuomge.exe
Token: SeDebugPrivilege	3040	i_trljgbywqo.exe
Token: SeDebugPrivilege	3940	i_ljdbvtnljd.exe
Token: SeDebugPrivilege	1384	i_tnlfdyvqoi.exe
Token: SeDebugPrivilege	5496	i_qnifaxvpnk.exe
Token: SeDebugPrivilege	716	i_nkfdxvpnhf.exe
Token: SeDebugPrivilege	4300	i_kecaxrpnhe.exe
Token: SeDebugPrivilege	6136	i_rpmhbzxrpj.exe
Token: SeDebugPrivilege	1984	i_ecwuomgezw.exe
Token: SeDebugPrivilege	2852	i_dbywuomgey.exe
Token: SeDebugPrivilege	4124	i_jdbwtolgdy.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5504	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 4620	4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4896 wrote to memory of 2068	4896	2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 2068 wrote to memory of 5504	2068	iexplore.exe	91
PID 5504 wrote to memory of 3220	5504	msedge.exe	92
PID 5504 wrote to memory of 3440	5504	msedge.exe	93
PID 5504 wrote to memory of 3364	5504	msedge.exe	94
PID 5504 wrote to memory of 3364	5504	msedge.exe	94
PID 5504 wrote to memory of 3364	5504	msedge.exe	94
PID 5504 wrote to memory of 464	5504	msedge.exe	95
PID 5504 wrote to memory of 464	5504	msedge.exe	95
PID 5504 wrote to memory of 4472	5504	msedge.exe	97
PID 5504 wrote to memory of 4472	5504	msedge.exe	97
PID 5504 wrote to memory of 4472	5504	msedge.exe	97
PID 5504 wrote to memory of 1232	5504	msedge.exe	98
PID 5504 wrote to memory of 1232	5504	msedge.exe	98
PID 5504 wrote to memory of 1232	5504	msedge.exe	98
PID 5504 wrote to memory of 5912	5504	msedge.exe	99
PID 5504 wrote to memory of 944	5504	msedge.exe	100
PID 5504 wrote to memory of 5912	5504	msedge.exe	99
PID 5504 wrote to memory of 5912	5504	msedge.exe	99
PID 5504 wrote to memory of 944	5504	msedge.exe	100
PID 5504 wrote to memory of 944	5504	msedge.exe	100
PID 5504 wrote to memory of 1984	5504	msedge.exe	102
PID 5504 wrote to memory of 1984	5504	msedge.exe	102
PID 4620 wrote to memory of 3312	4620	mjeuoljdbwtrljhb.exe	105
PID 5504 wrote to memory of 5472	5504	msedge.exe	107
PID 5504 wrote to memory of 3400	5504	msedge.exe	108
PID 5504 wrote to memory of 5472	5504	msedge.exe	107
PID 5504 wrote to memory of 3400	5504	msedge.exe	108
PID 4984 wrote to memory of 3504	4984	omjebwuojg.exe	110
PID 5504 wrote to memory of 5128	5504	msedge.exe	114
PID 5504 wrote to memory of 2484	5504	msedge.exe	115
PID 5504 wrote to memory of 2484	5504	msedge.exe	115
PID 5504 wrote to memory of 1552	5504	msedge.exe	116
PID 5504 wrote to memory of 1552	5504	msedge.exe	116
PID 4620 wrote to memory of 3748	4620	mjeuoljdbwtrljhb.exe	119
PID 4620 wrote to memory of 1648	4620	mjeuoljdbwtrljhb.exe	123
PID 5480 wrote to memory of 1536	5480	dbwigbywqo.exe	125
PID 4620 wrote to memory of 4580	4620	mjeuoljdbwtrljhb.exe	128
PID 4620 wrote to memory of 2604	4620	mjeuoljdbwtrljhb.exe	132
PID 5448 wrote to memory of 1008	5448	vtnlfdbywq.exe	134
PID 4620 wrote to memory of 4072	4620	mjeuoljdbwtrljhb.exe	137
PID 4620 wrote to memory of 5984	4620	mjeuoljdbwtrljhb.exe	141
PID 3912 wrote to memory of 3800	3912	kifdyvqnif.exe	143
PID 4620 wrote to memory of 1388	4620	mjeuoljdbwtrljhb.exe	147
PID 5504 wrote to memory of 1428	5504	msedge.exe	149
PID 5504 wrote to memory of 4528	5504	msedge.exe	150
PID 5504 wrote to memory of 3488	5504	msedge.exe	151
PID 4620 wrote to memory of 1960	4620	mjeuoljdbwtrljhb.exe	154
PID 2940 wrote to memory of 3408	2940	fdxvpnhfzx.exe	156
PID 4620 wrote to memory of 5044	4620	mjeuoljdbwtrljhb.exe	159
PID 4620 wrote to memory of 4472	4620	mjeuoljdbwtrljhb.exe	163
PID 5796 wrote to memory of 5080	5796	fdxupmcxup.exe	165
PID 4620 wrote to memory of 3416	4620	mjeuoljdbwtrljhb.exe	168
PID 4620 wrote to memory of 5868	4620	mjeuoljdbwtrljhb.exe	172
PID 5224 wrote to memory of 4684	5224	kecwupmhez.exe	174
PID 4620 wrote to memory of 3216	4620	mjeuoljdbwtrljhb.exe	177
PID 4620 wrote to memory of 1860	4620	mjeuoljdbwtrljhb.exe	181
PID 5552 wrote to memory of 5128	5552	mjhecwurmj.exe	183
PID 4620 wrote to memory of 3576	4620	mjeuoljdbwtrljhb.exe	186
PID 5504 wrote to memory of 4724	5504	msedge.exe	188
PID 5504 wrote to memory of 4724	5504	msedge.exe	188
PID 4620 wrote to memory of 6116	4620	mjeuoljdbwtrljhb.exe	194
PID 204 wrote to memory of 1856	204	jgeywuomge.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_db7b7f228b5ccd4d6794370cc9608a04_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Temp\mjeuoljdbwtrljhb.exe
  C:\Temp\mjeuoljdbwtrljhb.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omjebwuojg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3312
  - - C:\Temp\omjebwuojg.exe
      C:\Temp\omjebwuojg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4984
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3504
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omjebwuojg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3748
  - - C:\Temp\i_omjebwuojg.exe
      C:\Temp\i_omjebwuojg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbwigbywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1648
  - - C:\Temp\dbwigbywqo.exe
      C:\Temp\dbwigbywqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5480
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1536
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbwigbywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4580
  - - C:\Temp\i_dbwigbywqo.exe
      C:\Temp\i_dbwigbywqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlfdbywq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2604
  - - C:\Temp\vtnlfdbywq.exe
      C:\Temp\vtnlfdbywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5448
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1008
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlfdbywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4072
  - - C:\Temp\i_vtnlfdbywq.exe
      C:\Temp\i_vtnlfdbywq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kifdyvqnif.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5984
  - - C:\Temp\kifdyvqnif.exe
      C:\Temp\kifdyvqnif.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3912
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3800
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kifdyvqnif.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1388
  - - C:\Temp\i_kifdyvqnif.exe
