systex | c7f53740ae9ef55da110f00ef1e91aedc02ad0b36be4eac5130aed83c35b04a5

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260910-c2wcyawya1
SHA256 c7f53740ae9ef55da110f00ef1e91aedc02ad0b36be4eac5130aed83c35b04a5
MD5 d0bd0b01f1c91f6b72e891ba1745c117
SHA1 3d95af8862160156f4924d657e6ca7a9e745e494
SHA512 097278499eb960d6cc66cb7936ce9702d1891188fb4696575fcb17c2531870f03a86d6aeb3b6913393eabcaeb3704389a8a7fbe8ac7ef27d10b9d9a279d3dc94
SSDEEP 6144:+flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:+flfAsiVGjSGecvX
TLSH
T1F4747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4292	ifaysqkifaxvtnli.exe
4868	ifaysqkifaxvtnli.sys
2896	CreateProcess.exe
4588	pnifaysqki.exe
5012	CreateProcess.exe
1624	CreateProcess.exe
1840	i_pnifaysqki.exe
4200	faysqkifax.sys
2084	CreateProcess.exe
3236	fcaxspkhfd.exe
2716	CreateProcess.exe
4952	CreateProcess.exe
5160	i_fcaxspkhfd.exe
1136	faxspnhfzx.sys
5388	CreateProcess.exe
5384	spkhfzxusm.exe
5860	CreateProcess.exe
2592	CreateProcess.exe
4124	i_spkhfzxusm.exe
1412	pmkhczxusm.sys
3456	CreateProcess.exe
3112	xrpkhczurm.exe
2660	CreateProcess.exe
1752	CreateProcess.exe
4220	i_xrpkhczurm.exe
4376	zwuomhecwu.sys
1224	CreateProcess.exe
2264	wuomhezwrp.exe
5280	CreateProcess.exe
4688	CreateProcess.exe
5828	i_wuomhezwrp.exe
3080	hezwjgbzwr.sys
1976	CreateProcess.exe
5152	zwqoljebzw.exe
2816	CreateProcess.exe
4940	CreateProcess.exe
3332	i_zwqoljebzw.exe
5424	geywrojgby.sys
1344	CreateProcess.exe
2368	jgbywrojyt.exe
3644	CreateProcess.exe
5064	CreateProcess.exe
4644	i_jgbywrojyt.exe
6036	tqljdbvtnl.sys
4552	CreateProcess.exe
4788	qolgeywqoi.exe
4844	CreateProcess.exe
6092	CreateProcess.exe
4972	i_qolgeywqoi.exe
4476	nlfdyvtnlf.sys
1520	CreateProcess.exe
4988	gdyvqnigay.exe
1672	CreateProcess.exe
5460	CreateProcess.exe
3256	i_gdyvqnigay.exe
5656	xvsnkfdavs.sys
1876	CreateProcess.exe
1572	xvsnlfdxvp.exe
4572	CreateProcess.exe
2968	CreateProcess.exe
5020	i_xvsnlfdxvp.exe
1800	xvpnkfcxvp.sys
4268	CreateProcess.exe
4440	smkhfzuspk.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_1295829244\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_462897546\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_1687062629\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_1687062629\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_1687062629\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_828842667\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_1295829244\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_462897546\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_1687062629\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_828842667\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_828842667\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_828842667\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_865949003\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbywrojyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkhfzuspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusmkhfcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljgecwuroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljgecwuroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqoigeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcaxspkhfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomhezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdyvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausnkecxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpkhczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzwuoljgbo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqoigeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqnlgdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkhfzxusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvsnlfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzwuoljgbo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvqnifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvqnifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlicavsnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwqoljebzw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusmkhfcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqnlgdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkhfzuspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlicavsnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcaxspkhfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwqoljebzw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbywrojyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qolgeywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaysqkifaxvtnli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpkhczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qolgeywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdyvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvsnlfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkhfzxusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomhezwrp.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3188	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5288	ipconfig.exe
4816	ipconfig.exe
4264	ipconfig.exe
4484	ipconfig.exe
5932	ipconfig.exe
2328	ipconfig.exe
5900	ipconfig.exe
5672	ipconfig.exe
