systex | 9d381408d8f48eee5a34cbb8b23ff400a325d8e62e9936b0b589b77437d8416d

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 456KB
Sample260913-c646mszgpc
SHA256 9d381408d8f48eee5a34cbb8b23ff400a325d8e62e9936b0b589b77437d8416d
MD5 44960504de250380b24f3165358d7cbc
SHA1 b0cff499bbf9b19204f17ad47338b92a77af2878
SHA512 6fbac27187319e44191180b0f7c7f1f628c99c2c0b809aa4afb4a1c3ed2c3afc491e95298083451e02e4fd1a58624241fce1563af24f5a757131dc71257f74b0
SSDEEP 6144:CflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIy:CflfAsiVGjSGecvXAflfAsiW
TLSH
T12CA48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5232	hbzurpmhezwurmjh.exe
5852	hbzurpmhezwurmjh.sys
2492	CreateProcess.exe
3268	upecwuojhz.exe
1092	CreateProcess.exe
4776	CreateProcess.exe
4232	i_upecwuojhz.exe
4504	ljebwuomje.sys
4756	CreateProcess.exe
2152	ljebztrojh.exe
2584	CreateProcess.exe
1984	CreateProcess.exe
1696	i_ljebztrojh.exe
1760	wtolgeywqo.sys
3028	CreateProcess.exe
3304	vtrljdbztr.exe
2792	CreateProcess.exe
2628	CreateProcess.exe
2520	i_vtrljdbztr.exe
5324	tolgdbytqo.sys
1836	CreateProcess.exe
5340	tqolgdbytq.exe
3364	CreateProcess.exe
3740	CreateProcess.exe
4936	i_tqolgdbytq.exe
704	vtnlfdyvqn.sys
1388	CreateProcess.exe
4720	fdyvqnigay.exe
1060	CreateProcess.exe
2952	CreateProcess.exe
4360	i_fdyvqnigay.exe
1760	fcavsqkiga.sys
5264	CreateProcess.exe
4320	daysqkfdxv.exe
1120	CreateProcess.exe
2520	CreateProcess.exe
5336	i_daysqkfdxv.exe
1376	usnkicavpn.sys
2232	CreateProcess.exe
3440	nhfaxsqkic.exe
2340	CreateProcess.exe
5172	CreateProcess.exe
4232	i_nhfaxsqkic.exe
2744	hecxusmkhc.sys
5588	CreateProcess.exe
2580	nhfzxuspkh.exe
4304	CreateProcess.exe
4432	CreateProcess.exe
4768	i_nhfzxuspkh.exe
908	pmkhczxupm.sys
236	CreateProcess.exe
1112	cwurmhecwu.exe
5712	CreateProcess.exe
5964	CreateProcess.exe
6088	i_cwurmhecwu.exe
4204	mhezwrpjhb.sys
5168	CreateProcess.exe
3560	gecwuomgez.exe
2744	CreateProcess.exe
4836	CreateProcess.exe
4936	i_gecwuomgez.exe
2720	geywtrljhb.sys
2004	CreateProcess.exe
3404	gbywqomjeb.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6100_1392466869\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6100_1392466869\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6100_5314271\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6100_5314271\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6100_5314271\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6100_1074870408\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6100_1801274021\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6100_1801274021\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6100_5314271\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtrljdbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqolgdbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqoigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywuomgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljebztrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigbvtolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfcavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzurpmhezwurmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdyvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbywqomjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfcavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upecwuojhz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtrljdbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwurmhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gecwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbywqomjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqoigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqolgdbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdyvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daysqkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_daysqkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxuspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzxrpjhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upecwuojhz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebztrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gecwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icausmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxuspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwurmhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigbvtolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywuomgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trligbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzxrpjhfzx.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2540	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2856	ipconfig.exe
4940	ipconfig.exe
3536	ipconfig.exe
4296	ipconfig.exe
4780	ipconfig.exe
4180	ipconfig.exe
1924	ipconfig.exe
4660	ipconfig.exe
1892	ipconfig.exe
4180	ipconfig.exe
2664	ipconfig.exe
584	ipconfig.exe
1116	ipconfig.exe
6140	ipconfig.exe
2672	ipconfig.exe
5708	ipconfig.exe
1588	ipconfig.exe
2272	ipconfig.exe
3584	ipconfig.exe