      C:\Temp\i_kifdyvqnif.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvpnhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1960
  - - C:\Temp\fdxvpnhfzx.exe
      C:\Temp\fdxvpnhfzx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2940
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxvpnhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5044
  - - C:\Temp\i_fdxvpnhfzx.exe
      C:\Temp\i_fdxvpnhfzx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxupmcxup.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4472
  - - C:\Temp\fdxupmcxup.exe
      C:\Temp\fdxupmcxup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5080
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxupmcxup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3416
  - - C:\Temp\i_fdxupmcxup.exe
      C:\Temp\i_fdxupmcxup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kecwupmhez.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5868
  - - C:\Temp\kecwupmhez.exe
      C:\Temp\kecwupmhez.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5224
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kecwupmhez.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3216
  - - C:\Temp\i_kecwupmhez.exe
      C:\Temp\i_kecwupmhez.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjhecwurmj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1860
  - - C:\Temp\mjhecwurmj.exe
      C:\Temp\mjhecwurmj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5552
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5128
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjhecwurmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3576
  - - C:\Temp\i_mjhecwurmj.exe
      C:\Temp\i_mjhecwurmj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgeywuomge.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6116
  - - C:\Temp\jgeywuomge.exe
      C:\Temp\jgeywuomge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:204
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1856
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgeywuomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1900
  - - C:\Temp\i_jgeywuomge.exe
      C:\Temp\i_jgeywuomge.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljgbywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2516
  - - C:\Temp\trljgbywqo.exe
      C:\Temp\trljgbywqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2772
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4088
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljgbywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1148
  - - C:\Temp\i_trljgbywqo.exe
      C:\Temp\i_trljgbywqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbvtnljd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2884
  - - C:\Temp\ljdbvtnljd.exe
      C:\Temp\ljdbvtnljd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5240
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2496
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbvtnljd.exe ups_ins
    3⤵
    PID:5020
  - - C:\Temp\i_ljdbvtnljd.exe
      C:\Temp\i_ljdbvtnljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnlfdyvqoi.exe ups_run
    3⤵
    PID:4208
  - - C:\Temp\tnlfdyvqoi.exe
      C:\Temp\tnlfdyvqoi.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3692
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5184
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnlfdyvqoi.exe ups_ins
    3⤵
    PID:4444
  - - C:\Temp\i_tnlfdyvqoi.exe
      C:\Temp\i_tnlfdyvqoi.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnifaxvpnk.exe ups_run
    3⤵
    PID:2104
  - - C:\Temp\qnifaxvpnk.exe
      C:\Temp\qnifaxvpnk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5836
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6092
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnifaxvpnk.exe ups_ins
    3⤵
    PID:5948
  - - C:\Temp\i_qnifaxvpnk.exe
      C:\Temp\i_qnifaxvpnk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkfdxvpnhf.exe ups_run
    3⤵
    PID:3940
  - - C:\Temp\nkfdxvpnhf.exe
      C:\Temp\nkfdxvpnhf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2020
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkfdxvpnhf.exe ups_ins
    3⤵
    PID:4048
  - - C:\Temp\i_nkfdxvpnhf.exe
      C:\Temp\i_nkfdxvpnhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kecaxrpnhe.exe ups_run
    3⤵
    PID:2328
  - - C:\Temp\kecaxrpnhe.exe
      C:\Temp\kecaxrpnhe.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3696
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5444
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kecaxrpnhe.exe ups_ins
    3⤵
    PID:1132
  - - C:\Temp\i_kecaxrpnhe.exe
      C:\Temp\i_kecaxrpnhe.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpmhbzxrpj.exe ups_run
    3⤵
    PID:2792
  - - C:\Temp\rpmhbzxrpj.exe
      C:\Temp\rpmhbzxrpj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5916
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5312
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpmhbzxrpj.exe ups_ins
    3⤵
    PID:1544
  - - C:\Temp\i_rpmhbzxrpj.exe
      C:\Temp\i_rpmhbzxrpj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwuomgezw.exe ups_run
    3⤵
    PID:1044
  - - C:\Temp\ecwuomgezw.exe
      C:\Temp\ecwuomgezw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:792
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1512
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwuomgezw.exe ups_ins
    3⤵
    PID:1452
  - - C:\Temp\i_ecwuomgezw.exe
      C:\Temp\i_ecwuomgezw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbywuomgey.exe ups_run
    3⤵
    PID:5356
  - - C:\Temp\dbywuomgey.exe
      C:\Temp\dbywuomgey.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5840
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbywuomgey.exe ups_ins
    3⤵
    PID:5024
  - - C:\Temp\i_dbywuomgey.exe
      C:\Temp\i_dbywuomgey.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbwtolgdy.exe ups_run
    3⤵
    PID:4384
  - - C:\Temp\jdbwtolgdy.exe
      C:\Temp\jdbwtolgdy.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1872
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4576
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbwtolgdy.exe ups_ins
    3⤵
    PID:2356
