systex | 5f28bb540f3198aabfedfd26c26cde62e5f76968224ad1507862cb5984104365

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 03:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260818-dnbxtaveja
SHA256 5f28bb540f3198aabfedfd26c26cde62e5f76968224ad1507862cb5984104365
MD5 8e34e22f62afff1f1e532d03c3f86abb
SHA1 ea7fb339acfd0122c4c8905df287c46eec74202c
SHA512 d5ba88d0b8f371ad7a3336b154341c55534027bc23ab548d59c8f2e1d18d59a940a6749bb0c3b586a51da8135a9935bb592bfe29101a2b37eb8c6ac9606512c2
SSDEEP 6144:fflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:fflfAsiVGjSGecvX
TLSH
T1CD747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3668	ztrljebwuomgezwr.exe
1428	ztrljebwuomgezwr.sys
2072	CreateProcess.exe
980	ebwuojhuoj.exe
4412	CreateProcess.exe
3424	CreateProcess.exe
5700	i_ebwuojhuoj.exe
4328	gdbwtomgey.sys
4912	CreateProcess.exe
4552	wqoigebwto.exe
2580	CreateProcess.exe
4784	CreateProcess.exe
5412	i_wqoigebwto.exe
7072	nljdbvtolg.sys
4824	CreateProcess.exe
3144	igaytqolga.exe
6492	CreateProcess.exe
1604	CreateProcess.exe
1080	i_igaytqolga.exe
2732	dxvtnlfdxv.sys
7032	CreateProcess.exe
6908	avsnlfdxvs.exe
2060	CreateProcess.exe
5364	CreateProcess.exe
1044	i_avsnlfdxvs.exe
5436	icavsnkfdx.sys
3256	CreateProcess.exe
2776	vsnkfdxvpn.exe
3840	CreateProcess.exe
3708	CreateProcess.exe
2788	i_vsnkfdxvpn.exe
800	uspkifaxvs.sys
3184	CreateProcess.exe
120	xusmkfdxup.exe
2916	CreateProcess.exe
4644	CreateProcess.exe
3988	i_xusmkfdxup.exe
2868	mkecwupmke.sys
7048	CreateProcess.exe
1452	mjhczusmke.exe
1372	CreateProcess.exe
4000	CreateProcess.exe
2012	i_mjhczusmke.exe
3344	mhecwupmhe.sys
2000	CreateProcess.exe
7156	eczuromhez.exe
3288	CreateProcess.exe
4444	CreateProcess.exe
4864	i_eczuromhez.exe
1524	rmjhbzwuom.sys
1132	CreateProcess.exe
6308	bztrojhbzt.exe
4928	CreateProcess.exe
5092	CreateProcess.exe
5852	i_bztrojhbzt.exe
6864	dbwtomgeyw.sys
7116	CreateProcess.exe
2700	dbzwuomgdb.exe
3468	CreateProcess.exe
6532	CreateProcess.exe
4240	i_dbzwuomgdb.exe
2652	wtolgdbvto.sys
2920	CreateProcess.exe
1268	vtolgdywqo.exe