5856	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134337409455154563"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{640B39A6-B0EE-4DF8-85C2-3173EEDCB7E8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5232	hbzurpmhezwurmjh.exe
5232	hbzurpmhezwurmjh.exe
5232	hbzurpmhezwurmjh.exe
5232	hbzurpmhezwurmjh.exe
5232	hbzurpmhezwurmjh.exe
5232	hbzurpmhezwurmjh.exe
5232	hbzurpmhezwurmjh.exe
5232	hbzurpmhezwurmjh.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
6100	msedge.exe
6100	msedge.exe
6100	msedge.exe
6100	msedge.exe
6100	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4232	i_upecwuojhz.exe
Token: SeDebugPrivilege	1696	i_ljebztrojh.exe
Token: SeDebugPrivilege	2520	i_vtrljdbztr.exe
Token: SeDebugPrivilege	4936	i_tqolgdbytq.exe
Token: SeDebugPrivilege	4360	i_fdyvqnigay.exe
Token: SeDebugPrivilege	5336	i_daysqkfdxv.exe
Token: SeDebugPrivilege	4232	i_nhfaxsqkic.exe
Token: SeDebugPrivilege	4768	i_nhfzxuspkh.exe
Token: SeDebugPrivilege	6088	i_cwurmhecwu.exe
Token: SeDebugPrivilege	4936	i_gecwuomgez.exe
Token: SeDebugPrivilege	4920	i_gbywqomjeb.exe
Token: SeDebugPrivilege	1124	i_qoigbvtolj.exe
Token: SeDebugPrivilege	3600	i_vqoigaysql.exe
Token: SeDebugPrivilege	5972	i_qkicaysqki.exe
Token: SeDebugPrivilege	2636	i_hfcavsnlfd.exe
Token: SeDebugPrivilege	4020	i_icausmkecx.exe
Token: SeDebugPrivilege	4988	i_bzxrpjhfzx.exe
Token: SeDebugPrivilege	1852	i_hczurmkecw.exe
Token: SeDebugPrivilege	5228	i_ywuomgeywr.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 5232	4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 4216 wrote to memory of 3552	4216	2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 3552 wrote to memory of 6100	3552	iexplore.exe	89
PID 6100 wrote to memory of 5768	6100	msedge.exe	90
PID 6100 wrote to memory of 2336	6100	msedge.exe	92
PID 6100 wrote to memory of 2540	6100	msedge.exe	93
PID 6100 wrote to memory of 2336	6100	msedge.exe	92
PID 6100 wrote to memory of 2336	6100	msedge.exe	92
PID 6100 wrote to memory of 3508	6100	msedge.exe	94
PID 6100 wrote to memory of 3508	6100	msedge.exe	94
PID 6100 wrote to memory of 3560	6100	msedge.exe	95
PID 6100 wrote to memory of 3560	6100	msedge.exe	95
PID 6100 wrote to memory of 6116	6100	msedge.exe	96
PID 6100 wrote to memory of 3560	6100	msedge.exe	95
PID 6100 wrote to memory of 6116	6100	msedge.exe	96
PID 6100 wrote to memory of 6116	6100	msedge.exe	96
PID 6100 wrote to memory of 112	6100	msedge.exe	97
PID 6100 wrote to memory of 124	6100	msedge.exe	98
PID 6100 wrote to memory of 112	6100	msedge.exe	97
PID 6100 wrote to memory of 112	6100	msedge.exe	97
PID 6100 wrote to memory of 124	6100	msedge.exe	98
PID 6100 wrote to memory of 124	6100	msedge.exe	98
PID 6100 wrote to memory of 2584	6100	msedge.exe	99
PID 6100 wrote to memory of 2584	6100	msedge.exe	99
PID 6100 wrote to memory of 5640	6100	msedge.exe	101
PID 6100 wrote to memory of 5116	6100	msedge.exe	102
PID 6100 wrote to memory of 5640	6100	msedge.exe	101
PID 6100 wrote to memory of 5116	6100	msedge.exe	102
PID 5232 wrote to memory of 2492	5232	hbzurpmhezwurmjh.exe	105
PID 3268 wrote to memory of 1092	3268	upecwuojhz.exe	108
PID 6100 wrote to memory of 4024	6100	msedge.exe	111
PID 6100 wrote to memory of 3224	6100	msedge.exe	113
PID 6100 wrote to memory of 3224	6100	msedge.exe	113
PID 6100 wrote to memory of 5344	6100	msedge.exe	116
PID 6100 wrote to memory of 5344	6100	msedge.exe	116
PID 5232 wrote to memory of 4776	5232	hbzurpmhezwurmjh.exe	117
PID 5232 wrote to memory of 4756	5232	hbzurpmhezwurmjh.exe	121
PID 2152 wrote to memory of 2584	2152	ljebztrojh.exe	123
PID 5232 wrote to memory of 1984	5232	hbzurpmhezwurmjh.exe	126
PID 5232 wrote to memory of 3028	5232	hbzurpmhezwurmjh.exe	130
PID 3304 wrote to memory of 2792	3304	vtrljdbztr.exe	132
PID 5232 wrote to memory of 2628	5232	hbzurpmhezwurmjh.exe	135
PID 5232 wrote to memory of 1836	5232	hbzurpmhezwurmjh.exe	139
PID 5340 wrote to memory of 3364	5340	tqolgdbytq.exe	141
PID 5232 wrote to memory of 3740	5232	hbzurpmhezwurmjh.exe	145
PID 6100 wrote to memory of 2580	6100	msedge.exe	147
PID 6100 wrote to memory of 4660	6100	msedge.exe	148
PID 6100 wrote to memory of 4836	6100	msedge.exe	149
PID 5232 wrote to memory of 1388	5232	hbzurpmhezwurmjh.exe	152
PID 4720 wrote to memory of 1060	4720	fdyvqnigay.exe	154
PID 5232 wrote to memory of 2952	5232	hbzurpmhezwurmjh.exe	157
PID 5232 wrote to memory of 5264	5232	hbzurpmhezwurmjh.exe	161
PID 4320 wrote to memory of 1120	4320	daysqkfdxv.exe	163
PID 5232 wrote to memory of 2520	5232	hbzurpmhezwurmjh.exe	166
PID 5232 wrote to memory of 2232	5232	hbzurpmhezwurmjh.exe	170
PID 3440 wrote to memory of 2340	3440	nhfaxsqkic.exe	172
PID 5232 wrote to memory of 5172	5232	hbzurpmhezwurmjh.exe	175
PID 5232 wrote to memory of 5588	5232	hbzurpmhezwurmjh.exe	179
PID 2580 wrote to memory of 4304	2580	nhfzxuspkh.exe	181
PID 5232 wrote to memory of 4432	5232	hbzurpmhezwurmjh.exe	184
PID 6100 wrote to memory of 4252	6100	msedge.exe	186
PID 6100 wrote to memory of 4252	6100	msedge.exe	186
PID 5232 wrote to memory of 236	5232	hbzurpmhezwurmjh.exe	192
PID 1112 wrote to memory of 5712	1112	cwurmhecwu.exe	194