6076	ipconfig.exe
1136	ipconfig.exe
1532	ipconfig.exe
6096	ipconfig.exe
5404	ipconfig.exe
5964	ipconfig.exe
4352	ipconfig.exe
4312	ipconfig.exe
2988	ipconfig.exe
1844	ipconfig.exe
1508	ipconfig.exe
4620	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334813028994802"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{5FE592DC-DF08-439A-8368-3C45E07CC702}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4292	ifaysqkifaxvtnli.exe
4292	ifaysqkifaxvtnli.exe
4292	ifaysqkifaxvtnli.exe
4292	ifaysqkifaxvtnli.exe
4292	ifaysqkifaxvtnli.exe
4292	ifaysqkifaxvtnli.exe
4292	ifaysqkifaxvtnli.exe
4292	ifaysqkifaxvtnli.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1840	i_pnifaysqki.exe
Token: SeDebugPrivilege	5160	i_fcaxspkhfd.exe
Token: SeDebugPrivilege	4124	i_spkhfzxusm.exe
Token: SeDebugPrivilege	4220	i_xrpkhczurm.exe
Token: SeDebugPrivilege	5828	i_wuomhezwrp.exe
Token: SeDebugPrivilege	3332	i_zwqoljebzw.exe
Token: SeDebugPrivilege	4644	i_jgbywrojyt.exe
Token: SeDebugPrivilege	4972	i_qolgeywqoi.exe
Token: SeDebugPrivilege	3256	i_gdyvqnigay.exe
Token: SeDebugPrivilege	5020	i_xvsnlfdxvp.exe
Token: SeDebugPrivilege	5628	i_smkhfzuspk.exe
Token: SeDebugPrivilege	3680	i_xusmkhfcxu.exe
Token: SeDebugPrivilege	3844	i_pmkecwuomh.exe
Token: SeDebugPrivilege	3080	i_ljgecwuroj.exe
Token: SeDebugPrivilege	5480	i_bzwuoljgbo.exe
Token: SeDebugPrivilege	5936	i_eywqoigeyw.exe
Token: SeDebugPrivilege	3232	i_yvqnlgdyvq.exe
Token: SeDebugPrivilege	3544	i_lfdxvqnifd.exe
Token: SeDebugPrivilege	4728	i_nlicavsnki.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5040	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 4292	4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4004 wrote to memory of 4496	4004	2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 4496 wrote to memory of 5040	4496	iexplore.exe	91
PID 5040 wrote to memory of 1160	5040	msedge.exe	92
PID 5040 wrote to memory of 2788	5040	msedge.exe	93
PID 5040 wrote to memory of 3188	5040	msedge.exe	94
PID 5040 wrote to memory of 2788	5040	msedge.exe	93
PID 5040 wrote to memory of 2788	5040	msedge.exe	93
PID 5040 wrote to memory of 2120	5040	msedge.exe	95
PID 5040 wrote to memory of 2120	5040	msedge.exe	95
PID 5040 wrote to memory of 1500	5040	msedge.exe	97
PID 5040 wrote to memory of 4288	5040	msedge.exe	98
PID 5040 wrote to memory of 1500	5040	msedge.exe	97
PID 5040 wrote to memory of 1500	5040	msedge.exe	97
PID 5040 wrote to memory of 4288	5040	msedge.exe	98
PID 5040 wrote to memory of 4288	5040	msedge.exe	98
PID 5040 wrote to memory of 1420	5040	msedge.exe	99
PID 5040 wrote to memory of 5048	5040	msedge.exe	100
PID 5040 wrote to memory of 1420	5040	msedge.exe	99
PID 5040 wrote to memory of 1420	5040	msedge.exe	99
PID 5040 wrote to memory of 5048	5040	msedge.exe	100
PID 5040 wrote to memory of 5048	5040	msedge.exe	100
PID 5040 wrote to memory of 1308	5040	msedge.exe	101
PID 5040 wrote to memory of 1308	5040	msedge.exe	101
PID 5040 wrote to memory of 2672	5040	msedge.exe	106
PID 5040 wrote to memory of 3572	5040	msedge.exe	105
PID 5040 wrote to memory of 2672	5040	msedge.exe	106
PID 5040 wrote to memory of 3572	5040	msedge.exe	105
PID 5040 wrote to memory of 4472	5040	msedge.exe	108
PID 5040 wrote to memory of 764	5040	msedge.exe	109
PID 5040 wrote to memory of 764	5040	msedge.exe	109
PID 4292 wrote to memory of 2896	4292	ifaysqkifaxvtnli.exe	110
PID 4588 wrote to memory of 5012	4588	pnifaysqki.exe	115
PID 5040 wrote to memory of 1496	5040	msedge.exe	118
PID 5040 wrote to memory of 1496	5040	msedge.exe	118
PID 4292 wrote to memory of 1624	4292	ifaysqkifaxvtnli.exe	120
PID 4292 wrote to memory of 2084	4292	ifaysqkifaxvtnli.exe	124
PID 3236 wrote to memory of 2716	3236	fcaxspkhfd.exe	126
PID 4292 wrote to memory of 4952	4292	ifaysqkifaxvtnli.exe	129
PID 4292 wrote to memory of 5388	4292	ifaysqkifaxvtnli.exe	133
PID 5384 wrote to memory of 5860	5384	spkhfzxusm.exe	135
PID 4292 wrote to memory of 2592	4292	ifaysqkifaxvtnli.exe	138
PID 4292 wrote to memory of 3456	4292	ifaysqkifaxvtnli.exe	142
PID 3112 wrote to memory of 2660	3112	xrpkhczurm.exe	144
PID 4292 wrote to memory of 1752	4292	ifaysqkifaxvtnli.exe	148
PID 5040 wrote to memory of 3100	5040	msedge.exe	150
PID 5040 wrote to memory of 5068	5040	msedge.exe	151
PID 5040 wrote to memory of 1660	5040	msedge.exe	152
PID 4292 wrote to memory of 1224	4292	ifaysqkifaxvtnli.exe	155
PID 2264 wrote to memory of 5280	2264	wuomhezwrp.exe	157
PID 4292 wrote to memory of 4688	4292	ifaysqkifaxvtnli.exe	160
PID 4292 wrote to memory of 1976	4292	ifaysqkifaxvtnli.exe	164
PID 5152 wrote to memory of 2816	5152	zwqoljebzw.exe	166
PID 4292 wrote to memory of 4940	4292	ifaysqkifaxvtnli.exe	169
PID 4292 wrote to memory of 1344	4292	ifaysqkifaxvtnli.exe	173
PID 2368 wrote to memory of 3644	2368	jgbywrojyt.exe	175
PID 4292 wrote to memory of 5064	4292	ifaysqkifaxvtnli.exe	178
PID 4292 wrote to memory of 4552	4292	ifaysqkifaxvtnli.exe	182
PID 4788 wrote to memory of 4844	4788	qolgeywqoi.exe	184
PID 4292 wrote to memory of 6092	4292	ifaysqkifaxvtnli.exe	187
PID 5040 wrote to memory of 2124	5040	msedge.exe	189
PID 5040 wrote to memory of 2124	5040	msedge.exe	189
PID 4292 wrote to memory of 1520	4292	ifaysqkifaxvtnli.exe	195
PID 4988 wrote to memory of 1672	4988	gdyvqnigay.exe	197