Loads dropped DLL 1 IoCs

pid	Process
6496	msedge.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6496_178390648\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6496_862612829\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6496_492127579\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6496_178390648\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6496_464077560\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6496_464077560\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6496_862612829\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6496_492127579\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6496_178390648\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6496_178390648\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjhcztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwuojhuoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczuromhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbzwuomgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfdxvqnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjhcztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljebwuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuojhuoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusmkfdxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczuromhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrojhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqligaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaytqolga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtolgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurpmkecau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzxusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsnlfdxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusmkfdxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xsqnhfausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsnlfdxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbzwuomgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfdxvqnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurpmkecau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrojhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtolgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzxusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaytqolga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xsqnhfausn.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4836	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6408	ipconfig.exe
4864	ipconfig.exe
4676	ipconfig.exe
5892	ipconfig.exe
3356	ipconfig.exe
2592	ipconfig.exe
5492	ipconfig.exe
3068	ipconfig.exe
1276	ipconfig.exe
3196	ipconfig.exe
2740	ipconfig.exe
1764	ipconfig.exe
4732	ipconfig.exe
2816	ipconfig.exe
5712	ipconfig.exe
1940	ipconfig.exe
2764	ipconfig.exe
5192	ipconfig.exe
2096	ipconfig.exe
3920	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314961417561559"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{53CBD97A-2F58-45A5-AB98-8D2E45BEE295}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3668	ztrljebwuomgezwr.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3668	ztrljebwuomgezwr.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3668	ztrljebwuomgezwr.exe
3668	ztrljebwuomgezwr.exe
3668	ztrljebwuomgezwr.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3668	ztrljebwuomgezwr.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3668	ztrljebwuomgezwr.exe
3668	ztrljebwuomgezwr.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3668	ztrljebwuomgezwr.exe
3668	ztrljebwuomgezwr.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3668	ztrljebwuomgezwr.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
6496	msedge.exe
6496	msedge.exe
6496	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5700	i_ebwuojhuoj.exe
Token: SeDebugPrivilege	5412	i_wqoigebwto.exe
Token: SeDebugPrivilege	1080	i_igaytqolga.exe
Token: SeDebugPrivilege	1044	i_avsnlfdxvs.exe
Token: SeDebugPrivilege	2788	i_vsnkfdxvpn.exe
Token: SeDebugPrivilege	3988	i_xusmkfdxup.exe
Token: SeDebugPrivilege	2012	i_mjhczusmke.exe
Token: SeDebugPrivilege	4864	i_eczuromhez.exe
Token: SeDebugPrivilege	5852	i_bztrojhbzt.exe
Token: SeDebugPrivilege	4240	i_dbzwuomgdb.exe
Token: SeDebugPrivilege	2808	i_vtolgdywqo.exe
Token: SeDebugPrivilege	696	i_bvtnlfdyvq.exe
Token: SeDebugPrivilege	1096	i_nkfdxvqnhf.exe
Token: SeDebugPrivilege	4260	i_xsqnhfausn.exe
Token: SeDebugPrivilege	3444	i_zurpmkecau.exe
Token: SeDebugPrivilege	7076	i_bzxusmkecw.exe
Token: SeDebugPrivilege	3816	i_urpjhcztrm.exe
Token: SeDebugPrivilege	6268	i_zwrojhbztr.exe
Token: SeDebugPrivilege	4876	i_yvtrljdbwt.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6496	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 3668	4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 4788 wrote to memory of 1520	4788	2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	91
PID 1520 wrote to memory of 6496	1520	iexplore.exe	92
PID 6496 wrote to memory of 6588	6496	msedge.exe	93
PID 6496 wrote to memory of 4712	6496	msedge.exe	94
PID 6496 wrote to memory of 4836	6496	msedge.exe	95
PID 6496 wrote to memory of 4712	6496	msedge.exe	94
PID 6496 wrote to memory of 4712	6496	msedge.exe	94
PID 6496 wrote to memory of 256	6496	msedge.exe	96
PID 6496 wrote to memory of 256	6496	msedge.exe	96
PID 6496 wrote to memory of 5524	6496	msedge.exe	97
PID 6496 wrote to memory of 5524	6496	msedge.exe	97
PID 6496 wrote to memory of 4200	6496	msedge.exe	98
PID 6496 wrote to memory of 5524	6496	msedge.exe	97
PID 6496 wrote to memory of 4200	6496	msedge.exe	98
PID 6496 wrote to memory of 4200	6496	msedge.exe	98
PID 6496 wrote to memory of 3276	6496	msedge.exe	103
PID 6496 wrote to memory of 6232	6496	msedge.exe	104
PID 6496 wrote to memory of 3276	6496	msedge.exe	103
PID 6496 wrote to memory of 6232	6496	msedge.exe	104
PID 3668 wrote to memory of 2072	3668	ztrljebwuomgezwr.exe	102
PID 6496 wrote to memory of 5832	6496	msedge.exe	108
PID 980 wrote to memory of 4412	980	ebwuojhuoj.exe	109
PID 3668 wrote to memory of 3424	3668	ztrljebwuomgezwr.exe	114
PID 3668 wrote to memory of 4912	3668	ztrljebwuomgezwr.exe	118
PID 4552 wrote to memory of 2580	4552	wqoigebwto.exe	120
PID 3668 wrote to memory of 4784	3668	ztrljebwuomgezwr.exe	123
PID 3668 wrote to memory of 4824	3668	ztrljebwuomgezwr.exe	127
PID 3144 wrote to memory of 6492	3144	igaytqolga.exe	129
PID 3668 wrote to memory of 1604	3668	ztrljebwuomgezwr.exe	132
PID 3668 wrote to memory of 7032	3668	ztrljebwuomgezwr.exe	136
PID 6908 wrote to memory of 2060	6908	avsnlfdxvs.exe	139
PID 3668 wrote to memory of 5364	3668	ztrljebwuomgezwr.exe	142
PID 6496 wrote to memory of 6628	6496	msedge.exe	144
PID 6496 wrote to memory of 924	6496	msedge.exe	145
PID 6496 wrote to memory of 2468	6496	msedge.exe	146
PID 3668 wrote to memory of 3256	3668	ztrljebwuomgezwr.exe	149
PID 2776 wrote to memory of 3840	2776	vsnkfdxvpn.exe	151
PID 3668 wrote to memory of 3708	3668	ztrljebwuomgezwr.exe	154
PID 3668 wrote to memory of 3184	3668	ztrljebwuomgezwr.exe	158
PID 120 wrote to memory of 2916	120	xusmkfdxup.exe	160
PID 3668 wrote to memory of 4644	3668	ztrljebwuomgezwr.exe	163
PID 3668 wrote to memory of 7048	3668	ztrljebwuomgezwr.exe	167
PID 1452 wrote to memory of 1372	1452	mjhczusmke.exe	169
PID 3668 wrote to memory of 4000	3668	ztrljebwuomgezwr.exe	172
PID 3668 wrote to memory of 2000	3668	ztrljebwuomgezwr.exe	176
PID 7156 wrote to memory of 3288	7156	eczuromhez.exe	178
PID 3668 wrote to memory of 4444	3668	ztrljebwuomgezwr.exe	181
PID 6496 wrote to memory of 5900	6496	msedge.exe	183
PID 6496 wrote to memory of 5900	6496	msedge.exe	183
PID 3668 wrote to memory of 1132	3668	ztrljebwuomgezwr.exe	188
PID 6308 wrote to memory of 4928	6308	bztrojhbzt.exe	190
PID 3668 wrote to memory of 5092	3668	ztrljebwuomgezwr.exe	193
PID 3668 wrote to memory of 7116	3668	ztrljebwuomgezwr.exe	197
PID 2700 wrote to memory of 3468	2700	dbzwuomgdb.exe	199
PID 3668 wrote to memory of 6532	3668	ztrljebwuomgezwr.exe	202
PID 6496 wrote to memory of 6712	6496	msedge.exe	204
PID 6496 wrote to memory of 6712	6496	msedge.exe	204
PID 3668 wrote to memory of 2920	3668	ztrljebwuomgezwr.exe	207
PID 1268 wrote to memory of 204	1268	vtolgdywqo.exe	209
PID 3668 wrote to memory of 6008	3668	ztrljebwuomgezwr.exe	212
PID 3668 wrote to memory of 6560	3668	ztrljebwuomgezwr.exe	216
PID 2788 wrote to memory of 3464	2788	bvtnlfdyvq.exe	218
PID 3668 wrote to memory of 5448	3668	ztrljebwuomgezwr.exe	221