  - - C:\Temp\i_jdbwtolgdy.exe
      C:\Temp\i_jdbwtolgdy.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igaysqlidb.exe ups_run
    3⤵
    PID:4044
  - - C:\Temp\igaysqlidb.exe
      C:\Temp\igaysqlidb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1928
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5788
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5560
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffa7944c188,0x7ffa7944c194,0x7ffa7944c1a0
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,3486039080956759306,16301961643481674725,524288 --field-trial-handle=2608,i,13526290377346550388,17916161645230419471,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:11
      4⤵
      System Time Discovery
      PID:3440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,2283495671105065873,11008561434041499822,262144 --field-trial-handle=2608,i,13526290377346550388,17916161645230419471,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:2
      4⤵
      PID:3364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,1347812967893303562,10916885742001867681,524288 --field-trial-handle=2608,i,13526290377346550388,17916161645230419471,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:13
      4⤵
      PID:464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3660,i,14387290773623807331,5197919380180193687,2097152 --field-trial-handle=2608,i,13526290377346550388,17916161645230419471,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:1
      4⤵
      PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3648,i,8380255476943118028,12741849704506492492,2097152 --field-trial-handle=2608,i,13526290377346550388,17916161645230419471,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
      4⤵
      PID:1232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,852038659843095902,13072392001002024812,2097152 --field-trial-handle=2608,i,13526290377346550388,17916161645230419471,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:1
      4⤵
      PID:5912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4352,i,7159136250569011684,8689191387010896260,2097152 --field-trial-handle=2608,i,13526290377346550388,17916161645230419471,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:9
      4⤵
      PID:944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,9924215124368136195,1145158823620600639,524288 --field-trial-handle=2608,i,13526290377346550388,17916161645230419471,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
      4⤵
      PID:1984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,10418645980627240476,17795455902437563026,524288 --field-trial-handle=2608,i,13526290377346550388,17916161645230419471,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
      4⤵
      PID:5472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,16669715569236615134,4860249811549021948,524288 --field-trial-handle=2608,i,13526290377346550388,17916161645230419471,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14
      4⤵
      PID:3400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,2500219072728806560,11881319918818611857,524288 --field-trial-handle=2608,i,13526290377346550388,17916161645230419471,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
      4⤵
      PID:4580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,2500219072728806560,11881319918818611857,524288 --field-trial-handle=2608,i,13526290377346550388,17916161645230419471,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
      4⤵
      PID:5128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,4661780470849880805,6276701666680686059,524288 --field-trial-handle=2608,i,13526290377346550388,17916161645230419471,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
      4⤵
      PID:2484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,11323315721070701441,7755648699505994179,524288 --field-trial-handle=2608,i,13526290377346550388,17916161645230419471,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
      4⤵
      PID:1552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,9492829260673842960,15879517882024898367,524288 --field-trial-handle=2608,i,13526290377346550388,17916161645230419471,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
      4⤵
      PID:1428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,14021126227986420465,9977089246599025579,524288 --field-trial-handle=2608,i,13526290377346550388,17916161645230419471,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,13857349697514661774,7929097497995113101,524288 --field-trial-handle=2608,i,13526290377346550388,17916161645230419471,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
      4⤵
      PID:3488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3020,i,627342881775304886,4052485498105473317,524288 --field-trial-handle=2608,i,13526290377346550388,17916161645230419471,262144 --variations-seed-version --mojo-platform-channel-handle=1956 /prefetch:14
      4⤵
      PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,14995890840333656577,9608955330826673667,524288 --field-trial-handle=2608,i,13526290377346550388,17916161645230419471,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
      4⤵
      PID:1988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,15112120584086335875,15688439047904631080,524288 --field-trial-handle=2608,i,13526290377346550388,17916161645230419471,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
      4⤵
      PID:6084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,1854163145270487225,10112672217417164321,524288 --field-trial-handle=2608,i,13526290377346550388,17916161645230419471,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:14
      4⤵
      PID:1240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=924,i,1706970343814120981,1284319773818703359,262144 --field-trial-handle=2608,i,13526290377346550388,17916161645230419471,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:10
      4⤵
      PID:5160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,10263337153655068720,12923952773813473909,524288 --field-trial-handle=2608,i,13526290377346550388,17916161645230419471,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:14
      4⤵
      PID:5972