C:\Users\Admin\AppData\Local\Temp\2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-12_44960504de250380b24f3165358d7cbc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Temp\hbzurpmhezwurmjh.exe
  C:\Temp\hbzurpmhezwurmjh.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upecwuojhz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2492
  - - C:\Temp\upecwuojhz.exe
      C:\Temp\upecwuojhz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3268
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1092
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upecwuojhz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4776
  - - C:\Temp\i_upecwuojhz.exe
      C:\Temp\i_upecwuojhz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljebztrojh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4756
  - - C:\Temp\ljebztrojh.exe
      C:\Temp\ljebztrojh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2152
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2584
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljebztrojh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1984
  - - C:\Temp\i_ljebztrojh.exe
      C:\Temp\i_ljebztrojh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtrljdbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3028
  - - C:\Temp\vtrljdbztr.exe
      C:\Temp\vtrljdbztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3304
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2792
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtrljdbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2628
  - - C:\Temp\i_vtrljdbztr.exe
      C:\Temp\i_vtrljdbztr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqolgdbytq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1836
  - - C:\Temp\tqolgdbytq.exe
      C:\Temp\tqolgdbytq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5340
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3364
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqolgdbytq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3740
  - - C:\Temp\i_tqolgdbytq.exe
      C:\Temp\i_tqolgdbytq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdyvqnigay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1388
  - - C:\Temp\fdyvqnigay.exe
      C:\Temp\fdyvqnigay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4720
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1060
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdyvqnigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2952
  - - C:\Temp\i_fdyvqnigay.exe
      C:\Temp\i_fdyvqnigay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\daysqkfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5264
  - - C:\Temp\daysqkfdxv.exe
      C:\Temp\daysqkfdxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4320
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1120
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_daysqkfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2520
  - - C:\Temp\i_daysqkfdxv.exe
      C:\Temp\i_daysqkfdxv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfaxsqkic.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2232
  - - C:\Temp\nhfaxsqkic.exe
      C:\Temp\nhfaxsqkic.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3440
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2340
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfaxsqkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5172
  - - C:\Temp\i_nhfaxsqkic.exe
      C:\Temp\i_nhfaxsqkic.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfzxuspkh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5588
  - - C:\Temp\nhfzxuspkh.exe
      C:\Temp\nhfzxuspkh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2580
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4304
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfzxuspkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4432
  - - C:\Temp\i_nhfzxuspkh.exe
      C:\Temp\i_nhfzxuspkh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwurmhecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:236
  - - C:\Temp\cwurmhecwu.exe
      C:\Temp\cwurmhecwu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1112
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5712
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwurmhecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5964
  - - C:\Temp\i_cwurmhecwu.exe
      C:\Temp\i_cwurmhecwu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gecwuomgez.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5168
  - - C:\Temp\gecwuomgez.exe
      C:\Temp\gecwuomgez.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3560
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2744
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gecwuomgez.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4836
  - - C:\Temp\i_gecwuomgez.exe
      C:\Temp\i_gecwuomgez.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbywqomjeb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2004
  - - C:\Temp\gbywqomjeb.exe
      C:\Temp\gbywqomjeb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4768
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gbywqomjeb.exe ups_ins
    3⤵
    PID:1876
  - - C:\Temp\i_gbywqomjeb.exe
      C:\Temp\i_gbywqomjeb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigbvtolj.exe ups_run
    3⤵
    PID:4292
  - - C:\Temp\qoigbvtolj.exe
      C:\Temp\qoigbvtolj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1220
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1400
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigbvtolj.exe ups_ins
    3⤵
    PID:3692
  - - C:\Temp\i_qoigbvtolj.exe
      C:\Temp\i_qoigbvtolj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vqoigaysql.exe ups_run
    3⤵
    PID:3420
  - - C:\Temp\vqoigaysql.exe
      C:\Temp\vqoigaysql.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3324
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5488
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vqoigaysql.exe ups_ins
    3⤵
    PID:412
  - - C:\Temp\i_vqoigaysql.exe
      C:\Temp\i_vqoigaysql.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3600
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkicaysqki.exe ups_run
    3⤵
    PID:4600
  - - C:\Temp\qkicaysqki.exe
      C:\Temp\qkicaysqki.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5884
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3128
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkicaysqki.exe ups_ins
    3⤵
    PID:3172
  - - C:\Temp\i_qkicaysqki.exe
      C:\Temp\i_qkicaysqki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfcavsnlfd.exe ups_run
    3⤵
    PID:1588
  - - C:\Temp\hfcavsnlfd.exe
      C:\Temp\hfcavsnlfd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5648
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6000
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfcavsnlfd.exe ups_ins
    3⤵
    PID:1576
  - - C:\Temp\i_hfcavsnlfd.exe
      C:\Temp\i_hfcavsnlfd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2636
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icausmkecx.exe ups_run
    3⤵
    PID:3600
  - - C:\Temp\icausmkecx.exe
      C:\Temp\icausmkecx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2508
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3416
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icausmkecx.exe ups_ins
    3⤵
    PID:2144
  - - C:\Temp\i_icausmkecx.exe
      C:\Temp\i_icausmkecx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzxrpjhfzx.exe ups_run
    3⤵
    PID:3672
  - - C:\Temp\bzxrpjhfzx.exe
      C:\Temp\bzxrpjhfzx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2008
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzxrpjhfzx.exe ups_ins
    3⤵
    PID:2036
  - - C:\Temp\i_bzxrpjhfzx.exe
      C:\Temp\i_bzxrpjhfzx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczurmkecw.exe ups_run
    3⤵
    PID:1264
  - - C:\Temp\hczurmkecw.exe
      C:\Temp\hczurmkecw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1648
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2844
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczurmkecw.exe ups_ins
    3⤵
    PID:3396
  - - C:\Temp\i_hczurmkecw.exe
      C:\Temp\i_hczurmkecw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywuomgeywr.exe ups_run
    3⤵
    PID:5224
  - - C:\Temp\ywuomgeywr.exe
      C:\Temp\ywuomgeywr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:348
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5128
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywuomgeywr.exe ups_ins
    3⤵
    PID:3408
  - - C:\Temp\i_ywuomgeywr.exe
      C:\Temp\i_ywuomgeywr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trligbytrl.exe ups_run
    3⤵
    PID:4696
  - - C:\Temp\trligbytrl.exe
      C:\Temp\trligbytrl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5432
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5268
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5856
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c0,0x300,0x7ff88f7ac188,0x7ff88f7ac194,0x7ff88f7ac1a0
      4⤵
      PID:5768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1856,i,5804056857828877734,10871920530296216494,262144 --field-trial-handle=2424,i,3300221014526752445,8575729578910847269,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:2
      4⤵
      PID:2336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2112,i,4519246543941939000,12979765715510706774,524288 --field-trial-handle=2424,i,3300221014526752445,8575729578910847269,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:11
      4⤵
      System Time Discovery
      PID:2540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2656,i,13876648924495362928,1576650323980491127,524288 --field-trial-handle=2424,i,3300221014526752445,8575729578910847269,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:13
      4⤵
      PID:3508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,7496255885830689581,14739423789581135587,2097152 --field-trial-handle=2424,i,3300221014526752445,8575729578910847269,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:3560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,1766786701505101973,2169895982935605313,2097152 --field-trial-handle=2424,i,3300221014526752445,8575729578910847269,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:6116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,8218711055238839711,8884343948595049795,2097152 --field-trial-handle=2424,i,3300221014526752445,8575729578910847269,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
      4⤵
      PID:112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,3064114572654121138,3466576224559698976,2097152 --field-trial-handle=2424,i,3300221014526752445,8575729578910847269,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:9
      4⤵
      PID:124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,4533549245874798710,6984735944020280490,524288 --field-trial-handle=2424,i,3300221014526752445,8575729578910847269,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14
      4⤵
      PID:2584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,2804920288458513445,200237290641618206,524288 --field-trial-handle=2424,i,3300221014526752445,8575729578910847269,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
      4⤵
      PID:5640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,8391875200071814679,13505383120112061102,524288 --field-trial-handle=2424,i,3300221014526752445,8575729578910847269,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
      4⤵
      PID:5116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,12449197029654261072,13655148083148062717,524288 --field-trial-handle=2424,i,3300221014526752445,8575729578910847269,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
      4⤵
      PID:1696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,12449197029654261072,13655148083148062717,524288 --field-trial-handle=2424,i,3300221014526752445,8575729578910847269,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
      4⤵
      PID:4024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,17776595166483098804,15553181594319173186,524288 --field-trial-handle=2424,i,3300221014526752445,8575729578910847269,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:3224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,8846743846708258602,971017400240297212,524288 --field-trial-handle=2424,i,3300221014526752445,8575729578910847269,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
      4⤵
      PID:5344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1428,i,15089196231648818658,9074430136682452551,524288 --field-trial-handle=2424,i,3300221014526752445,8575729578910847269,262144 --variations-seed-version --mojo-platform-channel-handle=1392 /prefetch:14
      4⤵
      PID:2580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1436,i,1034188094375389757,13303763595835593533,524288 --field-trial-handle=2424,i,3300221014526752445,8575729578910847269,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
      4⤵
      PID:4660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1444,i,2017910636889114465,14535306961681432613,524288 --field-trial-handle=2424,i,3300221014526752445,8575729578910847269,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
      4⤵
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,11190610004284093413,17076297566815647346,524288 --field-trial-handle=2424,i,3300221014526752445,8575729578910847269,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
      4⤵
      PID:4252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,11952124835873408338,13177621535566380712,524288 --field-trial-handle=2424,i,3300221014526752445,8575729578910847269,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:14
      4⤵
      PID:1336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,16171121760976117679,11313843012598899327,524288 --field-trial-handle=2424,i,3300221014526752445,8575729578910847269,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
      4⤵
      PID:3128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,13798459079710207133,5204816184498342979,524288 --field-trial-handle=2424,i,3300221014526752445,8575729578910847269,262144 --variations-seed-version --mojo-platform-channel-handle=948 /prefetch:14
      4⤵
      PID:1140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6060,i,17069589583644812826,2397324101299501879,262144 --field-trial-handle=2424,i,3300221014526752445,8575729578910847269,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:10
      4⤵
      PID:3460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,3739193337813947477,3025721318714233019,524288 --field-trial-handle=2424,i,3300221014526752445,8575729578910847269,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:5972