C:\Users\Admin\AppData\Local\Temp\2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_d0bd0b01f1c91f6b72e891ba1745c117_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Temp\ifaysqkifaxvtnli.exe
  C:\Temp\ifaysqkifaxvtnli.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnifaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2896
  - - C:\Temp\pnifaysqki.exe
      C:\Temp\pnifaysqki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4588
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5012
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnifaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1624
  - - C:\Temp\i_pnifaysqki.exe
      C:\Temp\i_pnifaysqki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcaxspkhfd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2084
  - - C:\Temp\fcaxspkhfd.exe
      C:\Temp\fcaxspkhfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3236
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2716
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcaxspkhfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4952
  - - C:\Temp\i_fcaxspkhfd.exe
      C:\Temp\i_fcaxspkhfd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkhfzxusm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5388
  - - C:\Temp\spkhfzxusm.exe
      C:\Temp\spkhfzxusm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5384
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkhfzxusm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2592
  - - C:\Temp\i_spkhfzxusm.exe
      C:\Temp\i_spkhfzxusm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpkhczurm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3456
  - - C:\Temp\xrpkhczurm.exe
      C:\Temp\xrpkhczurm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3112
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2660
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpkhczurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1752
  - - C:\Temp\i_xrpkhczurm.exe
      C:\Temp\i_xrpkhczurm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomhezwrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1224
  - - C:\Temp\wuomhezwrp.exe
      C:\Temp\wuomhezwrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2264
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5280
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomhezwrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4688
  - - C:\Temp\i_wuomhezwrp.exe
      C:\Temp\i_wuomhezwrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwqoljebzw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1976
  - - C:\Temp\zwqoljebzw.exe
      C:\Temp\zwqoljebzw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5152
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2816
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwqoljebzw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4940
  - - C:\Temp\i_zwqoljebzw.exe
      C:\Temp\i_zwqoljebzw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgbywrojyt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1344
  - - C:\Temp\jgbywrojyt.exe
      C:\Temp\jgbywrojyt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2368
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3644
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgbywrojyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5064
  - - C:\Temp\i_jgbywrojyt.exe
      C:\Temp\i_jgbywrojyt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qolgeywqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4552
  - - C:\Temp\qolgeywqoi.exe
      C:\Temp\qolgeywqoi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4788
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4844
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qolgeywqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6092
  - - C:\Temp\i_qolgeywqoi.exe
      C:\Temp\i_qolgeywqoi.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdyvqnigay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1520
  - - C:\Temp\gdyvqnigay.exe
      C:\Temp\gdyvqnigay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4988
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1672
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdyvqnigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5460
  - - C:\Temp\i_gdyvqnigay.exe
      C:\Temp\i_gdyvqnigay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvsnlfdxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1876
  - - C:\Temp\xvsnlfdxvp.exe
      C:\Temp\xvsnlfdxvp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1572
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4572
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvsnlfdxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2968
  - - C:\Temp\i_xvsnlfdxvp.exe
      C:\Temp\i_xvsnlfdxvp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkhfzuspk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4268
  - - C:\Temp\smkhfzuspk.exe
      C:\Temp\smkhfzuspk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4440
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4420
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkhfzuspk.exe ups_ins
    3⤵
    PID:1460
  - - C:\Temp\i_smkhfzuspk.exe
      C:\Temp\i_smkhfzuspk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xusmkhfcxu.exe ups_run
    3⤵
    PID:764
  - - C:\Temp\xusmkhfcxu.exe
      C:\Temp\xusmkhfcxu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2880
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5656
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xusmkhfcxu.exe ups_ins
    3⤵
    PID:1536
  - - C:\Temp\i_xusmkhfcxu.exe
      C:\Temp\i_xusmkhfcxu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmkecwuomh.exe ups_run
    3⤵
    PID:1804
  - - C:\Temp\pmkecwuomh.exe
      C:\Temp\pmkecwuomh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:860
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5328
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmkecwuomh.exe ups_ins
    3⤵
    PID:2612
  - - C:\Temp\i_pmkecwuomh.exe
      C:\Temp\i_pmkecwuomh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljgecwuroj.exe ups_run
    3⤵
    PID:4376
  - - C:\Temp\ljgecwuroj.exe
      C:\Temp\ljgecwuroj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:128
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2476
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljgecwuroj.exe ups_ins
    3⤵
    PID:2728
  - - C:\Temp\i_ljgecwuroj.exe
      C:\Temp\i_ljgecwuroj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzwuoljgbo.exe ups_run
    3⤵
    PID:3676
  - - C:\Temp\bzwuoljgbo.exe
      C:\Temp\bzwuoljgbo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:620
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5772
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzwuoljgbo.exe ups_ins
    3⤵
    PID:5272
  - - C:\Temp\i_bzwuoljgbo.exe
      C:\Temp\i_bzwuoljgbo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywqoigeyw.exe ups_run
    3⤵
    PID:5424
  - - C:\Temp\eywqoigeyw.exe
      C:\Temp\eywqoigeyw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4592
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1508
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywqoigeyw.exe ups_ins
    3⤵
    PID:2544
  - - C:\Temp\i_eywqoigeyw.exe
      C:\Temp\i_eywqoigeyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvqnlgdyvq.exe ups_run
    3⤵
    PID:4372
  - - C:\Temp\yvqnlgdyvq.exe
      C:\Temp\yvqnlgdyvq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1156
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4692
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvqnlgdyvq.exe ups_ins
    3⤵
    PID:1844
  - - C:\Temp\i_yvqnlgdyvq.exe
      C:\Temp\i_yvqnlgdyvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdxvqnifd.exe ups_run
    3⤵
    PID:3912
  - - C:\Temp\lfdxvqnifd.exe
      C:\Temp\lfdxvqnifd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4652
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdxvqnifd.exe ups_ins
    3⤵
    PID:5680
  - - C:\Temp\i_lfdxvqnifd.exe
      C:\Temp\i_lfdxvqnifd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlicavsnki.exe ups_run
    3⤵
    PID:5968
  - - C:\Temp\nlicavsnki.exe
      C:\Temp\nlicavsnki.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1296
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlicavsnki.exe ups_ins
    3⤵
    PID:5624
  - - C:\Temp\i_nlicavsnki.exe
      C:\Temp\i_nlicavsnki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ausnkecxvp.exe ups_run
    3⤵
    PID:3784
  - - C:\Temp\ausnkecxvp.exe
      C:\Temp\ausnkecxvp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3100
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2832
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4312
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc6c05c188,0x7ffc6c05c194,0x7ffc6c05c1a0
      4⤵
      PID:1160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,2909529031086445134,5251891787464514298,262144 --field-trial-handle=2628,i,15998671950630747889,11937951524619861196,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:2
      4⤵
      PID:2788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,6600309407614934241,13886069533642760390,524288 --field-trial-handle=2628,i,15998671950630747889,11937951524619861196,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:11
      4⤵
      System Time Discovery
      PID:3188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2044,i,10649480024975519686,10663389817798874240,524288 --field-trial-handle=2628,i,15998671950630747889,11937951524619861196,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:13
      4⤵
      PID:2120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,1139131434604974399,17001876264455500085,2097152 --field-trial-handle=2628,i,15998671950630747889,11937951524619861196,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:1500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,9455766779022346707,12436887798909725308,2097152 --field-trial-handle=2628,i,15998671950630747889,11937951524619861196,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:4288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,9211313939707672402,5512613678064609262,2097152 --field-trial-handle=2628,i,15998671950630747889,11937951524619861196,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:1
      4⤵
      PID:1420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,7195580908197371416,372253017663567963,2097152 --field-trial-handle=2628,i,15998671950630747889,11937951524619861196,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:9
      4⤵
      PID:5048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,16077072323046282667,17608068918814760855,524288 --field-trial-handle=2628,i,15998671950630747889,11937951524619861196,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
      4⤵
      PID:1308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,8995506595134525976,17113871065624907601,524288 --field-trial-handle=2628,i,15998671950630747889,11937951524619861196,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
      4⤵
      PID:3572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,9494232580041460890,13748497247669483631,524288 --field-trial-handle=2628,i,15998671950630747889,11937951524619861196,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
      4⤵
      PID:2672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,15079030026278691709,10146212440379174837,524288 --field-trial-handle=2628,i,15998671950630747889,11937951524619861196,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
      4⤵
      PID:5404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,15079030026278691709,10146212440379174837,524288 --field-trial-handle=2628,i,15998671950630747889,11937951524619861196,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
      4⤵
      PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,3501138991640166714,1612151264663425559,524288 --field-trial-handle=2628,i,15998671950630747889,11937951524619861196,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
      4⤵
      PID:764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,17485126951267880790,15371972782566159618,524288 --field-trial-handle=2628,i,15998671950630747889,11937951524619861196,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
      4⤵
      PID:1496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,14972087361989747124,10074940321835263901,524288 --field-trial-handle=2628,i,15998671950630747889,11937951524619861196,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
      4⤵
      PID:3100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,17866591448040977989,12963565007053496072,524288 --field-trial-handle=2628,i,15998671950630747889,11937951524619861196,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
      4⤵
      PID:5068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,8286325107335305022,10102584876324420455,524288 --field-trial-handle=2628,i,15998671950630747889,11937951524619861196,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
      4⤵
      PID:1660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,17989062329563657639,15580008321936653577,524288 --field-trial-handle=2628,i,15998671950630747889,11937951524619861196,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
      4⤵
      PID:2124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,51146370464739881,87413583397878188,524288 --field-trial-handle=2628,i,15998671950630747889,11937951524619861196,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
      4⤵
      PID:1508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,8655538286640909480,3052763525595545253,524288 --field-trial-handle=2628,i,15998671950630747889,11937951524619861196,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
      4⤵
      PID:1600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,2832109485321440031,12173039283304708891,524288 --field-trial-handle=2628,i,15998671950630747889,11937951524619861196,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:14
      4⤵
      PID:1348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5112,i,13494213075391190584,1112174894824456120,262144 --field-trial-handle=2628,i,15998671950630747889,11937951524619861196,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:10
      4⤵
      PID:4136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,16612940747168429231,13067006235576408058,524288 --field-trial-handle=2628,i,15998671950630747889,11937951524619861196,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
      4⤵
      PID:2832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,7556222447569755686,12681043866077351904,524288 --field-trial-handle=2628,i,15998671950630747889,11937951524619861196,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:3844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2816