C:\Users\Admin\AppData\Local\Temp\2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_8e34e22f62afff1f1e532d03c3f86abb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Temp\ztrljebwuomgezwr.exe
  C:\Temp\ztrljebwuomgezwr.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwuojhuoj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2072
  - - C:\Temp\ebwuojhuoj.exe
      C:\Temp\ebwuojhuoj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:980
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4412
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebwuojhuoj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3424
  - - C:\Temp\i_ebwuojhuoj.exe
      C:\Temp\i_ebwuojhuoj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqoigebwto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4912
  - - C:\Temp\wqoigebwto.exe
      C:\Temp\wqoigebwto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4552
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2580
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqoigebwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4784
  - - C:\Temp\i_wqoigebwto.exe
      C:\Temp\i_wqoigebwto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igaytqolga.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4824
  - - C:\Temp\igaytqolga.exe
      C:\Temp\igaytqolga.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3144
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6492
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igaytqolga.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1604
  - - C:\Temp\i_igaytqolga.exe
      C:\Temp\i_igaytqolga.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\avsnlfdxvs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:7032
  - - C:\Temp\avsnlfdxvs.exe
      C:\Temp\avsnlfdxvs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6908
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2060
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_avsnlfdxvs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5364
  - - C:\Temp\i_avsnlfdxvs.exe
      C:\Temp\i_avsnlfdxvs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsnkfdxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3256
  - - C:\Temp\vsnkfdxvpn.exe
      C:\Temp\vsnkfdxvpn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2776
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsnkfdxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3708
  - - C:\Temp\i_vsnkfdxvpn.exe
      C:\Temp\i_vsnkfdxvpn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xusmkfdxup.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3184
  - - C:\Temp\xusmkfdxup.exe
      C:\Temp\xusmkfdxup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:120
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2916
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xusmkfdxup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4644
  - - C:\Temp\i_xusmkfdxup.exe
      C:\Temp\i_xusmkfdxup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjhczusmke.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:7048
  - - C:\Temp\mjhczusmke.exe
      C:\Temp\mjhczusmke.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1452
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1372
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjhczusmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4000
  - - C:\Temp\i_mjhczusmke.exe
      C:\Temp\i_mjhczusmke.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2012
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eczuromhez.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2000
  - - C:\Temp\eczuromhez.exe
      C:\Temp\eczuromhez.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:7156
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3288
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eczuromhez.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4444
  - - C:\Temp\i_eczuromhez.exe
      C:\Temp\i_eczuromhez.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrojhbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1132
  - - C:\Temp\bztrojhbzt.exe
      C:\Temp\bztrojhbzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6308
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4928
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrojhbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5092
  - - C:\Temp\i_bztrojhbzt.exe
      C:\Temp\i_bztrojhbzt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbzwuomgdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:7116
  - - C:\Temp\dbzwuomgdb.exe
      C:\Temp\dbzwuomgdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2700
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3468
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbzwuomgdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6532
  - - C:\Temp\i_dbzwuomgdb.exe
      C:\Temp\i_dbzwuomgdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtolgdywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2920
  - - C:\Temp\vtolgdywqo.exe
      C:\Temp\vtolgdywqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1268
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:204
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtolgdywqo.exe ups_ins
    3⤵
    PID:6008
  - - C:\Temp\i_vtolgdywqo.exe
      C:\Temp\i_vtolgdywqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtnlfdyvq.exe ups_run
    3⤵
    PID:6560
  - - C:\Temp\bvtnlfdyvq.exe
      C:\Temp\bvtnlfdyvq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2788
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3464
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtnlfdyvq.exe ups_ins
    3⤵
    PID:5448
  - - C:\Temp\i_bvtnlfdyvq.exe
      C:\Temp\i_bvtnlfdyvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkfdxvqnhf.exe ups_run
    3⤵
    PID:1420
  - - C:\Temp\nkfdxvqnhf.exe
      C:\Temp\nkfdxvqnhf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1020
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkfdxvqnhf.exe ups_ins
    3⤵
    PID:2708
  - - C:\Temp\i_nkfdxvqnhf.exe
      C:\Temp\i_nkfdxvqnhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xsqnhfausn.exe ups_run
    3⤵
    PID:6000
  - - C:\Temp\xsqnhfausn.exe
      C:\Temp\xsqnhfausn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2004
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6072
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xsqnhfausn.exe ups_ins
    3⤵
    PID:5432
  - - C:\Temp\i_xsqnhfausn.exe
      C:\Temp\i_xsqnhfausn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zurpmkecau.exe ups_run
    3⤵
    PID:6108
  - - C:\Temp\zurpmkecau.exe
      C:\Temp\zurpmkecau.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6896
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5348
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zurpmkecau.exe ups_ins
    3⤵
    PID:1580
  - - C:\Temp\i_zurpmkecau.exe
      C:\Temp\i_zurpmkecau.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzxusmkecw.exe ups_run
    3⤵
    PID:5812
  - - C:\Temp\bzxusmkecw.exe
      C:\Temp\bzxusmkecw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6080
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3048
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzxusmkecw.exe ups_ins
    3⤵
    PID:6776
  - - C:\Temp\i_bzxusmkecw.exe
      C:\Temp\i_bzxusmkecw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:7076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urpjhcztrm.exe ups_run
    3⤵
    PID:6400
  - - C:\Temp\urpjhcztrm.exe
      C:\Temp\urpjhcztrm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:7028
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2768
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urpjhcztrm.exe ups_ins
    3⤵
    PID:5808
  - - C:\Temp\i_urpjhcztrm.exe
      C:\Temp\i_urpjhcztrm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwrojhbztr.exe ups_run
    3⤵
    PID:2808
  - - C:\Temp\zwrojhbztr.exe
      C:\Temp\zwrojhbztr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1816
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4716
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwrojhbztr.exe ups_ins
    3⤵
    PID:6956
  - - C:\Temp\i_zwrojhbztr.exe
      C:\Temp\i_zwrojhbztr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvtrljdbwt.exe ups_run
    3⤵
    PID:5948
  - - C:\Temp\yvtrljdbwt.exe
      C:\Temp\yvtrljdbwt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4708
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3420
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvtrljdbwt.exe ups_ins
    3⤵
    PID:6360
  - - C:\Temp\i_yvtrljdbwt.exe
      C:\Temp\i_yvtrljdbwt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqligaytql.exe ups_run
    3⤵
    PID:3900
  - - C:\Temp\tqligaytql.exe
      C:\Temp\tqligaytql.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3636
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5040
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3068
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x31c,0x7ffe33f3c188,0x7ffe33f3c194,0x7ffe33f3c1a0
      4⤵
      PID:6588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,1235204592419863827,18392505072170666616,262144 --field-trial-handle=2312,i,478156978511419608,8710672173358596230,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
      4⤵
      PID:4712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,135492015164664936,10301519409328439328,524288 --field-trial-handle=2312,i,478156978511419608,8710672173358596230,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:11
      4⤵
      System Time Discovery
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,15269764545363942704,18156168397778693936,524288 --field-trial-handle=2312,i,478156978511419608,8710672173358596230,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:13
      4⤵
      PID:256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,12296324634949768748,13474429119405015739,2097152 --field-trial-handle=2312,i,478156978511419608,8710672173358596230,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:5524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,18421160418686511285,10068983227406172873,2097152 --field-trial-handle=2312,i,478156978511419608,8710672173358596230,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:4200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,13227266196618168652,10580149060529748291,524288 --field-trial-handle=2312,i,478156978511419608,8710672173358596230,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
      4⤵
      PID:3276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,1897767385354042342,4019166756557779617,524288 --field-trial-handle=2312,i,478156978511419608,8710672173358596230,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
      4⤵
      PID:6232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,15050922558268086700,1132807273338621998,524288 --field-trial-handle=2312,i,478156978511419608,8710672173358596230,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
      4⤵
      PID:5384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,15050922558268086700,1132807273338621998,524288 --field-trial-handle=2312,i,478156978511419608,8710672173358596230,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
      4⤵
      PID:5832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,10930757823385366838,12423705304465273929,524288 --field-trial-handle=2312,i,478156978511419608,8710672173358596230,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:14
      4⤵
      PID:6628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,2740154253982300260,3523671104218810395,524288 --field-trial-handle=2312,i,478156978511419608,8710672173358596230,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,4755455241286654982,4959557603797196225,524288 --field-trial-handle=2312,i,478156978511419608,8710672173358596230,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
      4⤵
      PID:2468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2060,i,3032528837293569187,15090458304930793776,524288 --field-trial-handle=2312,i,478156978511419608,8710672173358596230,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:14
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,11752070410760514713,574075699435337473,524288 --field-trial-handle=2312,i,478156978511419608,8710672173358596230,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
      4⤵
      PID:6712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=936,i,867984605539305223,12469375843451098948,524288 --field-trial-handle=2312,i,478156978511419608,8710672173358596230,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
      4⤵
      PID:5300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,8778085365001360981,7948121950172098306,524288 --field-trial-handle=2312,i,478156978511419608,8710672173358596230,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
      4⤵
      PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6292,i,8596324404921463056,11893509295865964431,262144 --field-trial-handle=2312,i,478156978511419608,8710672173358596230,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:10
      4⤵
      PID:4604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4060,i,3988223296174140664,5176292095012857556,524288 --field-trial-handle=2312,i,478156978511419608,8710672173358596230,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
      4⤵
      PID:6096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1928