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3748

C:\Temp\mjeuoljdbwtrljhb.sys
C:\Temp\mjeuoljdbwtrljhb.sys
1⤵
- Executes dropped EXE
PID:2432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:108

C:\Temp\gbytrljdby.sys
C:\Temp\gbytrljdby.sys
1⤵
- Executes dropped EXE
PID:4112

C:\Temp\tqoidaywqo.sys
C:\Temp\tqoidaywqo.sys
1⤵
- Executes dropped EXE
PID:2168

C:\Temp\lidaysqnif.sys
C:\Temp\lidaysqnif.sys
1⤵
- Executes dropped EXE
PID:2256

C:\Temp\sqnifaqkic.sys
C:\Temp\sqnifaqkic.sys
1⤵
- Executes dropped EXE
PID:4364

C:\Temp\cxvsmkhfzx.sys
C:\Temp\cxvsmkhfzx.sys
1⤵
- Executes dropped EXE
PID:5940

C:\Temp\kecxupnhfz.sys
C:\Temp\kecxupnhfz.sys
1⤵
- Executes dropped EXE
PID:5000

C:\Temp\mhezxrpmhe.sys
C:\Temp\mhezxrpmhe.sys
1⤵
- Executes dropped EXE
PID:3316

C:\Temp\rpjhecwurp.sys
C:\Temp\rpjhecwurp.sys
1⤵
- Executes dropped EXE
PID:5948

C:\Temp\zwromgeywr.sys
C:\Temp\zwromgeywr.sys
1⤵
- Executes dropped EXE
PID:5184

C:\Temp\olgdbytqoi.sys
C:\Temp\olgdbytqoi.sys
1⤵
- Executes dropped EXE
PID:5104

C:\Temp\tnlfdxvqni.sys
C:\Temp\tnlfdxvqni.sys
1⤵
PID:1984

C:\Temp\vsnkigdxvt.sys
C:\Temp\vsnkigdxvt.sys
1⤵
PID:4252

C:\Temp\sqkifausnk.sys
C:\Temp\sqkifausnk.sys
1⤵
PID:1044

C:\Temp\khcauspkhf.sys
C:\Temp\khcauspkhf.sys
1⤵
PID:712

C:\Temp\rpmhecwurm.sys
C:\Temp\rpmhecwurm.sys
1⤵
PID:3032

C:\Temp\rmjhbzurmj.sys
C:\Temp\rmjhbzurmj.sys
1⤵
PID:5988

C:\Temp\gecwuoljhe.sys
C:\Temp\gecwuoljhe.sys
1⤵
PID:1664

C:\Temp\igbytrljdb.sys
C:\Temp\igbytrljdb.sys
1⤵
PID:4296

C:\Temp\ljdbvtnlfd.sys
C:\Temp\ljdbvtnlfd.sys
1⤵
PID:4144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cxvsmkhfzx.sys

Path C:\Temp\cxvsmkhfzx.sys
Size 293KB
SHA256 2a06bae9d5f2d74c55c352a236f7e7f52b78d90705bb9aefae2790b72838be22
MD5 50fa6a2f2a43ebb10ebf81afb429607c
SHA1 47978829b82bce184e1ea11550788b3a2bf0af03
SHA512 88ae8e34b9a51b674746d751ccae4bf57a3245bcaecf7178106ffaf07f9700aa3608c08f9d23e9418738f194f97a5ac2b0f812a86f069bc6ed6bebaa51020fac
SSDEEP 3072:3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:3IJjiJcbI03GBc3ucY5DCSj
TLSH
T179545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbwigbywqo.exe

Path C:\Temp\dbwigbywqo.exe
Size 361KB
SHA256 1eed007e5a812df6891d3c06d199e342b62303391a500300d389e9b14da7c56d
MD5 e28951d3f00a9f4b3ce6670fce0dbdf3
SHA1 a329322b602455bda7917c54d003aff2f5c46cb5
SHA512 8bce5ceaf985090a529b2aefe0c8e7f1d9be96116a221b80eb61b91d155a9ecae738127a7d790a78f642a5c4133c56a31bcd460e5dd2d9d17d63351c9fbc8d43
SSDEEP 6144:nflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:nflfAsiVGjSGecvX
TLSH
T1AD747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxupmcxup.exe

Path C:\Temp\fdxupmcxup.exe
Size 361KB
SHA256 0d465a432dd6bc816a9d758a92e4bdfae0dc6926a35fa387ded68fff578fd167
MD5 99d87ca03bf452f2b41de3ca9950adf4
SHA1 263bbf7d009e1a1e662096ca143cd1f12dd13a37
SHA512 472494b2da16fe5696c509772ebe22c36daebfefbe76cb949be5101cc803d6d2a2228da9cd872f019f3e9cb0571f577b5a4bc10531545af0acd92bbae2e80084
SSDEEP 6144:lflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:lflfAsiVGjSGecvX
TLSH
T1CF747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvpnhfzx.exe