C:\Temp\ifaysqkifaxvtnli.sys
C:\Temp\ifaysqkifaxvtnli.sys
1⤵
- Executes dropped EXE
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2784

C:\Temp\faysqkifax.sys
C:\Temp\faysqkifax.sys
1⤵
- Executes dropped EXE
PID:4200

C:\Temp\faxspnhfzx.sys
C:\Temp\faxspnhfzx.sys
1⤵
- Executes dropped EXE
PID:1136

C:\Temp\pmkhczxusm.sys
C:\Temp\pmkhczxusm.sys
1⤵
- Executes dropped EXE
PID:1412

C:\Temp\zwuomhecwu.sys
C:\Temp\zwuomhecwu.sys
1⤵
- Executes dropped EXE
PID:4376

C:\Temp\hezwjgbzwr.sys
C:\Temp\hezwjgbzwr.sys
1⤵
- Executes dropped EXE
PID:3080

C:\Temp\geywrojgby.sys
C:\Temp\geywrojgby.sys
1⤵
- Executes dropped EXE
PID:5424

C:\Temp\tqljdbvtnl.sys
C:\Temp\tqljdbvtnl.sys
1⤵
- Executes dropped EXE
PID:6036

C:\Temp\nlfdyvtnlf.sys
C:\Temp\nlfdyvtnlf.sys
1⤵
- Executes dropped EXE
PID:4476

C:\Temp\xvsnkfdavs.sys
C:\Temp\xvsnkfdavs.sys
1⤵
- Executes dropped EXE
PID:5656

C:\Temp\xvpnkfcxvp.sys
C:\Temp\xvpnkfcxvp.sys
1⤵
- Executes dropped EXE
PID:1800

C:\Temp\ausmkecaus.sys
C:\Temp\ausmkecaus.sys
1⤵
PID:1408

C:\Temp\rpmkebzurm.sys
C:\Temp\rpmkebzurm.sys
1⤵
PID:4644

C:\Temp\wuomzwrpjh.sys
C:\Temp\wuomzwrpjh.sys
1⤵
PID:4840

C:\Temp\wtrljgebwt.sys
C:\Temp\wtrljgebwt.sys
1⤵
PID:4260

C:\Temp\bwtqljdbvt.sys
C:\Temp\bwtqljdbvt.sys
1⤵
PID:4200

C:\Temp\ayvtnljdbv.sys
C:\Temp\ayvtnljdbv.sys
1⤵
PID:2284

C:\Temp\vqnigaysqo.sys
C:\Temp\vqnigaysqo.sys
1⤵
PID:4472

C:\Temp\nifdxvsnkf.sys
C:\Temp\nifdxvsnkf.sys
1⤵
PID:3996

C:\Temp\fcxvpnhfzx.sys
C:\Temp\fcxvpnhfzx.sys
1⤵
PID:6036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