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1564

C:\Temp\hbzurpmhezwurmjh.sys
C:\Temp\hbzurpmhezwurmjh.sys
1⤵
- Executes dropped EXE
PID:5852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3064

C:\Temp\ljebwuomje.sys
C:\Temp\ljebwuomje.sys
1⤵
- Executes dropped EXE
PID:4504

C:\Temp\wtolgeywqo.sys
C:\Temp\wtolgeywqo.sys
1⤵
- Executes dropped EXE
PID:1760

C:\Temp\tolgdbytqo.sys
C:\Temp\tolgdbytqo.sys
1⤵
- Executes dropped EXE
PID:5324

C:\Temp\vtnlfdyvqn.sys
C:\Temp\vtnlfdyvqn.sys
1⤵
- Executes dropped EXE
PID:704

C:\Temp\fcavsqkiga.sys
C:\Temp\fcavsqkiga.sys
1⤵
- Executes dropped EXE
PID:1760

C:\Temp\usnkicavpn.sys
C:\Temp\usnkicavpn.sys
1⤵
- Executes dropped EXE
PID:1376

C:\Temp\hecxusmkhc.sys
C:\Temp\hecxusmkhc.sys
1⤵
- Executes dropped EXE
PID:2744

C:\Temp\pmkhczxupm.sys
C:\Temp\pmkhczxupm.sys
1⤵
- Executes dropped EXE
PID:908

C:\Temp\mhezwrpjhb.sys
C:\Temp\mhezwrpjhb.sys
1⤵
- Executes dropped EXE
PID:4204

C:\Temp\geywtrljhb.sys
C:\Temp\geywtrljhb.sys
1⤵
- Executes dropped EXE
PID:2720

C:\Temp\olgdywqoig.sys
C:\Temp\olgdywqoig.sys
1⤵
PID:1376

C:\Temp\dbwqolgeyw.sys
C:\Temp\dbwqolgeyw.sys
1⤵
PID:2344

C:\Temp\qnifdyvqni.sys
C:\Temp\qnifdyvqni.sys
1⤵
PID:2704

C:\Temp\ifaxsqnifa.sys
C:\Temp\ifaxsqnifa.sys
1⤵
PID:5336

C:\Temp\khcausmkec.sys
C:\Temp\khcausmkec.sys
1⤵
PID:908

C:\Temp\khczurpkhf.sys
C:\Temp\khczurpkhf.sys
1⤵
PID:3820

C:\Temp\hezxromkec.sys
C:\Temp\hezxromkec.sys
1⤵
PID:940

C:\Temp\bztrmjebwu.sys
C:\Temp\bztrmjebwu.sys
1⤵
PID:5988

C:\Temp\tqomgebwtr.sys
C:\Temp\tqomgebwtr.sys
1⤵
PID:4492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