C:\Temp\ztrljebwuomgezwr.sys
C:\Temp\ztrljebwuomgezwr.sys
1⤵
- Executes dropped EXE
PID:1428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4284

C:\Temp\gdbwtomgey.sys
C:\Temp\gdbwtomgey.sys
1⤵
- Executes dropped EXE
PID:4328

C:\Temp\nljdbvtolg.sys
C:\Temp\nljdbvtolg.sys
1⤵
- Executes dropped EXE
PID:7072

C:\Temp\dxvtnlfdxv.sys
C:\Temp\dxvtnlfdxv.sys
1⤵
- Executes dropped EXE
PID:2732

C:\Temp\icavsnkfdx.sys
C:\Temp\icavsnkfdx.sys
1⤵
- Executes dropped EXE
PID:5436

C:\Temp\uspkifaxvs.sys
C:\Temp\uspkifaxvs.sys
1⤵
- Executes dropped EXE
PID:800

C:\Temp\mkecwupmke.sys
C:\Temp\mkecwupmke.sys
1⤵
- Executes dropped EXE
PID:2868

C:\Temp\mhecwupmhe.sys
C:\Temp\mhecwupmhe.sys
1⤵
- Executes dropped EXE
PID:3344

C:\Temp\rmjhbzwuom.sys
C:\Temp\rmjhbzwuom.sys
1⤵
- Executes dropped EXE
PID:1524

C:\Temp\dbwtomgeyw.sys
C:\Temp\dbwtomgeyw.sys
1⤵
- Executes dropped EXE
PID:6864

C:\Temp\wtolgdbvto.sys
C:\Temp\wtolgdbvto.sys
1⤵
- Executes dropped EXE
PID:2652

C:\Temp\yvqoigaysq.sys
C:\Temp\yvqoigaysq.sys
1⤵
PID:1252

C:\Temp\davsnlfdxv.sys
C:\Temp\davsnlfdxv.sys
1⤵
PID:5124

C:\Temp\axsqkicaus.sys
C:\Temp\axsqkicaus.sys
1⤵
PID:5316

C:\Temp\fzxrpkhcau.sys
C:\Temp\fzxrpkhcau.sys
1⤵
PID:4492

C:\Temp\jhfzxuhecw.sys
C:\Temp\jhfzxuhecw.sys
1⤵
PID:3168

C:\Temp\romhezxrpj.sys
C:\Temp\romhezxrpj.sys
1⤵
PID:3592

C:\Temp\wtrmjhbztr.sys
C:\Temp\wtrmjhbztr.sys
1⤵
PID:5080

C:\Temp\eyvtolgbyw.sys
C:\Temp\eyvtolgbyw.sys
1⤵
PID:3580

C:\Temp\dbvtolgdyw.sys
C:\Temp\dbvtolgdyw.sys
1⤵
PID:6680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avsnlfdxvs.exe

Path C:\Temp\avsnlfdxvs.exe
Size 361KB
SHA256 e74860e73f45f684123be4393a2ca54d1f5ec9a666dc063bc8ab3c817ccf6838
MD5 5d0c6da8adc330214dfd55fb3839e7c3
SHA1 90c074d36961b432a08d72f4bb55853b11aa1286
SHA512 e8f128e059d5c517f3cb24836af80891c9f10c39a5e1deba9b0ee95411189ab9b60a56025a48519cd98444d89ec259347515f0db9a3d8919c8d0f800bc10909a
SSDEEP 6144:WflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:WflfAsiVGjSGecvX
TLSH
T17F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvtnlfdxv.sys

Path C:\Temp\dxvtnlfdxv.sys
Size 293KB
SHA256 8cc3f0cc3efb6fed290b5737601eb655572a6b09c3eb474058ae5a0ffc48136a
MD5 004ca2dc79fa4c283b75b3bd97beb400
SHA1 7c8ea1fba4a14dbe2261e3f229b1e615a10726c1
SHA512 8dd2ac439c59631562992eafb5dd780b10fbc02c58f431576307f336b5fc23f115ec3bb6cc34955d051ff7bffba8fec9af6a00ecaabba1fe838f5bc358b3e762
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwuojhuoj.exe