faxspnhfzx.sys

Path C:\Temp\faxspnhfzx.sys
Size 293KB
SHA256 cef846b91f890a8b3bea1f3215bdf571b6afc7b5425a42f492f04bbe2218abc7
MD5 d53b54a74ef707df6daf0eee414ad41d
SHA1 b8efa2738cbc8c5d3f79be943d85a4c6ac070fd7
SHA512 66910702ea3cbf7b568a7b9ef90689946379ed61f6c4947bdb77b278d65206480e3c1484192205fe2afca8e0e287b7ddde7930a931085d78432f70efc32b295c
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T166545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faysqkifax.sys

Path C:\Temp\faysqkifax.sys
Size 293KB
SHA256 81f0dd1b11bde6034dfd85bd1686519f71bc400af278772b54749716a3d4f07e
MD5 11599fc65aee45665f6c8e9b97f0119a
SHA1 6d69372a7d0c579e8d1804e80082d06b24abbac0
SHA512 ac7581da60215826eb7520ae1e383d3763c22e583f605dd4737609d54d3502e6d2d080ca61e660910c32716ac673b15b68a7814abe8ed32c21e09ffeba0f5a4a
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T153545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcaxspkhfd.exe

Path C:\Temp\fcaxspkhfd.exe
Size 361KB
SHA256 cdbdc9669d755718eee57514734562ed36d80c24c7066e987bc473870bf08603
MD5 26e5c23034a022d39040a27fd3043123
SHA1 e203a582015292cd102a41e47e1f03bc405853c0
SHA512 ddbe9aee3d76628d5b93f36fbfa93638040f645876bd1a42e2aa57ed80e7d5181745b69d8dcb7d3ee5dd4baef02f513fe011640acafbfc6078ec81f5817be46f
SSDEEP 6144:7flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:7flfAsiVGjSGecvX
TLSH
T183747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hezwjgbzwr.sys

Path C:\Temp\hezwjgbzwr.sys
Size 293KB
SHA256 651fce14b056cf50eb899d2b900b200c2fa7e3ccb5ae37d43f42e2f8665e7bf0
MD5 d6f9a1712c97d6ff7fcebe2761ec03b8
SHA1 f44a053f92d74efb4ea487b0c0645c7a928911c3
SHA512 84cae0ca8845bf410a1c713a0020c48facfbee0ee9168ac45c547d8f5196b9a76d762bc8a2f30b902e69f596f6bb7a2de1409f27660f9e935fe3996703561b37
SSDEEP 3072:YtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:YIJjiJcbI03GBc3ucY5DCSj
TLSH
T17B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fcaxspkhfd.exe

Path C:\Temp\i_fcaxspkhfd.exe
Size 361KB
SHA256 9d26b977873cea5c5baf02723e98cad7fed2d628d8e05a5a34ff1f012cf1d544
MD5 1571e0a2b0abbe93c4a386ce966be93f
SHA1 746a76a3a9d369f69a9f49a0bb154f0c424d4e91
SHA512 5fa41c920087dffc90519601d9ab7798cde551326bae434199c4a1588c26e3a1c39350cba0ab2f3ee36edeab27a7a9eb183e4d6cc33edcf742ac4290b47d12cd
SSDEEP 6144:tflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:tflfAsiVGjSGecvX
TLSH
T158747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnifaysqki.exe

Path C:\Temp\i_pnifaysqki.exe
Size 361KB
SHA256 0d754ea6afee21e506c8b65d28fed69d53a59a3c4cb385dc8ac7541b29a97a7c
MD5 28a2515d810bbd41201078f74af498d5
SHA1 3817228ed8541c02ec9c346bf4a2f75eb3eec214
SHA512 5889bcaa4d81796901ab7fb824505db032261197483b5f18566269001613d4308352d029deb94e8ed0707e16ff75aabb59a44450fc25a925380e12827595bf62
SSDEEP 6144:vflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:vflfAsiVGjSGecvX
TLSH
T127747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_spkhfzxusm.exe

Path C:\Temp\i_spkhfzxusm.exe
Size 361KB
SHA256 5f1721895dca9a775bc891d899a06e018d38f635721904d5b7d78abb6db18679
MD5 a83c85835731569f66e9d6e68e120071
SHA1 7b17fe807bca271b0eee8c0001c9c29ef2709396
SHA512 dbda1744fb321431343c6dd70a5b4d33d6f38b6e06ff63eed07f243df636a9963e3bfabd6a6eda44afd21e7a98993d1632b66911f496a907caf2964bf37db068
SSDEEP 6144:cflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:cflfAsiVGjSGecvX
TLSH
T1A3747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wuomhezwrp.exe

Path C:\Temp\i_wuomhezwrp.exe
Size 361KB
SHA256 710ecd43c30b1f5ea575f061c6f8c61ac412722d46ba7aeb51fa25fb147b6e52
MD5 79228d92efac21d2ec450d837780edbc
SHA1 aea8ebf948ef8e1c3a1b16f2c257daf20cb4e8f2
SHA512 f56164e9ccc57f0caa85e1b0aa4decd5d2295427a4f6e9f63e9eb355708e71bc59ee2a2664e8887bbf58013dcc3d43d039d77d6df888d3f3e2c433a68cb8ede0
SSDEEP 6144:1flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:1flfAsiVGjSGecvX
TLSH
T1D3747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xrpkhczurm.exe

Path C:\Temp\i_xrpkhczurm.exe
Size 361KB
SHA256 206233187e611103a983aa5c7844095c5e15262d6ad3529f14b21ccd2ac9a979
MD5 7ad9920c0f6e147d13dce80af5a8c1d8
SHA1 66f7795bdc937bf4cdd6a77353c61df97068744e
SHA512 5fdcb24a77945ff7571d5a2ff88e92a1e871dde265bb86f0529de516b4d3de62d8364ecc4be472deb0b91f32d2d3fa60b9d54f9cbf3720053a9a1ba79ed236a6
SSDEEP 6144:4flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:4flfAsiVGjSGecvX
TLSH
T1A9747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaysqkifaxvtnli.exe