Path C:\Temp\fdxvpnhfzx.exe
Size 361KB
SHA256 8f3901ee5de1f807da74538b1df29a96e8b7906e615b2fe74b645e19116972a6
MD5 e1e2369a0f00818fb447baaffd4dc88f
SHA1 c6e485375abd4a83f8c147726abd73b42291d25c
SHA512 bd052b6107e6d0b1f89f745b416ed8714848cf4c78bc5042d7f762833982f93bc52cb506572aa993a86cb26d966396f7aa66861facdb22c767012411fba5ef57
SSDEEP 6144:fflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:fflfAsiVGjSGecvX
TLSH
T1CD747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytrljdby.sys

Path C:\Temp\gbytrljdby.sys
Size 293KB
SHA256 0462a9331cdeefc64a56501d7278a18881a121c439985638349c6e66e49a13cf
MD5 304b10135609df8f54e57949e301562a
SHA1 71c25da618a2c6e1d84ab724a7d7e415f82147dd
SHA512 1460fbf7b6463e3be4094d17c22fff3bf85f59b595d425af6073e2782b1c7cbcd61b5bd2c9753b1ba789c0f8e8346a2cf7fe8db282ba6d2d9a079abd08061ff1
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T12A545B44AAA4B0F6D9D5043C00EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbwigbywqo.exe

Path C:\Temp\i_dbwigbywqo.exe
Size 361KB
SHA256 eb38dc73ce5cc134652b6498c786f4abfa5387c4f30b5b957e5d33c58cc71142
MD5 220a56a74213e9b41ba495841a2de4c7
SHA1 a46adee3a714a03bd44d1f181e1ac8f810ac7180
SHA512 79e1220c4d2352888df1bb4b6156d4fa986265eba4b47a92c12c67ed77b7d596eb0709822e409cf125158a7895184b2d88f9eabc2ad35eb3ca06232f4bc5f83b
SSDEEP 6144:HflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:HflfAsiVGjSGecvX
TLSH
T15C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxvpnhfzx.exe

Path C:\Temp\i_fdxvpnhfzx.exe
Size 361KB
SHA256 63bb8a64b64a804c31901f95aa9a870a935cf060c82d7f75e6f61c4d2fb89cec
MD5 6161b323c5e617607cbe3ab5b7275803
SHA1 3ef787f3805603c7ba3126b526076ce9ae64cd10
SHA512 660d094dca7a69ff722a0b4623cbb1798a35b3cc10d40aa8a2055c13c594a20e26efd9e1df91b3e2379bd5ef01caeaefb569725fa354f179e77881e1cf5d4ac8
SSDEEP 6144:pflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:pflfAsiVGjSGecvX
TLSH
T100747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kifdyvqnif.exe

Path C:\Temp\i_kifdyvqnif.exe
Size 361KB
SHA256 9a969e0829b4fbd153903465262b34f74983f1d8427a8c6dcefb089e8f3102b7
MD5 143c91e07a8f006a50553d7400243af0
SHA1 5ea5aecffbdafb725575632a7e9e7e10caf7b97f
SHA512 0d5af9b36a0a79c8b8463e8b9ae9438ab38e7ea29ccc2854ae857bae54c16117712a89de97b025749812a9f0899adac58f7918aba7b9c68a15dc1ea14f8d52e8
SSDEEP 6144:pflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:pflfAsiVGjSGecvX
TLSH
T11F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omjebwuojg.exe

Path C:\Temp\i_omjebwuojg.exe
Size 361KB
SHA256 ac2c3c53bfa79931bd31fb91b7c058e6d692f8beecf415f55937324d6ca7e8a8
MD5 7ce61e25c115769cfccbcb7331cb216d
SHA1 242595a66839d4883ee3aa0bad86d2789ba0dc3e
SHA512 9497a08bee22a062408d0110e850dcaefe76353d341ceb3061d800084a8f98bd64a07297f120268b264e28f6cbec4b1452557dd13c5f57c8977d12fe25d888b9
SSDEEP 6144:aflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:aflfAsiVGjSGecvX
TLSH
T145747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtnlfdbywq.exe

Path C:\Temp\i_vtnlfdbywq.exe
Size 361KB
SHA256 1f48e8278ae9c9c79861d690c33a7f3eae7f29e942eb38ef39c45eac25a06f86
MD5 731c155683988682f303fe018e292afd
SHA1 df9c3a7f5518ec4510f130e06d24d64cb1935b39
SHA512 96c1671295c29456c825b6ffee8ee5b9bf55ba8c36db1e147165c22a9738437a2edb6f1c310487f095ca0053222ad10cce6a3f0f3a7aa3f225753ea1a2e4853b
SSDEEP 6144:UflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:UflfAsiVGjSGecvX
TLSH
T1E6747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kifdyvqnif.exe

Path C:\Temp\kifdyvqnif.exe
Size 361KB
SHA256 0146d72613db3281225e2f9b1a0ce070d5022f408d4f4a0aab709d312ffd812e
MD5 bd8d8eb404b33c6f9879cfdaf6a8454e
SHA1 6ec5d6d46804c169cd3e4139481f78eacb2c31be
SHA512 9afeed134ead00c614fef20211bb548ca5f23aab7dc275e4a04bbbc10d084942498811367c1f447e6e7ff05f59043ce6892dfb5ff9e05b22a531b53785a66f79
SSDEEP 6144:tflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:tflfAsiVGjSGecvX
TLSH
T1CC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidaysqnif.sys