daysqkfdxv.exe

Path C:\Temp\daysqkfdxv.exe
Size 456KB
SHA256 daba2a19a4f8184cdc717be3058c1d2e90951972828ae965fba49cbbc4a396cb
MD5 8f8427dfb14ce155e82c112c853d6540
SHA1 b4d1d42cfd7bdfdf219cff9dd9ea9e4196fde2bd
SHA512 84efbac8dcac908ab7d95b6fa6a724c787bc59b45065fbc15b0f890288b9617dd0367399583d7f3f77af823a05d6a2a87650c498612841aa69f8b072f1ce706a
SSDEEP 6144:DflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIR:DflfAsiVGjSGecvXAflfAsid
TLSH
T1D5A48C14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcavsqkiga.sys

Path C:\Temp\fcavsqkiga.sys
Size 293KB
SHA256 6df5f298783a1493a20412a0d6f22aeb341a601a85d0e3ecdd35ba47c3761ccf
MD5 8284e657f9fbfc948231f24aaba77f7a
SHA1 8174d961c31cf0feb07d58f12b8b5c29c6ef50d4
SHA512 725c266030ec2831f93fded2394fe05678fcd7629dc44b4aebb4af2fa412f131b045d9ee1c53bbd178c393119010da6866087439f39b63d40b800e3c90f0f3d6
SSDEEP 3072:6tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:6IJjiJcbI03GBc3ucY5DCSj
TLSH
T1EE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdyvqnigay.exe

Path C:\Temp\fdyvqnigay.exe
Size 456KB
SHA256 dafba1f782579af0fea83bc6e1843d11d20f9e1325244e51662bd0ce0ecbf91b
MD5 71e393659ab3d1e31eee297af5127acb
SHA1 47d801457e822ebe114bbf7e3552b27b83d805fc
SHA512 0f83c966fc9172ff89d9fe6d7ea423dcbd96170c0d25bbee6eff6b304fbbecff11cba125046151eefd5705332e94ec70c336f24a937b87b0f795ff1cd3b13db2
SSDEEP 6144:8flfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIw:8flfAsiVGjSGecvXAflfAsik
TLSH
T183A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzurpmhezwurmjh.exe

Path C:\Temp\hbzurpmhezwurmjh.exe
Size 456KB
SHA256 498a5d603040a04166a4140bde65c942ab8ce12cd0a0ab0fe2698190c7191653
MD5 4c05fcfdd6b82e7fd54380d9a6bc4807
SHA1 3bcb7c0b0b8955290ec6d9b019359b8b598174bb
SHA512 4ca7f1514388b569d851328fe1b34f3f9777c2616149478791359fb52022e42a6618152243593d04ab78529cb614ec5830cccf7f8d31f6d0d7a79ff56d61f1e9
SSDEEP 6144:IflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIE:IflfAsiVGjSGecvXAflfAsiY
TLSH
T19CA48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzurpmhezwurmjh.sys

Path C:\Temp\hbzurpmhezwurmjh.sys
Size 293KB
SHA256 bd587cc4d6e5ff310483faf733c66fb09706bb3635740c8bfd3715e07771b19b
MD5 4d34f423e114fee1dc03d7f6ffd78ec6
SHA1 5d2678f08f338b05697330c435660cd7721f98b4
SHA512 9b96d41d529e27a61ca2a3dc27ccdc5d23244159731732e460e802c5c7e5352d03c86b318cbf4426fb5261b63fc1357065cf7cd0c88131375ce4e70b53f4cd6f
SSDEEP 3072:VtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:VIJjiJcbI03GBc3ucY5DCSj
TLSH
T128545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdyvqnigay.exe

Path C:\Temp\i_fdyvqnigay.exe
Size 456KB
SHA256 b8c73e19e548b6c4a5b83667f2c257e63107e2c8b1c32ee9a1c30a068f0661cf
MD5 42fd01fec4c8b705534497b1419f9f60
SHA1 72be3a06051aa4170f4724145f046fb9f7910e48
SHA512 c556ae3e4aa144bcb3ac627888afaaa08fc62c132e3567d737104dd23536da6003623774ef4c7280528dea7c3b0d3f9029b23235abacac211043e3bb8508cc59
SSDEEP 6144:rflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIh:rflfAsiVGjSGecvXAflfAsil
TLSH
T1A1A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljebztrojh.exe

Path C:\Temp\i_ljebztrojh.exe
Size 456KB
SHA256 74481fa5a64442e539042d9a8eaebc5c152141f883ab2b2312437a0e10bda85b
MD5 7ba44eedfeb4ff6c20235cc0556891d7
SHA1 09440e54cc045582e10f68a9810b6b3cf80a2f33
SHA512 61eaddff79c491fcc2e0de80720391df3331753a4dfc9da30d192e75b3058139ded9db72cae79715bec678afa26733b2e41d289c17fdbe85e27f511d49c8f31d
SSDEEP 6144:aflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIS:aflfAsiVGjSGecvXAflfAsiu
TLSH
T180A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tqolgdbytq.exe