Path C:\Temp\ebwuojhuoj.exe
Size 361KB
SHA256 8d4ddfac068f9b322e7bd369febf894831dbac3e021a968aa92736afb02db8a9
MD5 076e85d4c690fd85d1af0b88ea10b3c2
SHA1 30371e468bb90978bd3301bc913a13a5cc8ecd90
SHA512 aaa6f1674eb5410501be1fe8d020696f9156630631ee550522a215f70478420524b2e866b5d0d5da6e3301f48897caee05d2a4bb0a30cae0e75a47636c56292f
SSDEEP 6144:xflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:xflfAsiVGjSGecvX
TLSH
T15F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdbwtomgey.sys

Path C:\Temp\gdbwtomgey.sys
Size 293KB
SHA256 a63df8e4b8802aacdb8c989d7f5fd2d8cf0a0d2bf18753f0497d2e1e3e2a430b
MD5 9ac16145216e5893bae830ba7abd3820
SHA1 dbf8d4103da1d24c7ff03479791d4afb181d2696
SHA512 b6546222391c20443a1c498bdeafca69bb3a830c51b3b8304cab65dfeb8be90c4a99a08b6b25a293a64e0d0dc94cdbe081aeb8d2a4d93af8fd346dd0ea845e81
SSDEEP 3072:ttKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:tIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_avsnlfdxvs.exe

Path C:\Temp\i_avsnlfdxvs.exe
Size 361KB
SHA256 ebfaa4b5c7aae8d9746368fd1aec29116ca1e09496d378eee61c25b5da8d0acc
MD5 4ce255995aee1be33fe88b96cdf0d502
SHA1 d20e99ea764e875a94f7a90966a44033bf31c04d
SHA512 a0f407c49978ace9efdf391d93b273a8933eb4fc87a987a81576e583f73ff001267cc546e981c4f952ee18952063f63e98211639b133f1eb8f5fe08add617d08
SSDEEP 6144:JflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:JflfAsiVGjSGecvX
TLSH
T10B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ebwuojhuoj.exe

Path C:\Temp\i_ebwuojhuoj.exe
Size 361KB
SHA256 548dcf16d00d6a42c4b4aa4b1840de77c6529e4cbde29dd34c1809092a0303dc
MD5 66b852e7215ac61b7d647b880999f784
SHA1 2bdd991ad8968a4f0ba490232bc791767ae303e8
SHA512 62843cfab87e9f6dee9da982774d76f26f34702b14fa4eb2fd07e339df3aa589dd58d586fb49e48c2087dfe313f0cca9ef414a6d4fa0bef92fb3ae1089680daf
SSDEEP 6144:PflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:PflfAsiVGjSGecvX
TLSH
T1C3747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igaytqolga.exe

Path C:\Temp\i_igaytqolga.exe
Size 361KB
SHA256 56c59999d481253a44f6c19141780b69cd8f9b53b123d14946d017fb56df8509
MD5 1a0bae725fb893503070f55461a2370f
SHA1 b26975a5f54a94904425d2504da2b45177c96d01
SHA512 3d94ee432a3569065aed5196c3db216599fa61af646c760c1c13a6118facc21ffccd75a03296bea50ab98eca3e99f6ed5d88492a38f47f2ed2e6a9be8a071068
SSDEEP 6144:OflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:OflfAsiVGjSGecvX
TLSH
T173747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsnkfdxvpn.exe

Path C:\Temp\i_vsnkfdxvpn.exe
Size 361KB
SHA256 7d4a792324e458ec2fb9350b5be0ec1c2423fa10068019b38678b482dfd821ed
MD5 b5c42017540f57c5170d01c4efe8c6e5
SHA1 d3826281498d00b7f0ce0edad72d87bef0c6837a
SHA512 6eaf062cfb74060517c31ca470bf3ebb6755d96f37aa8c1576a023bfba8a0f1a2a4206773a9d899ebc7ac51b57c4f1f282ed9fd117339cc4dcf95183e88edd37
SSDEEP 6144:2flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:2flfAsiVGjSGecvX
TLSH
T124747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wqoigebwto.exe

Path C:\Temp\i_wqoigebwto.exe
Size 361KB
SHA256 901dbfe86b9c392614d194587017046bcbbd4478226bc1623423d8163f189af9
MD5 ce578130b8eff8c114979a0d881e1e2c
SHA1 54a5659130ec9b44dd60acc703be4868212438a0
SHA512 431690e6d062ba3abb58a73d2f25513a1c52f4c7675e2e5b78a15eb160b71ecc2dc02e81635921904273fd91c7ad635bddb1f2c5eb3249ef4db0e27fc72eb8c2
SSDEEP 6144:GflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:GflfAsiVGjSGecvX
TLSH
T150747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xusmkfdxup.exe

Path C:\Temp\i_xusmkfdxup.exe
Size 361KB
SHA256 3216114558b6d28125850ca98f34a43c1ff1eac6f64aacc51b8450568e73f059
MD5 942a9897f8b91cbed974acaf34493380
SHA1 73e832597ef89125c6b9d3aaaa5be558fa63e267
SHA512 da1ae5955ddc5f53674d9eb1010cbb919e12c9e1f03ab9c4283ef2b514a324a49e4e93101786ed8b5ba55d697edc3d36cef2805556e38ddb1eedca06e739368f
SSDEEP 6144:jflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:jflfAsiVGjSGecvX
TLSH
T183747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icavsnkfdx.sys

Path C:\Temp\icavsnkfdx.sys
Size 293KB
SHA256 71b3639e9ba84a3ec715c722228f3606cbaaa89f24269198fffe61d978375cca
MD5 914772a2be2d36088258df506baedc2a
SHA1 fb1cd0e26b1c73186b25e54107dd92531007f956
SHA512 82b7231d4a0c9d69557d98c36012e54e449e0816567e6c91d6591fd5fbbe56e07a35dbd7a1ac4b03933b3c868a3919657d8f4e9591749cc51f529ae83f032cd4
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaytqolga.exe

Path C:\Temp\igaytqolga.exe
Size 361KB
SHA256 f9b441cb2e13d70406e36912589cb73190bf08dec4a569cc8fefa9c70bd04c79
MD5 86439fcd9b406da10adf0ed9134ff6cc
SHA1 ae7c089d044a5b5c4aac2a0ddc19f191fc1cf224
SHA512 287e0e982ac1aa30dd7f4499cc1ef6744d4e4eae28c1ee3652619e4746bd8684a5c6c2df6a18315104f149dc7ffc761fd141d03e8a2b01344fd6429be2e10eea
SSDEEP 6144:dflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:dflfAsiVGjSGecvX
TLSH
T105747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjhczusmke.exe