Path C:\Temp\lidaysqnif.sys
Size 293KB
SHA256 219284df9cbd4125f5c320328e05090b908c4ecf1caf2ff9d887356551ee180b
MD5 855192a4c15b8eedc25306d7fd6e5b48
SHA1 4459ca63f97804afe74fd7a97d5b92834b4eb298
SHA512 825111cee429f9c9b9442076c67d137481b53686e5b18af69cbac1ef841b16bfd4eb8b5d9f86f0d87a457fef9ef7c552298e349c72860ea722434cb35d332a1f
SSDEEP 3072:PtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:PIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjeuoljdbwtrljhb.exe

Path C:\Temp\mjeuoljdbwtrljhb.exe
Size 361KB
SHA256 bc27ed047794324f4711f44fac5c993ec4ee2557736aca23ad2d3ee5e4906e37
MD5 a2a7313a2d55ac632a584353d0b15d98
SHA1 cbc23e157cedc35c185f40b360195e813fb743ec
SHA512 a669ef6efe860da0ff678af3c7b02e6713fc952e7ae0dcaa149ed7a7f33cb8a37d5fc8184bc96f2a7d6f07832adb17c41c7bb6077e40970cdc7763a7bbb93668
SSDEEP 6144:QflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:QflfAsiVGjSGecvX
TLSH
T1B3747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjeuoljdbwtrljhb.sys

Path C:\Temp\mjeuoljdbwtrljhb.sys
Size 293KB
SHA256 68511e861323ed739c5e0736d2e9db92d617b4d5a98cabef0e341b5fbd7486fb
MD5 9c79188bc3f01f081a0b3697ccfea656
SHA1 b4d15dbce9fa0d20246abacb518e8be9ac3a67c6
SHA512 0530c33c2e065b65af767311281b2f6f39638c03b1078d575dcbb26946e19c4b90038ddbba7a4887f1d06d2961fa17fb806f58b9870a4c8f808e2258aa576a97
SSDEEP 3072:StKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:SIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omjebwuojg.exe

Path C:\Temp\omjebwuojg.exe
Size 361KB
SHA256 d81640eb95e002cbcf510e995e713bcdf899675ccdcf19caba6c8dda2f3d655a
MD5 ddcd2a18aeefae31041c67e14e785d18
SHA1 f959e69d18234f5b65091e8f5a7f1df983b97abd
SHA512 80c51cd3ac077a7ecafa2c2b065503e5b027987a7d7c5ee6b893597f9a96b59d8715fadb6b3a8cf56f87429427cd120b97938585bd3baf0db6aaf2978b52cb0a
SSDEEP 6144:rflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:rflfAsiVGjSGecvX
TLSH
T118747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqnifaqkic.sys

Path C:\Temp\sqnifaqkic.sys
Size 293KB
SHA256 2c9912dbe0a1ce01dedb70417a9af610faa1751cc7c2c84531f1fcb705b1cb31
MD5 c79e8722161a1f16685d116566d216a8
SHA1 3c7c9ce5c2a6f124732b5119788fcca1fdfb7481
SHA512 2b5cc67e5598e49f48677c9ae0e0391ef7af43bc0290bb26ec32f874eaa5a4142cb468181c1846ad284d2807a2708767091b578e05e973b2d9777de1524f0389
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T169545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqoidaywqo.sys

Path C:\Temp\tqoidaywqo.sys
Size 293KB
SHA256 4ab2846608bb84807234478439999c74381ca8c228d357a2a95a9597177b9d30
MD5 f8af52301ad84e77e02e8fb641903b41
SHA1 2f55028b7b48921d677d16a26317ee90a56cbaaf
SHA512 71523d6c79b0730e6295443b0fb32e48196ea4699f6fe4829f4da0f4c6c311519271b519380890f8c024e04bb5fe3fc621722cfbed538913690192b13ccbccf6
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdbywq.exe