Path C:\Temp\i_tqolgdbytq.exe
Size 456KB
SHA256 b40711ba1b9d1592968d49cc6a0bf6f587890d98a56ea9f7a7489140e9f7ca71
MD5 de0399885088d49620d9ce80d87e8e2a
SHA1 8f2d276a328f78203853c815669b75d3ecc932aa
SHA512 609bf2df9ca678a5ef6d66b42e34e9fe87870746b5d56122c596def99b6391fba02129630a7e94e358cb318e3a7c26a3579175d134eab6e46e9472c7b72e88e4
SSDEEP 6144:YflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lI8:YflfAsiVGjSGecvXAflfAsi4
TLSH
T180A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_upecwuojhz.exe

Path C:\Temp\i_upecwuojhz.exe
Size 456KB
SHA256 c7fff8c363aad54c9ca95eafad1e3928b233040311baa823b74a0da74b8ec353
MD5 fc629c6b0d89927ea3a26a5e4b902688
SHA1 d26a0f5b21d63fb866504b987a7a5db400bc9752
SHA512 1391607c252495b96b318aa37efece8eb980c08e48d5e10c21dd8229df560a3883df0506ae0b80ae2f47528884456eaf787826c0b6d59597a805b429e06576d1
SSDEEP 6144:yflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIa:yflfAsiVGjSGecvXAflfAsiW
TLSH
T100A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtrljdbztr.exe

Path C:\Temp\i_vtrljdbztr.exe
Size 456KB
SHA256 e0ea50775ef87b920b499d9924400b0bc3f43b53978bdbb23363f4f4892795b7
MD5 55e115e7f02138e7ce17c2f50d24e893
SHA1 c48c6ebbd1ef46dd60d5c63c206b205792adc9d7
SHA512 cb6720c60e84a5ce0ec89d6923530f0437815f0bc0ab48caf6b8b7ea5f695f0b88d29f02a36e247f5f415d396812e119be1d06537344553f89a834aa156673d0
SSDEEP 6144:yflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIa:yflfAsiVGjSGecvXAflfAsiW
TLSH
T188A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljebwuomje.sys

Path C:\Temp\ljebwuomje.sys
Size 293KB
SHA256 c1c5b5bb7759ad9e5360cd32bd4d1a7de8c3a3af76e0912da8044f16d1cb6b66
MD5 d2f0e177bf7f0ceec03204c328c77441
SHA1 2fe6025dcd62dec55231ecb6c21c3449fd2505ae
SHA512 3ac716d9cb964134218d13598172f7d696a3e15de1defea7fc4b918229b5cdf09e6c286170ae28b0aa855d9467285f7d99fc46f91e53f64e3d7df8d019ac28ea
SSDEEP 3072:MtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:MIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljebztrojh.exe

Path C:\Temp\ljebztrojh.exe
Size 456KB
SHA256 087bb37cd37e29409388c3ce4b058c5298d36d42fa0c76534785a5e4720d3aed
MD5 ebab844decf24f3436b81770b4d24c26
SHA1 1586a5f0a7691f7ba2c8aba742f2fea7f58fe45b
SHA512 a58ff3a37565945a51e3a6939934be5b4869dc712abbd2bdff1b1313955c3a119d7ca4cdc580cffa217d58aa72a08500b8bc26912d73a33b4c45c0dac9e7757b
SSDEEP 6144:YflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIs:YflfAsiVGjSGecvXAflfAsio
TLSH
T13AA48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tolgdbytqo.sys

Path C:\Temp\tolgdbytqo.sys
Size 293KB
SHA256 8f734e7b041fef57e8a86647583d5aea7c36fee9170dad4f20a8b37fcfbe0afe
MD5 b5f1d6761e7e52e60b79f6a0f2a56611
SHA1 55403aa8ce7fef481148a3fb0d9c67ae94850733
SHA512 3884e5bf198e5795b63b84e740880c2b1bd662e11ea63830b76fb50047d8e13e989a9d89804f26ba977e91cae4ef2109961093966c36cdc91494815c3f57e08d
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqolgdbytq.exe

Path C:\Temp\tqolgdbytq.exe
Size 456KB
SHA256 fabf37cdabacc47d92be1034a7362aa5c5a48039fb30e8973ecd513b495e3ca9
MD5 1183908ee70c87c69f6b421c9d9194f5
SHA1 06bbc41900e40bbee094e774a52084499b80cda1
SHA512 9c730ce761322832110891ad65ec7b7a71356fd94b47dd7d8a1011108f9c89f8c3c1cb57a62c17b1e46ec2b0b152323d42f91a240868c47cd958a0b4b6e03f25
SSDEEP 6144:lflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lI/:lflfAsiVGjSGecvXAflfAsiT
TLSH
T114A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upecwuojhz.exe

Path C:\Temp\upecwuojhz.exe
Size 456KB
SHA256 71095fda1fe1c895c505ca9640b337e5a907bfae39a7ec114ffd60370f299853
MD5 0aa5adc22ede18794530f28da0ad525a
SHA1 aa10eb5f9bd13cb1087aef758a27b80c0a1df9b7
SHA512 a3e589d6980155005f0ec84412830ac28be0d700691a3df1af6864785b87990542de3ea9806ce05515345f4325d26fa8210423a1615e96240874eb3375d6c250
SSDEEP 6144:0flfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIg:0flfAsiVGjSGecvXAflfAsis
TLSH
T105A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdyvqn.sys

Path C:\Temp\vtnlfdyvqn.sys
Size 293KB
SHA256 06fa03e40c182153a57f7e76e2665cb979a8a74b96a21cb9c5a3954a0371f9da
MD5 5505a0a4338f506b3caebe41d7bb84bf
SHA1 2d37a0093eec1662eb00003c33c0d8c36710daf5
SHA512 a7d6a2f7a39f8c164f0f38f6d261fb7e6fe5aeab3e5d2b9332ae731938877fe64ff3d75bbb5e172b6ab1f4ff8abfc202bf422f44a326dc942a2eccc80c41f814
SSDEEP 3072:4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:4IJjiJcbI03GBc3ucY5DCSj
TLSH
T187545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtrljdbztr.exe