Path C:\Temp\ifaysqkifaxvtnli.exe
Size 361KB
SHA256 517967c41c845d9909d9001028a25771f4e9c6cc28c76473e3d92f3d684cfb2f
MD5 dcfb9a3390c494b768ee9ed5ad0d8139
SHA1 4baa9fa7d2aa53d36792fde4288f6a3213fde3d6
SHA512 eb4e4955f7e028e6b0875549cb7c2b1ec36fa4ed0bd2646b3cbb017320c0b3fc370b447b8b006555c28a7afb6b51f94b99850379ee007d9500036cfb4267b9cb
SSDEEP 6144:iflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:iflfAsiVGjSGecvX
TLSH
T1CE747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaysqkifaxvtnli.sys

Path C:\Temp\ifaysqkifaxvtnli.sys
Size 293KB
SHA256 4373c219978c9772f2a223b76db4cb71515438406201c0fb64fd4e26a0a0ea64
MD5 5f7b335e3a9fd9f81feb95efe0682866
SHA1 422219fd53eceafe2211d322a6fd19098d7b9792
SHA512 d0cdbf9afc9a253c0cbd08144a65751031fb0ef8047649af8a6a11be66e1a01b30d0a1bf1a5d93ddf21548a9a77eeff17969e64f0944852c416933c2a752f91a
SSDEEP 3072:itKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:iIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmkhczxusm.sys

Path C:\Temp\pmkhczxusm.sys
Size 293KB
SHA256 b5f397751fe6234ed221be5b32f1c742e6d391016739d22407260995ad5f2d95
MD5 e5dcc627117fd4e4113eece7d178344f
SHA1 c86ddc8f4ea9c1a54a0b11ca0f6749709e612ce1
SHA512 82352eec943e550f902a08ded8017d1ae916912154607cb573380a21914a497a3d366e3a1db49799c46894d674b777a95cdc1d586f9d60b3ffb60d796ba89830
SSDEEP 3072:StKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:SIJjiJcbI03GBc3ucY5DCSj
TLSH
T18C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnifaysqki.exe

Path C:\Temp\pnifaysqki.exe
Size 361KB
SHA256 590b2cdb1428d5b27cf149e2a530f0feb1c1e477b8cc44ffa99cf83c38dcb6e5
MD5 0cf58bb870bd66eaa27450ea754629bb
SHA1 5c125bced91a105114c65f479c114215399337e0
SHA512 14392c4f3f924a736436c035fae0054f23274b0e0db8b33c364c3e1a94f8eddf4694f8be31fdd2681136c3bfab4d9fffb6378f12aa43f34c7bb7b969a10383b6
SSDEEP 6144:CflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:CflfAsiVGjSGecvX
TLSH
T16A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkhfzxusm.exe

Path C:\Temp\spkhfzxusm.exe
Size 361KB
SHA256 0c85f1bc17824499dc4844f07cc6fbc5c165603393013d9b63a6e88671f448ce
MD5 6fdea330ca3220f845ed03684d69e695
SHA1 b9a00fe74781dd3f90fdcb93b8c3de807cab84fd
SHA512 636a3e124bbd0198ae6ac971dbbfff7ffce1770245eb80afc8b3f4cc3c69e3d06862ab09fb39680b5d2a2d75324a0f273b866e6f712d932ab4dc3fc3027c0eb2
SSDEEP 6144:/flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:/flfAsiVGjSGecvX
TLSH
T16A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomhezwrp.exe

Path C:\Temp\wuomhezwrp.exe
Size 361KB
SHA256 ba703bd5957574b83663d4fc799e84c6573716821100adb6c6c6a0d6761ed867
MD5 9b2f6694b788d9131143129bac709cd2
SHA1 b13931f30c2b93e38f33dee2c6a3d735cd3cb435
SHA512 8b784122d958a15b3e1a00416215e51e557c7ed5de1dbb7dd5fb31a29a236ce3bab2fafdbeadb9351e97be8b8cc4caa50fc720645c8220b6e1beeaaa9b76de56
SSDEEP 6144:OflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:OflfAsiVGjSGecvX
TLSH
T133747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpkhczurm.exe

Path C:\Temp\xrpkhczurm.exe
Size 361KB
SHA256 9aa7ad86f91848f905a9c5169aed9389e08c28d8f28b67d7d88e33b252478aa1
MD5 6f8029938efd70d3abec4edd01fe4630
SHA1 cde62a79d1da8aa3d68fb8e366d7edec46a002f2
SHA512 dcdbf3f2c7f2c34da20b35ab6bdbf296e0615c600fbf72d7fc5cd84a2fce6873fc1f275de1c413a273546d1cd7b484c4622c3871708dda007c7c962db1e26762
SSDEEP 6144:NhflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:jflfAsiVGjSGecvX
TLSH
T10E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwqoljebzw.exe

Path C:\Temp\zwqoljebzw.exe
Size 361KB
SHA256 f186edb6a29ec5ee4ac06a72339f4fc8ac9a89e9b1d39928329f07414e32dcc1
MD5 70a44080fe2fa3887544576a273ca351
SHA1 87f3429d51f8f79770ae570bf4844fece27cba29
SHA512 405c0f4794aad1835818f61c39508536d56b27817189b0cd2c80daf7ee19f45e6659480407058f95437fef89154317291a36e677187e21e97b81d160853a9d97
SSDEEP 6144:nflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:nflfAsiVGjSGecvX
TLSH
T1BD747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwuomhecwu.sys