Path C:\Temp\mjhczusmke.exe
Size 361KB
SHA256 a4af822d9f10517879c1c863f170a0942eb5513dddfdf4f71ffa3c176b00d06c
MD5 13f95e113dbac48a50d798fa9efe0678
SHA1 06cace33731387b041dd936579952f2ee2bd1081
SHA512 97e1c2abdb9f61a36683469baf90ddd1477fc825ef93d278f13a46171a4fbd87658f0a4ee969ed0a801cac9f7558fe130748e5bc483ba5ca9d37f0e0299d2268
SSDEEP 6144:OflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:OflfAsiVGjSGecvX
TLSH
T16E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecwupmke.sys

Path C:\Temp\mkecwupmke.sys
Size 293KB
SHA256 b069ddfcf0b012c1efe7020a05bdfcbc9dd956d37992991e5cd238e328eb7c04
MD5 38a08b265f7daeb03efc15183c6c6e32
SHA1 c3adac7d0870364a78991e465687b8d5f1bd1d30
SHA512 00546aba27b51047b71a429a799630ce74f1a022f6d5179f1af40ae474186ab9b2db74713ac96fc165b1f260824a343fa4a455440284b9762a21a4af4e798f16
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T13A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nljdbvtolg.sys

Path C:\Temp\nljdbvtolg.sys
Size 293KB
SHA256 b94add146e57ca286d43cbf152fb1d93af808a1f18a3a6f7e7b23f752e20d69c
MD5 8ca5cda06b539185980194d376702347
SHA1 89e878c3b013bb3763a60a0e457dc1cc7b166f81
SHA512 1800d75b8039ff235d7eb0862419e2486c3e84c2e7e52f56796a1c161fc8add1f31b9dd7a166869ea993b88d33401c7fed4a579f3a0931f8ee645cf0a3a4ae62
SSDEEP 3072:QtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:QIJjiJcbI03GBc3ucY5DCSj
TLSH
T13E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uspkifaxvs.sys

Path C:\Temp\uspkifaxvs.sys
Size 293KB
SHA256 7368a0455223962ab6fb736d77541d1ca1ab360d18216f8abd6c6c568bbb2f0d
MD5 9af81ad730934b5a2bbd6dd100e6a2f8
SHA1 0d892ff41b97817e52d6ed430331919ed28e071c
SHA512 2e221c24cef6ef0e820c6e877eeee5c92b7f30c368855a8ba4cff19389716a0083c1d0e061a96d52f52071ef6eb41f5170e9f5b72767c17b9f54c46fc355e6f2
SSDEEP 3072:PtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:PIJjiJcbI03GBc3ucY5DCSj
TLSH
T14F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnkfdxvpn.exe

Path C:\Temp\vsnkfdxvpn.exe
Size 361KB
SHA256 c1a5ae0c3ac9214cccce153c74c8b5babb670b70fc31994325a1b2f347c104c3
MD5 5510ec3acfc97e79d20af3f47613c8ac
SHA1 7c0694e5602abb29f8090182790d058f4331d563
SHA512 49c2077b724af043cfc64df36536819c27f8f0c742bc32ab2d5fe3ca3b3076e0e1e5c67500756175faba8d657a5d7a9c59fca2b62afda870a060c9c9c109a169
SSDEEP 6144:IflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:IflfAsiVGjSGecvX
TLSH
T167747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqoigebwto.exe

Path C:\Temp\wqoigebwto.exe
Size 361KB
SHA256 fd876df6b2abebb0dc6fe4ca77c4f9728fdb6a9c09bbeb57d0a1f24dd529f7fb
MD5 5ef469cc6eba0928a8a01610aa79f6f6
SHA1 ce775cd22aa445bbe8f43fae2f68e8a6f12e17ca
SHA512 5852854780395fd1a20751e8cf18b332864b5aa427b08adc5a9021f9a7a239396d20c9b2750fd3191739b7c26776fcfc29e5c0cd404a3929b3e3af7a254715f9
SSDEEP 6144:FflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:FflfAsiVGjSGecvX
TLSH
T10A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xusmkfdxup.exe

Path C:\Temp\xusmkfdxup.exe
Size 361KB
SHA256 b43da7173d606b25a025e85874c0078acc0f7d80786daad06045b500d1e0192d
MD5 07908fcc9630fe31a9a2bd2d49fa16ce
SHA1 8e16f21b16c0a95e3562ff821f1790d2050a5267
SHA512 ccd9846586219295bacd3cefa0b5d73754bfe3bf27f81799a13f2c0be650049b58a05515ee1b603e35910fd1d25f892b79a5d0b6d531d770d49940b091617870
SSDEEP 6144:nflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:nflfAsiVGjSGecvX
TLSH
T140747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljebwuomgezwr.exe

Path C:\Temp\ztrljebwuomgezwr.exe
Size 361KB
SHA256 d76ef11cd85795eb9b9a42f4921ec6068c680ea06613a1b4a3508e10f495fad1
MD5 d619967f010c82e85038abffde961d83
SHA1 df382568506b62d7099c2ca8f73511a50b0d4436
SHA512 d0556d0cb5454a42d7ca7ea7762fcb3b6d90dd01edde66d9f3ff3e5e1c2a27ec101bae7012647282f484dc707245c67183b39204ea9dcbe5b0618efb71a5234e
SSDEEP 6144:LflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:LflfAsiVGjSGecvX
TLSH
T18B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljebwuomgezwr.sys

Path C:\Temp\ztrljebwuomgezwr.sys
Size 293KB
SHA256 4eeaf1d81085ef676fb029deeb18a500b4395b78f57f45357db686ba3e91cbfd
MD5 c6e071a676fb2f55cf149f79b262986d
SHA1 45c6ce0f30eaf9b1dd0c3a909df84b15c9b20c52
SHA512 d679daeb033b0f010415f0173b061d4c42e680f6656a9efa40050f78948789a4357b375f80a4425cba0f8844bdd4debb57ddd162dfec3d00e65df4658cd88ab6
SSDEEP 3072:TtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:TIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