Path C:\Temp\vtrljdbztr.exe
Size 456KB
SHA256 f447a766237124ed89842cd3d668630e17bf5a9061978ead54f99ff47fda7fd6
MD5 3251c5280d65ce3ae0d5cbe5aa43ca6d
SHA1 365b2d207f527091cc11454e57a3f43d3da9784e
SHA512 42881783a725a08850d32c1fd8bff500593f1781489f4e419b4161a301365c452d02b27e7be8fd8b73d106bcb6deda4678ee2811ac3a894db1cb5a115c04ba71
SSDEEP 6144:RflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIL:RflfAsiVGjSGecvXAflfAsi3
TLSH
T12EA48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtolgeywqo.sys

Path C:\Temp\wtolgeywqo.sys
Size 293KB
SHA256 aa28cd3dba6c0995f63fa6be6204d6abd84b7d5a990bbb5d87c1d610bbcbd6f2
MD5 72ec7b3466e62b78adf75e227a9090e4
SHA1 fbb2818a920ecf3e060d051218901f90cf3926f0
SHA512 9da793f3add8571453e47e2407f58fa49c038f7d886adb4514538329217882f034449370746941f1fef9e96024f90de63efcdb2703b8a178cac7cce0da2a2046
SSDEEP 3072:ZtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:ZIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc0a38b9bd67def6f8a6da7a4a5956bc201e5aac4ba6f906946e52f5b14e13c2
MD5 1f96c275206494cbaa7386b7e675b940
SHA1 e11ab12226c05e6b54c67a266c2f75cfeb24b04a
SHA512 a117c9e9ceb3447431daa46611f5c54ed75796456b4251af5e1ed3f62b5c6cbe9ebccf949569237178ca2ca7feba8c9acb69940a8457c36a9156ef8fd98eb09c
TLSH
T188D02B3671684D13E0805278007111613882F405DF0601C01322982609902483010180
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0d0352bb5f4b47f3d1ca8042212dfbae37957031d48d7789bd6cd7b4b6cbbe31
MD5 32b3e4b238ee2f76e0152ca1b1ff9944
SHA1 78d56bdababf57c069ac4ad713ad9cdc3e3f04a0
SHA512 3e7b72969f35c769b07f0760fb1a06022e37e68e88be1bff45e02463b5358a671e4f84f6bad11b043a01370573d062084b864866961ee86cb12eceb980874f69
TLSH
T178D02B3A71584E13E0805274007011613892F405EF0601C01322581609902483011184
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3d4c8cfdbaed3a31b8a1cc98a1fc4a1d98d1531f1b1c44145f01a182c534259a
MD5 05b3dc3c8cd48218a340d1e9a2e7c1d8
SHA1 a5bc62de4c36537d6fbb95a8a3a3e614d27490b7
SHA512 f158fbe7edbdff385e1ca7359ce0b108cfcd0588529b63751584158c184a468886a85ecba2a38032e618add6f49e80640267370e5db73ae87ddcb71421e715e0
TLSH
T124712E4EA759C049E7AC0938FAD0108B3B3087B2AC4F1E22179BDA75F476BD84AD0C51
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597c5a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe597c5a.TMP
Size 3KB
SHA256 849db34747245eca273c64d9c1ed166d6e185f2524eed5d4e4d7d404aa670a4d
MD5 c9892d6923d1970946a0a375183825c1
SHA1 de55f9510892d9e42a0236ce6c73930176cfd4e0
SHA512 f77a9393caa3f34ec304776a4e9d3564b78783b18f5abbf5f5dce2e6d7ac66e87a212c12428ecbf5f188c865a3b5652e9e06f248062b6c22656183c57e160396
TLSH
T165712D4EA759C049E7AC0938FAD0108B3B3083B2AC8F1F12179BDA75F476BD84AD0C55
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d390001c6a2f485f6a8f87f024a9f3c490cfea076c4ce0d546d187fb42c2f120
MD5 af89848f6c87e9a56575d2d716537c42
SHA1 09953de999e313042bdb30a0104f472353468b9c
SHA512 36800097e04d741ebeacb567083f996201c62d7b07be94f52900142a2969a15e39147162548264bef9ae425a2711502db68f8bd772b8f9eb641856b7e3fe1904
TLSH
T1C84190F3C3E5866EC90156F0AA186E2BCE1D0915832C3D5AC9E4EF5B93E24B1D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4516d5f234c05e1a1e94cf59a7c6daad1c2260fd5ecb98eb579b9269a660065f
MD5 11edaa1970dbece883085f1fb47c5465
SHA1 f4cf020cb59e36760511a0c77474b51b2181ca84
SHA512 368eac896bf07eddf3cbcb09cf8962b509e1f80f130b7bfecb9e55f627779d947b9610c7db22770ca153f48058370ca1a115d66750bbd9cd253c169bdb216a33
SSDEEP 192:sxRLRvCm/ftsZCrZPOShzoA8p9a/g6+WNCvV/YoMQGtsIgtJ:sxRLQm/ftsZCFPu8/5U/8w3
TLSH
T15932B715AD68A93B8CCBE21DBB657F53E2F91032A0D51F48AAFC861C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ccbcf47d3d5ba3260b8e31e104f8cc1321283527477bd754d4f02bcbb28903c6
MD5 f612b89010ce01c138856f333abd79af
SHA1 3c417d433ddd4a0cca6a584767ecfb704bcdfd97
SHA512 dcfd53d01f11b4ae6cc569bffade38d81e557dc40866e792ee686c8d62181b69ff65bf100bea09846d95614460473f4b53a8007a25f590e89dfc3e1bab13d618
SSDEEP 192:sxRgRvCm/ftsGCrZPOShzoA8p9a/g6+WNCvV/YoMQGtsIgD9J:sxRgQm/ftsGCFPu8/5U/8wD
TLSH
T1DA32B715AD68A93B8CDBD21DBB65BF53E2F91032A0D51F48AAFC861C05E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 65b05d9620aa89ed226cb5a373c567e1d966270a841f3ad30308077a953b1805
MD5 bf24340ac947b03c17017288b32d83ae
SHA1 a9d7c0d4549a994890602a93dc44dac0403f2927
SHA512 9fd3c85b198075e47442a611df228cf0a85a6c208e8ed18cc93364eba4f91739fb497d79c99602695a92f6b5cee1f10abc40dd992deba8d97a4cc225464911cf
SSDEEP 192:sxRgRvCm/fts5CrZPOShzoA8p9a/g6+WNCvV/YoTCQGtsIgDfJ:sxRgQm/fts5CFPu8/5U/Xqwt
TLSH
T1DF42C815AD68693B8CCBE21DBB557F53E2F91032A0D51F48A6FC861C15E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 c9d0277f9f8bfc2159f58d12d8f42557ca452e8ed5fb213dc77c8cba10241d82