Path C:\Temp\zwuomhecwu.sys
Size 293KB
SHA256 f6154f039e1908505c43bb4ed3b4057f32235f7086bde0520ed1c960e1cb62cf
MD5 9ab747c949fd793697024743d349b556
SHA1 a20eb6408f66653af981d18dbeb28cb78f503ffb
SHA512 122ae5fd511450a637aa995e563fdbab49cec845eda1ddf7bb06cec82377b3996b2df60329d45462c217ec82c56d690edf36c1f5575a4018dd03032c66f1bdf3
SSDEEP 3072:rtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:rIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 a6673ce49b12fdcbb7d76835e1b016504a29767f7212d8e801c405cb7104ab24
MD5 ca6c08209c2d38cddd20d85d8c5dc47a
SHA1 cec1cabd103f18062e7cb4e4d6f0d8b419a6c0bd
SHA512 21049ac949a133b2d3655a743fa48fb77fd023763be431c403808d8b8cc86ade7133ad2fd2407bc2f19378bde77d294fb858d77ccfdd369434389ccbd4e515c6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T17AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 4f0dc0b8733538f0e9d191bafc19b66ee2e91d1ce9524eb72600ce371150c544
MD5 f1322dcb58e36cc424bef8dbd0d3e5d1
SHA1 6dd2a9f68bd7f6d665c16fd91f3d93a3e49b273f
SHA512 3f115c4c3a94aaa43a01066e648e35f42af524b442440294de91712ae53bc2adee139c3cc47621ac9dab851f092c100f3310eb827d49adda9d9bbb40dde6168f
TLSH
T11541A67063EA29EADB6C4177C7D07AAA32F8C4A946036E61D4482D74C90EF9C77D0467
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a0ddc63a9a5ff3797d3891ad8c3d9f02b68bc58db77a7c725140f955fdbd6f20
MD5 8fbbf5165e4a577b1ada1709243e79fd
SHA1 a9626f5b6e8ca4705b7d7e2139c956a7c6849c73
SHA512 bee026ca5a238fc514cc6e70b08ef92041057384de4fc967fbb2c8f9cd00a535c71c16a612d81e1a87be8df0c7b19b102e67f501598bab74f4d2d3be2629f06f
TLSH
T11751AEF383E8866D8A1556F0AB146E1FDE1D0515432C3C6AC9E4EE2BD3E34B1E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 51d67f69a57333604dc454e0faaf74ea61791ffe9401686dcdb6a14a965d5902
MD5 d7dce01c318e16ff45004d31e25c36f0
SHA1 44ada45e146f2a584422d4c05896da5522b10d37
SHA512 6ea3c991bc7d9749b7a6a1f0b8ac5a42b23899ac08feccc46be74bea9f70496eab2777fa000dccdcd6af50d1b277d3912f765f2c50161ec427afdaea7933bca4
SSDEEP 192:sxRwRDyM/jK1Ml8wCD/fssaNZSqzoA8p9J/g6+WNCfE/YE8NbKYG1IgVeJ:sxRwJ8D/fssajSnf/5N/quo
TLSH
T19D62E915AA245D7BCCDBD30DBA55BF63D6F81573A1905E44AEFC8A1C00E6AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 12e3b4fa9c9332b23169ab16e2322b9129274101b109c8d4b43eb6612045946c
MD5 5d3a82e07b9c48edfa0fba6506a1e94e
SHA1 e7248c8106d607860f29853576f7da4189d24993
SHA512 d0d8b005d86397f4366949b2d2d8433adb85d6a5f769c3464f465c81680756b09ddf35c50266422ee0f6bfe98f6c4d7c9d7abe25db9790612902ddfbaaa7cad4
SSDEEP 192:sxRnRDyM/jK1Ml8UQGACD/fss+NZSqzoA8prJ/g6+WNCfE/YEddKKYG1IgD6eJ:sxRnJqGXD/fss+jSnF/5N/OuZ
TLSH
T16262D815A9249D7BCCDBD30DBA51BF63D2F85573A1905E44AEFC8A1C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 688afe20a412be767960a5b0bd1d5ed8e3a0aba41b4979715252918dabe454f6
MD5 471a3d9bd8aa9c39b9dac17823316a0f
SHA1 3a72fe358c4a014ddccf94dac91026fa46277b6d
SHA512 1c762f74586a63f09ccc7c4932ea0608302df92362ee1916904ac4b11c0bdc94efa60b34342dde7ab098f49b57fc04662c1d93ce8f5d3f104da3ae3d299b9ab4
SSDEEP 192:sxRnRDyM/jK1Ml8wCD/fssANZSqzoA8p9J/g6+WNCfE/YE8NbKYG1IgDYeJ:sxRnJ8D/fssAjSnf/5N/quP
TLSH
T1F662E915AA345D7B8CDBD30DBA51BF63D6F81573A1905E44AEFC8A1C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 c00ce00df4bd1bcaf01950ff2edf821f98a223856c7c078dd1fff0b8661923b6
MD5 dcf6d19e1ca7537f98c2b10a743791d9
SHA1 c5162bb6f9c103be70f998cc79a486ecd8204e8b
SHA512 425291a1d16de7830d88312cfa59fe91e84e51f907b1e5bc4db9adc7d120cdf30bc4e6d4436e669e82c4bc66124d568c6d481688bc886997cf8cbf9e417e6963
SSDEEP 768:0hiipW7pLuL7jaWgH7f3Q8F1+UoAYDCx9Tuqh0VfUC9xbog/OVyeZOV8CroE6s:0hiip2E7jaWgH7f3Qu1jaReZI8ZG
TLSH
T1E3E2FC3B680CCB7E4F404EDCEC29BD9A6DE801CB56D88D9447EA884C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 eb702bdbb5ac7243e1fae15a596acce7f07803fa5e4337d41ff8c4f1edb7c2e9
MD5 219baf2fc8a3372bf3b175efc1d12171
SHA1 3eb3cdbc6fa567f3c9c6cc29c0fdea8277f85a31
SHA512 4536f0d34fc4e64d0101a6689659f9434eb4dee90dd91da4b6382415d8c19e8225fa39c2be18600ad1f7c2079d3681c93d89f953386d4b797fbca22151203d2f
SSDEEP 96:KRJGXThDXzWnUCgbzK4qgVzcZRsPXQH0VAE+imkWivPgMkK4BgGkckEP+lWAKPqt:CJGXThDXinUDbpqgVgZRsPXQH0VAE+i/
TLSH
T16391015170BB0250383E6A0881F5892F96C175E27058EA2F7BA955E65F27E07CEFCCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a9c60.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a9c60.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 706a49ae8f4bf69c8ab266dc7d939ffe555145ca820fa6e87a48932d093349b5
MD5 4b357341e2069aa75d4f84887d4f3eba
SHA1 1b61e63dd3058c1a03ae96fcaad0b90b11108d49
SHA512 cc8c78b5981e3108215d7fa15cb1bf830c77a21357c57473e78ac44ce80828f70b490e6f9966c70f7a44d7fea129597ac0e72981d0ec1bd8e2e3232dee6a2b23