Path C:\Temp\vtnlfdbywq.exe
Size 361KB
SHA256 38279427893f22648f41cc4f5ed2133d6cd19a7660ccf5e0c53c82b13a159229
MD5 19ffeda419f6acf0d715110c0e9fa9ba
SHA1 9fc57fbbaad67fc18a1c35a9b04933070979ed1a
SHA512 62cfcb5aa51ad54f16b31eff305fc32da656c181fca16644a7c4da2bcf646c5fbcf39d3b156f7ec7f013e434a316007d2ffcc320d8df0927746068d930dedd8f
SSDEEP 6144:NflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:NflfAsiVGjSGecvX
TLSH
T108747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 93a5fef10de5324af89ac81c002b281bdff816a8a7acaf866ab1f60989d8004c
MD5 5183434bb540ba021544a063e76c3044
SHA1 438dc889f63d42ecf4a8b24659a404bc76a470a9
SHA512 70e31240e8ff4737e8257e36def08e04eb7b1c6c53408837288a400f2955ed68d9a4309ff6f8af68f21fbe3e570257c0b6df300fec18cccd22a7cb1f596e6d9c
TLSH
T15651A86D233F35CECB7441B994E4658532F0A45B8AB7EF22C0005D7A59D6F10EDCA853
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a82d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a82d.TMP
Size 2KB
SHA256 2d4e116a2129a9c545091da2ef1a8d740b14033d8c8e45b87cb55aedad8d5216
MD5 cf7c6815b4ca119a0ecb9df649acc69a
SHA1 23ac768a1cac20e5b9ae76719b86b3a9cb1d3898
SHA512 de5dc9c25acb0b8a84893c523e96395a68200ad766ac705f3759c24f6cff69d066bfe8ed00bd0befd6e4ecef0f00e1cf65339db53d7b3272d83d9fe64cefd108
TLSH
T17951B96D237F35CDCB7441B994E4558932F0A45B8AB7DF22C0041D7959D6F10EDC9453
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 cc95d30c164cbf15bae3b2b798b92f339cb5df5b069684d96b1817fbc7da4f07
MD5 b873b04e575651d5877542b57bc09032
SHA1 5e4776698ccff776300b7c64a48aafaf075cbfb2
SHA512 ce89b998bf26bf9c49b8cf0b11cfa8838451ee74d530062fc74a9786f567cd4a6c36a1e018b23e8152cb85634e807b4e7bf62144af193801d2923daa7f6380ab
TLSH
T1D451ADF383E4856E8A0196F0AB146E1FDE2D0515432C7D6AC9E0AF2BD3E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5ee85e932d27ea95d1ad67d430774130da88938f0629df913d16f157ef5ef447
MD5 b0e8eb0adf84464da6f0cfab4dc53996
SHA1 f1dbe8df8fcd7552c4226c0ec0cfddbc977fdaf0
SHA512 f22b7b0fb2a218db5ced41fbab1ce8967f3fb8858db193b6762791ee466f2076dd5d7e880fba64864a0c5c00e263e2b4bb24501ebb3146c9b990a458a93764eb
SSDEEP 192:sxR/xRnCc/fasCzPZQ0MzoD8p9T/g6+WNCKR/YCrauOVGhIgVPJ:sxR/xcc/fasCzRVk5/5p/4qP
TLSH
T1F042C8166E68A93B4CCBE20DBB55BF53D3F91032A1D51E58AAFC8B1C14EB6DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 af4470414a52da243eb21361904b96bedd522d7a951f2e922eac9cf7a8049d28
MD5 bb83344c66e28dae33b3d6dcad1d96e6
SHA1 44136aee47842cf3a9b0afe227bb6148e8a30d6b
SHA512 a7b6f8711cd1073fd959096e702f50f1522f69570e443af0bcfb435df8ac3ffef73e7b337c6396c23e6950618ef24077a60b8661a472d4579917416d8331aec4
SSDEEP 192:sxR/aRnCc/fasDzPZQ0MzoD8p9T/g6+WNCKR/YCrauOVGhIgDHPJ:sxR/acc/fasDzRVk5/5p/4ql
TLSH
T17C42D8156E68A93B4CCBE20DBB55BF53D3F91032A1D51E58AAFC8B1C14EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 66a695b3ae8152ad39572c93bd7f8a236b4855de0b23dd9ff16b1cdcf11623a0
MD5 b8764c20e4eaf7d87775050e5b361655
SHA1 a9da81e7eec45657793ed32274fc863657b02d92
SHA512 f103c3c6093ab3c683449d09a40cb063f00b2d509a5a97210e8c049ebb44967c05b5d52e3599839047795dc552071d7918e699074b828c8841f5690ede1e668a
SSDEEP 192:sxR/aRnCc/fasDvPZQ0MzoD8p9T/g6+WNCKR/YCTeuOVGhIgDFPJ:sxR/acc/fasDvRVk5/5p/UqD
TLSH
T12D42E8156A686D3B5CCBE20DBB15BF53D3F81032A1911E58AAFC8B1C14EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 bd2e5f07dc0b2852003cc1af542d81995ad65ff54570dca16a4afa1ea6f48c60
MD5 2d0d08f2c2af054b72537a1074b45fa8
SHA1 038bedee0d029ce1732e77059dedbe0ad806a019
SHA512 9a614043f27135a2b8f2a9aeae4aabd14dbeb24aa9e48d49800acc503f66cf6cdbdc3cac742c382ea55895483e32cc0e1dd41d6293d34321c6fad183c0872f11
SSDEEP 768:jC+vCN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OViS0QqctroZT:jC+vC7E7JQWgQ+f4+u1jaxS0VcGt
TLSH
T1E1D2EB7B640DCB7F4F804ADDED197E9B6DA802CB9698CD4047FA841C02C6BEB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7de606a7cf598d4430677b5d1bfc5f47fb60a38987a3e7e712d0f9144d5e5077
MD5 bb0ecef487f040a3858ad0fc2fd22b6b
SHA1 6103dc0abb1476a34044b10b07b0bca0a7205dd6
SHA512 f38c270203fb94668b6656700b2c169565b0cf108396dea11a1cbff09fcb50654d46af58db533d45999ad8cab85f35e6a8af3879dd7108f0cd987a5b3e194dfe
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHLURlTp5FWtC4gNFK40gjFcrzKtZ+zonEh:CbEBVj5JAdSp9/EgTK7j6dJOHLURlTpE
TLSH
T1FA915250347B02C03DBEA51D80F8892A978174B73439A57B3BA841971F67E466DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a4305.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a4305.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3828c140ec94073bbb591fa2b1a9e791c60c2fec7fbb1b0622ab78d4609b23db
MD5 69debd1d449b2aa299576fcb46dcd17d
SHA1 bf68b3ef310fc9bbb813dd37b589f47eb67f8425
SHA512 d33e83ef67ae532a4f09138c03d436a2fdd4fc27643f17ddcacc0d8fac077d4fb37e68e6bc11b4a438ac75d965aa7053cec969dbdca344f0b2772a8aad95d971
SSDEEP 768:kd3lvpptVap8+p3bd66j+4BRv86aLIWaPi9P92:kd3ZE8+p3Z6n4ykPj
TLSH
T14FF2AEB1E8A89D239CF9D745B29637437FF451B3A5C01E98E4DCA70D149326E1B0B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 085b89c8a440d98262b3966e124b54451df387ff6e04e4845e5e5b80421d093a
MD5 5c4355e97db566add69852b546885d4d
SHA1 cf94060096d3f21cebed42874aeb3b49c4b3c89a
SHA512 e3285a65121558a2f3cc66c12a2cfc3c2ae04e7bbaa3dea746a32c99daf5ad5c1617244bc1b33843cb1524bec238c0b4f3d33dd8f37765f234f25bd6238c177b
SSDEEP 768:Vd3UvpptVap8+p3bd66j+4BRv86aLIWaPi9P92:Vd3CE8+p3Z6n4ykPj
TLSH
T113F2AEB1E8A89D239CF9D745B29637437FF411B3E5C01E98E4D8A70D149326E1B0B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 e76128f24241ebffe904c4326b79cc950be97a659755e36f05cf200c58c89c72
MD5 b988a5111611294187522db409473fe2
SHA1 5ea42b6c8c8616247afbb6285e8f088d9e157ebe
SHA512 9f2535db8ca28a0c7a0b01611f3febe6b984e684367a7caf0744c695fe4c686f49ed1e19036d17d01aa84791c391afed5fa1c9a4f43ec9e5ca7f0196f6539f08
SSDEEP 768:Prv+4UNbdD3v5pptVNp8+p3bd66j+4BRv86aLITa2bwCl1:Pbsbp3RL8+p3Z6n4yv0ww
TLSH
T1EF03BE72F9A89D339CF6C644B1867B837FF811A395C10ED4E8D92B4E405A25E270B937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ba0e90b7268eb5cf2ae707ed3061928a37f8a48c8b99d1e997e036478eb3d5bb
MD5 b9db089b7d8f3b4690a64404a59557e9
SHA1 aa01d13b3fdc07d5326fa094ef01c51db1b9cafa
SHA512 e03f7acb4a72feb20491428db2e00041643ab010586f256ab05729a56656f6e6c63d7a31f3b81f13f1c2d9982975ea20de4a190cec6de3959299180620eb852a
SSDEEP 768:Irv+4UNbdD3ccpoNp8+p3bd66j+4BRv86aLIiO2bwCl1:Ibsbp3GL8+p3Z6n4yA0ww
TLSH
T11503BF33F9A899739CF6C648B2467B433FF851A396C10AC0D4DD2B4E419A19E230BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 81abde948b8529715aca48c59910b8a2c1a6f37db11a58742fac8a7e971d3426
MD5 b84f0b8b566d26a922aad0cffc0aecd3
SHA1 fb53f1b6743d793e1a285cae9e70a0ca160b1fd4
SHA512 65ec7aa1c469194bbf594ed725b11833b46a7cd41d16aa74ffcb67ccccd57e7339fd6eb0c772f46407b7f9621d1d8beee4dd3583e960f495d2638d57687e4402
SSDEEP 768:nFQt3/wgdc4ptYp8+p3bd66j+4BRv86aLIWaPi9P92:6t3i8+p3Z6n4ykPj
TLSH
T16C1327F1D8D78936D8AE8787A37D2E429EFCD063B5845894B7C85A0CCC8217FD70A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