MD5 ad03ed6b2a660e3c6fa1bcbbf353d2a0
SHA1 287209976e0fed1a44a6dd6268285da573efaa1b
SHA512 04a4f2ea3986011bd61af4c94c92ca505135f9c944b46aa9701494cabec61d0ec3ebfb9a6b0623e1665bfb5a3e355f1f7cf5de7d563f18c8f1daff2f29b15cc4
SSDEEP 768:p/wWhO7pLuLbOnWg/Xf1p8F1+UoAYDCx9Tuqh0VfUC9xbog/OV2iXH3Ifroia7je:p/wWhOEbOnWg/Xf1pu1jaJiXXIMt7je
TLSH
T16DD2D97B740CCA7F4F804ADDDC197A9F6DA802CB9698CD8047FA985C02C67EA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c147a318-1935-4d7e-8211-fd91bb08eae5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c147a318-1935-4d7e-8211-fd91bb08eae5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 108702c0c6f58c6a852b88c109e844cefa19f90666b81ef069d57e956a540ec0
MD5 a89e29b47bc907fdc9c0e02196ebf094
SHA1 6f532d688169365d941ce3817f80a9e62eb959e5
SHA512 8f80918af3a4e96574d055dd1c4f87a926942a89ee78d624f69cbe79c615f3653d053894eb655229feb39b8e121665a9eaaedb1a2b7621304bf81cac7bf64f44
SSDEEP 768:X/UxvxjgC+H3VdEOEA/9OA9at01j0iq00+Ia2rSHxRz:KZj3+H3V8CHq00NaISTz
TLSH
T1FB03C031ECA19D739CF7B384730A63979FF44663C6C56AA049ED2A0E05876AD1307CA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 c8252fb260d72aa8fa04cc6f0f2c39ac4e92ffd3c335e84bce8347fbb535c378
MD5 a3fb54f04c3967ca693faf979866e01f
SHA1 09994c02bd238022fc331104cf46708b23120648
SHA512 936a6e7cf04c6fac471c4ca221d65bc8415addf699f071e844fe625d56589310ad14174b4c99968a88c06f71362a9c78d0f399efd0a167d24f71d15e747a5ed7
SSDEEP 768:m/UxvxjgC+13d2oOE+3I/9OA9at01j0iq00+IaipSHx68:bZj3+13dIRCHq00NaWSQ8
TLSH
T11203C031ECA29D739CFAB284730A63C79FF41663C5C55EA489E91A0D04877AD170BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 a39dd07d4d20abb4f913fbf188fdfd5145077ab08f561b9b2e48eba86eea526f
MD5 9eafe97501421a2ed65292b4a69a503b
SHA1 71aa322e97234d07dd1c6a6ff97809ca3352c41d
SHA512 189d3c34352f68ab591bab21a0ba877ec5d5ce8e03e11565a8c0ed27b942f6bcb2f9b86cea652082b3f94d13b3df34829b1aa0e73ede6714a23b34f425b10c22
SSDEEP 768:+k3XioOE+3r/9OA9at01j0iq00+IaipMgm2n:+k3XskCHq00NaWMgvn
TLSH
T15EF2AFB1ACA1DD739CFAB385B30663876FF41663C5C94E84C5E95A0E04476AE170BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 6c6efb2a274ff633298009738192c1ed71f4b9ebcb13d7000b27c513c05879c1
MD5 0c5b5de0a3c518f49a3dd241428fa344
SHA1 9d349999d90d1a79c6acf88ccc64c433456a8f5c
SHA512 0b5ae75981d7a47d55578e51ebca2a35c68d1a372e6a8496cff72adec2e146968ad77079f4a9a43f20d49156d0ac66918bc5bf7d544146b2942ce79e6a711d93
SSDEEP 768:bK4FQey3uwgWc+xIOE+3z/9OA9at01j0iq00+IaipMgm2n:cX35lMCHq00NaWMgvn
TLSH
T10A1328F198D38977E8AE5783A33D6E469EBCC153B5898980B7D91D0DCC422BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7fa7e697-22dc-4109-bdfb-fa830a1b6262.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\7fa7e697-22dc-4109-bdfb-fa830a1b6262.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6100_1322729447\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 8f04bf1f444569b173a13c270f7900892cf26b734c379f0a73b505e12a7e1363
MD5 7f3f8508d05a8b25ba52b6d1ab21e83e
SHA1 61cf05be805b4e64fd9b36e76e7d1990dd757805
SHA512 a30b29787cbeacf8bce53b509d7badc9da0dd61d76cd38b441f58bb440b87857d6caad23b3394ab52211b8fe342b187d11541cac22387eb8e1e69a5cc8f45962
TLSH
T11171238356B8D9F2C1DA5BF002835648F1FF223C0B2370304B555546AB30A7A64B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/704-274-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/908-332-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/908-448-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/940-472-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1376-312-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1376-392-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1760-230-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1760-295-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1760-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2344-405-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2704-417-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2720-365-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2744-317-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3820-454-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4204-336-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4492-496-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4504-183-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5324-258-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5336-450-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5336-428-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5852-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5988-492-0x0000000000010000-0x00000000000AB000-memory.dmp

Download