3889a1fd-35b4-4d0d-9689-d7c398fc263f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3889a1fd-35b4-4d0d-9689-d7c398fc263f.tmp
Size 15KB
SHA256 26d1556f7dcc385cc67c3fd34489ae848c5a4462b942ba76e8afbcc7c8904f84
MD5 6de92746e06f59dec53bda5d67579851
SHA1 1a06232979d02d0c31c1a04df6c627a249952e2b
SHA512 b3e16e0d482ff1471e5ad44787d6aec25e5e3631861fc024ada4bcb6ea02527d84a84d87c60a57b53a7964a565a476ea49d759ddac7b38203fb8251c14eae743
SSDEEP 384:sxRH78m/f5s4vSN/RIysx/56/WDgsGQ+j5:sjYm/f3vQWD/5AWDgsGQG
TLSH
T15672E9156A249D7BCCDBD60DFA96BF53D3F81573A1905E44AAFC9A0C00E66EC210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0f4658828ab7a4e3c7ba09213e5c3296ca196b72066972884ce3656604175476
MD5 06608d1e4ea9b0b8666524291749cb8d
SHA1 8af398bb8ec65494a9544bf9d071f934bb54b2e2
SHA512 5d7cf765a226996b5f2af46bf25acd8c529483a6c33fb80681aef7b39c93a78b6d7e1dd12546272f0da4ca856a0fbdc3573e56ed9d5a3359886003a7b1a7d02f
TLSH
T1FEE02BA5C820BC271DFC1B1861558787E750131B3B41884B3B3C812C4FB473B4786C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b778e7eceb4805dbbbea717115cdaaef996336d33145dea9b1e4e7059d2c808b
MD5 c700ae45d7192458efb1dbce78b7096e
SHA1 748c7486da0246d1e29e40811e6973416f401d74
SHA512 5990d2e2b2194bfd45aef255db6f8db6efe56d73c815109ef632256c87388ab365fb93ecee4d59d4fd10bb944385d129827bf500becec72d90ce39d0396e3708
TLSH
T14A41AFF783F4856ECE1196F0AA186E2FCF1D0515432C7D9A89E0EE2793E3471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 4bbf99cdb9e064984aff4c93a62f20eef3110d0047f1d52c11e070db7233108d
MD5 901508638aa0283b964b159579ab5c8b
SHA1 5bf5cec78f869817dfe26e5656ac82175ff37003
SHA512 50d518d44bfe89eb4b22bb0b77d2e12ddd2bea0999b3d7b093257f58f70440451efb22c5bfff6023ef367563d874b3e2e0ce0fc4cab8fe9fa852a58086d86b8d
SSDEEP 384:sxRH7qim/f5snvuN/RIysx/56/WDNSsGQ+hB:sj2im/f8vcWD/5AWDNSsGQk
TLSH
T15672E8159A249D77CCDBE619FA96BB93D3F8117391905E44AAFC8E1C00E76ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 c18d5de947ea3280b6ae1edacc345dbbf4f7960480d3972350a40cf6234bf9f5
MD5 b651419624a950ed2880d6c0991782d8
SHA1 9e6c6e119afb67c5b40d9abdb2b081e4b8a5f845
SHA512 a0314ab4d2295e444700cb3256fa65183c44e3069cf0d8fabfa367b297bec9e94dd6911fc42da29395f6cb69b74ec86282bda9bb38e1317aba27dfddba978f95
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEobbDwzro24u:Ob4YZnE7yTWg1NfwBu1jajobHwARu
TLSH
T170E2EB3B280CCB7E4F804ADDEC29BD9A6DA8018F5AD8C95447FA450C03C6BEB551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 281e6613ccd5bc18dc0045989f57b8e51b96df835bd40f7f104237c669bdea6f
MD5 0c30edc6353783092433d41ea8f163d3
SHA1 ae02bfc21884658e208e4c781209a51feb5a03d8
SHA512 ea87f30574ad1369d498f95206a46afc77b67fe0c1c610ebfd61acf16013f1e268e40bf2a44b6f83d5a23b24c97d381086c00c5e18bf88af0a54e1599b7a0841
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9R3+:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDR9
TLSH
T1BDB25F11713F4290387EAA0C81B9981F86C2B4637519F53F7B6802A65F67E139DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 4b57bd427ae29afe4957f8eab9ec7777b0083ac1bb3bbd5938ffd4e846f365e5
MD5 2ebb82eb447c4694ba19e7ff05776cc4
SHA1 c418790225a5a91109166c06566f9b29e0807397
SHA512 f6c835625fe96f685451e5e22b890d89b1148b9781ac484104103d90a3a7ac5f96379b37200c317695c68fbd43e4fad221bd0876c747615f0d1b382c468a0677
SSDEEP 384:n8iFiZcIr8NLL8TUNTUlIR0PvuTZXLgEqfbYGTQR9XQjWELl+gpySllYJTfY81Fu:nFQrQLwgSuVbvGUIWELkgpZuTHXaBu0
TLSH
T12BF2C2F198D78973E8AE5B97633D6E069AFCC163B5888984B7D44D0CCC821BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 700c2d9b3c6b4ddd2d056f89390c58957fb38fe90bd8a908a4cf19c728c57612
MD5 54482d5c1b0e8d09bf2c61eaa611147e
SHA1 19f4c8d8d102b5fd41a25e9dcf07043bdca96322
SHA512 21e98dfe4f4ba56e2099a5290ccc9b48eb5534ea5f5870d257758239f928e2f88cbd2b1be43963f0a1ebe4825296b71f9caa61b0fb595caa1bdfdccaf6c30114
SSDEEP 384:nCiF1tNn/s3n9Sn8Ngs8TUNTUlIRiPvuTu4REqfbYGTQR9XQpLGOObjI9G6w7ia6:JF1j+9SXswgUu5UGUaG29Mi
TLSH
T1AAC25B36EC59CEB7ECE64FD8B34A7A5ADEE012A385D85AC8DAD85D0C00C719D4307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d35ac7a3e687e5e64dc04c6c2fb8ba88e6bc162ad934522655b6a4682606bfc8
MD5 9e6795deac028017647cf1948124c523
SHA1 769aad093fbeb4de26a0e193f88353c8cb373620
SHA512 efcd08512237dcb892ea83cbaf0cf44bb244bcb5d76482a103feb26cd8cb9f47debf2326221903399ecc9518aa061ce83fa0a97d6e8b7b6b4836f8057abc68bc
SSDEEP 384:nniF1tNn/s3n9SC8NLL8TUNTUlIRxPvuTZYygEqfbYGTQR9XQjWELHGgpySllYJ+:iF1j+93QLwg/uVxvGUIWELmgpZuTHXK
TLSH
T15ED25B36D855DEA7ECEB4FD8770A7646DEE412A3858C8AC8EAD85D4D00C72DD0B0BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2d8d79002537a067da3c91236209ad568b04226fcd67f7d5d811970cd1f7cc7b
MD5 807a9f89c62e3d087c63f12a5134314b
SHA1 5403348594f82798baf549016b5c97c349a7f157
SHA512 44f999e32ad05567b09c8c93055da5d6abcf5694cae79358a241daf3d90573568f64abc092de9460cce3320c0a00c1a45cfa676d61132ac7806f885b16725063