SSDEEP 768:fB3TiqGryDkTGqK48dHeByERRFzjK3YLD184pAfMc1:fB3PGWN48dHSyw/lWV1
TLSH
T167F2AFB068A46DB34CAFD249BA43B757AEF0416394D89E64D5EDEF0E44421DD0B0BC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d119ba7fad7abca57bca942a6ea8f007b56debbb9e476c596187828367601d17
MD5 953ff5046bd436f7cd0c4aa38074352f
SHA1 557908d0034165ec76da0bb74f0fdad4df3afbeb
SHA512 0de35d0f824a9dbd72bed62150e19a03aebea36bcf46ed7f88a51c82b6c21bda4708b9ca6a5e75ad7d2811f6e6bb54dee11c9ff6fe1c58ffe2284bea0a8bf98e
SSDEEP 768:Qrv+4UNbdf3/qGlYDkT5K48dHeByERRFzjK3Y7eVH1SCj:QbsbJ3yG2l48dHSyw/FEH1Z
TLSH
T17803CE71A8A85E734CE792897643B657BFF4421382C41BA4C5DD6F4E828B4DC130BE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 876634bd45ed8de19e39ef0cdec3605c0a781e46cad5648e8fbdea0ee94cad49
MD5 dcef57123e8821b7d5e1211e6d0c114f
SHA1 0339c3b770212b1d2e1364398046f52f4b919116
SHA512 e6fd744a8cd44c80566b6a69f4cd3020274d52e5519c0fbad4b6d329f8b325e71200af900c345720d9a5263dcdabd3398dd64110979243a70c25c0dd80a345f2
SSDEEP 768:1rv+4UNbdO3viqGGyDkTGqK48dHeByERRFzjK3YLD184pAfMh:1bsbY3bGvN48dHSyw/lWa
TLSH
T1DE03BFB0B868AEB34CAF9249B543B797BFF4016384C44B64D5D9AF8E81460DD1B0FD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 13a0cfc0d933ad8c12f4004c6f234611c3788b7274c1596520b0702bc379f679
MD5 83794c455a1d2ec701265c9cdffbd820
SHA1 b5659652d403c601fa967aca3fb8216c9f3bda29
SHA512 0cfb2ba98ec512587de7b6bed5a7cac1fd940cc0d5b1e81c1ad97bf51248f832070cb5819d651690db1ce1b5bfd34ac6e2e12f1f80e2de00daf3359f4fb2d6bc
SSDEEP 768:rB3miqGryDkTGqK48dHeByERRFzjK3YLD184pAfMc1:rB3MGWN48dHSyw/lWV1
TLSH
T108F2AFB068A46DB34CAFD249BA43B757AEF4416394D89E64D5EDEF0E40421DD0B0BC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 b3af4660cb50c3bde9a1d955f8ad545430fc6c430b24add41d58a6c22541e2f1
MD5 8ae819425aaf374d4b1e0c4d39c87501
SHA1 0c798229925a471d58d85ffdc15ef280e686d292
SHA512 48da3f8c3daae1a74f6691d40f57d48e559073e3e8aac065476c3c2158ccea82468097fd70710096489368fb30b810345c580ecc6588d7ccec5a3d7d91e227b6
SSDEEP 768:Yrv+4UNbdf3FqGbEDkTG+K48dHeByERRFzjK3JLeVH1SCj:YbsbJ3gGol48dHSyw/aEH1Z
TLSH
T17603CFB0A4A8AE734CEB92497583B747BFF4016385C44BA4D4D9AF4E85864CD1B0BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 1187eeb1a6d1cf58b97f305b7899b8578a3a8459d399a327709b07fe48143496
MD5 794433b1b1cee32441c8a4f7fb8a6a59
SHA1 8df55fa488739dd273e7f15d1bb7cb63552fdaeb
SHA512 f85fbb74daabdb57e3faf896b07e7d5c7a7f58dec2302b906d0eee37ca32536c6de2a0e35287b0ffefd7343aaa4bcfebab8284b7575b9ed9f71522f66e466df4
SSDEEP 768:jFQc37wgHiqGRfKTG3K48dHeByERRFzjK3YLD184pAfMc1:Gc3dGA48dHSyw/lWV1
TLSH
T1531339F098D79976D8AE8387673E7E469DBCC153B4889990B7C85E4DCC420BFC70A819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

2fb077ea-03fe-4027-a5c6-c03bb30796e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2fb077ea-03fe-4027-a5c6-c03bb30796e5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5040_1932745899\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 9c061864c67094f582beb2fd18155aa97b4eab6c4268b68a3dd772668d5a70f5
MD5 55cd4c69e2a0fed0b4c2ee0cd3aacc26
SHA1 bc39535a1d1819e90b0bd7e3c9a3fbb2b7f6ae87
SHA512 69a78a88738cd8f10d49b1f2a9184833ba23641c16d3a68d5de428c45e81d86b8b3a025cb40aae5bf09a2eef01f6795d5e1fb1054509ac5ae68885baa57e0e98
TLSH
T18071238356B9CAB3C2DE5BF503835244F6FB2338476330204B915587AB70B3A58B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1136-236-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1408-384-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1412-261-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1800-364-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2284-458-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3080-286-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3996-490-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4200-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4200-189-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4260-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4376-273-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4472-462-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4476-330-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4644-397-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4840-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4868-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5424-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5656-335-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6036-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6036-494-0x0000000000010000-0x00000000000AB000-memory.dmp

Download