25c2de3f-bfaf-417d-b6d9-428cc9b1c1f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\25c2de3f-bfaf-417d-b6d9-428cc9b1c1f2.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

667c7698-edb2-4750-a6d2-647765360096.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\667c7698-edb2-4750-a6d2-647765360096.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5504_674387898\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 1ce1974d0864cb5ef9c42f4947b04b784af1ffcd74a48d27d7d876cf43a3af1e
MD5 1b650494e3d23a9ff6cf353be192721d
SHA1 ffcf6a4ccd2207b4f00265ee1beaad99a05bca10
SHA512 25df5a0dcc9f01e4849fdf06bebe837c5d9118fc78d9f1a60cf7fd2e1c6a140fbec567e469d23add61e8cb2e72e1c414d093aa5ba85b79ae5c4c58ebf7e6eaa7
TLSH
T16F71008357A8C5B3C1DE5FF502835648F5BB22380B2330344B515586AA30A7A24B8F48
MD5 SHA1 SHA512 TLSH

Submit Download

memory/712-429-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1044-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1664-466-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1984-377-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2168-235-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2256-263-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2432-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3032-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3316-317-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4112-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4144-487-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4252-398-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4296-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4364-275-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5000-313-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5104-365-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5184-336-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5940-288-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5948-332-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5988-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download