SSDEEP 384:nniF1tNn/s3n9Sn8NgL8TUNTUlIRiPvuTRPgEqfbYGTQR9XQjWELHkgpOObjI9G2:iF1j+9SXLwgUuxvGUIWELEgp29Mi
TLSH
T1C7D25D36E859CEB7ECE64FD8B34A7696DEE012A385CC9AC8E6D85D4C00C729D4707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ef61d2198702c7efab93bb95215b1cd91e0fad253556e1fb0201be033814ee2b
MD5 8192b6a67822ab301440ca019ec69d73
SHA1 f1bc6262bc129b0a2f3fdb39af571871de987369
SHA512 f6588cca204fefe276951f04ccbfa0ea62f97ef7acfe69136952a92e098834a1f133b152494126001811c1f1fb6c0aeceb9fa71ce6671858243cf8bd38d1c1b8
SSDEEP 384:nniFiZcIE8NLL8TUNTUlIR0PvuTZXygEqfbYGTQR9XQjWELHGgpySllYJTfY81Fu:iFQEQLwgSuVCvGUIWELmgpZuTHXaBu0
TLSH
T151D25B729854C9B7FCEA9FD8764AB646DEE451A3C58C8AC8EAD85E0D00C71AD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 4a504ecd5415909108c6f87486ec209bf2e48c96a568eecfee0e58ce0ce3fec0
MD5 167534bbdd96878be21bfcbed04f530c
SHA1 dacbe5192d34d359f9a265eb7d1f8f272fb90caf
SHA512 a073b3f3b4f24d869493abeaf3c6ac0648a0c0f122201eb1b53f69fed047df362834626bbe6856d11c3181a03c868b00c6ea691c51859a3bf8bf6f95f54a1a0d
SSDEEP 384:n+iFiZcIE8NLL8TUNTUlIR0PvuTZXygEqfbYGTQR9XQjWELHGgpySllYJTfY81Fu:VFQEQLwgSuVCvGUIWELmgpZuTHXaBu0
TLSH
T19ED25B729854C9B7FCEB9FD8764AB646DEE451A3C58C8AC8EAD85D0D00C71ED070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 25afb2f2bbaa4983e1dd9fbc7dbd3db3c6f90ba68a4da5cfa259e6125d7af563
MD5 df226db3e0bb4123ee114425d619b135
SHA1 8982e45bd0925562b0eae483d5f2134f34d13e37
SHA512 4ed768186ed4a8d0c2e88df140b8060a245ffc7383420454a9370e53e35b18248d0ebe303f8e0b57396fccb6bee2cd4e2aaaa633a45e7d4cd783999bf62c713c
TLSH
T1E7513DE04C381AC1D4BD0E6FB45B79FC85ECC726F4A0347D6858EA985A7A65D318483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 2f114d75a9cc6c7f1c466c3950e9951b03f0c375ccd0b1955072417997d5a019
MD5 d01a5c504c32e07b1caa569c652a6a20
SHA1 f0df32d4e03c5f5399edd122a28295f326be6681
SHA512 58ebbc60aa6b17453e7f1bd87854bbbb6fb7f93dace233f7934e151af24314152cd57aff649b8dc556e4f8a84be30f2250fbc5e5e6a0876ad737e935561b9ce0
TLSH
T1FF512EE04C382AD5D5FD0E7EB08739FC81EC9726F8A434786858EA5859BA21D249083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 26b91053fa5665c7f9dfbb70dfa8cf3e30ff195b27be968ac53fffddc337337e
MD5 f36fd20686b0cd08c1cc0cc0d1748528
SHA1 40bbca940bb397d8fef4133608ca78249c95c275
SHA512 4fa2c486c992eca274f7376f10e9a676e97bac60efdc8a18b36871bcfed51fe128d520e6e1742bd6698b2073c0305ec0e71c7ef1aa6c873a54118b55d6f8a219
TLSH
T1D85150E04C3C16D1D4BD0E3EB08739FC81EC9725F890343C6859EA585A7A21D309083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 08a293f1583d129c9e975f00f9f365bb366b9023bcc15b3612fa8cb7a3ef3e15
MD5 6a812c11f55f0456e0e0b26731680073
SHA1 843157812ee131255015c3bfa9b8c1411934d3f9
SHA512 00f516a51d1a92f8d24d8bde435a82a3ad9996b99efbbc760c7c172fcd6bd4708c0c59832474b40d0c3b04625d3fa60050b627fe415365d339382115061f24d1
TLSH
T11C515FE04C381AD1D4FD0E7EB48B78FC81EC9726F890343C6858EA985A7A21D349483F
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 85b64c4c3f1d7319c090b2ad066f833f38218c9360666bca9754ab8ca26371a1
MD5 79c49ad834f43b7600e1d86da3588d09
SHA1 9059b251175344fd168224c59480e418a28541c1
SHA512 e863ee72fc671ee259240824ccdd162817afd337e20bcbe6dee4ca7da2dc9b09dd37cb147875f214aa82c6e65765ce5d14d487796efd13214d7fff9ff9cb8395
TLSH
T1AE71238357B8C5F3C5DE5FF102835608F1FB22384B2330340B515986AB30A7A24B8F48
MD5 SHA1 SHA512 TLSH

Submit Download

memory/800-267-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/800-227-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1252-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1428-52-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1524-274-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2652-310-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2732-201-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2868-263-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3168-380-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3344-270-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3580-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3592-384-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4328-145-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4328-181-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4492-369-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5080-408-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5124-345-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5316-349-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5436-214-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6680-431-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6864-278-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/7072-180-0x0000000000010000-0x00000000000AB000-memory.dmp

Download