systex | cf22cba3362c6c92346898907a714c1f5897dc60705e1402127e5e3fde45ab86

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 23:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260920-21aghsvsbv
SHA256 cf22cba3362c6c92346898907a714c1f5897dc60705e1402127e5e3fde45ab86
MD5 ea12c2d3a0e27fcab775b8ef2bed890d
SHA1 d91fbdd1000f892641e47882d4cb801f3da4a203
SHA512 7fa0b8611f18a08422950ef5670837c5b1778a4e80ec90832df676d5753553f667ae4be6841ce53f329f88463adad91c58e9d4c11776593f3afafea5b95b33f4
SSDEEP 6144:oflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:oflfAsiVGjSGecvX
TLSH
T1CF747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4960	cwuomgezwromgezw.exe
5308	cwuomgezwromgezw.sys
524	CreateProcess.exe
5676	ecwuomgeyw.exe
4636	CreateProcess.exe
3576	CreateProcess.exe
1752	i_ecwuomgeyw.exe
5836	omgeywtolj.sys
3084	CreateProcess.exe
2072	ljgbywqojg.exe
4380	CreateProcess.exe
4572	CreateProcess.exe
5900	i_ljgbywqojg.exe
2180	oigaywqoig.sys
8	CreateProcess.exe
2544	igdbvtolgd.exe
5800	CreateProcess.exe
3720	CreateProcess.exe
360	i_igdbvtolgd.exe
400	nljdbvtnlf.sys
3452	CreateProcess.exe
5892	dbvtnlfdyv.exe
3156	CreateProcess.exe
1720	CreateProcess.exe
2328	i_dbvtnlfdyv.exe
1064	fdxvqnlfda.sys
2220	CreateProcess.exe
4344	ayvqnifays.exe
5288	CreateProcess.exe
3832	CreateProcess.exe
4204	i_ayvqnifays.exe
5772	avsmkfcxvp.sys
2052	CreateProcess.exe
4924	usmkfcxvpn.exe
3264	CreateProcess.exe
1400	CreateProcess.exe
5484	i_usmkfcxvpn.exe
4296	smkhfzxupm.sys
5780	CreateProcess.exe
1248	rpnkeczxup.exe
2788	CreateProcess.exe
3792	CreateProcess.exe
3152	i_rpnkeczxup.exe
4436	hczurpjhcz.sys
4692	CreateProcess.exe
3196	zxrmjeczur.exe
1668	CreateProcess.exe
1288	CreateProcess.exe
2464	i_zxrmjeczur.exe
3376	ecwurmjecw.sys
5128	CreateProcess.exe
3492	zwrpjhbztr.exe
4544	CreateProcess.exe
1688	CreateProcess.exe
5140	i_zwrpjhbztr.exe
1324	wromgeywro.sys
5624	CreateProcess.exe
2616	trlgeywrom.exe
5056	CreateProcess.exe
800	CreateProcess.exe
3536	i_trlgeywrom.exe
5824	ljdbwtnlgd.sys
5448	CreateProcess.exe
2248	igeywqoigb.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4664_314817656\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4664_476770933\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4664_1118619818\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4664_1118619818\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4664_476770933\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4664_10942890\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4664_10942890\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4664_1118619818\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4664_1118619818\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czurmkebzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrmjeczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvsnlidays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrmjhczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdbvtqgay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpnkeczxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icausnkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljgbywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqlidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurmkebzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomgezwromgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igdbvtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqojgbywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igdbvtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ayvqnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvsnlidays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causpkhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqojgbywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrmjeczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausnkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljgbywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trlgeywrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trlgeywrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqlidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrmjhczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ayvqnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpnkeczxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causpkhfzx.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4136	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6028	ipconfig.exe
4848	ipconfig.exe
1512	ipconfig.exe
3972	ipconfig.exe
5084	ipconfig.exe
4892	ipconfig.exe
2844	ipconfig.exe
6140	ipconfig.exe
5504	ipconfig.exe
3840	ipconfig.exe
3940	ipconfig.exe
2348	ipconfig.exe
5124	ipconfig.exe
4712	ipconfig.exe
5980	ipconfig.exe
2964	ipconfig.exe
2280	ipconfig.exe
2680	ipconfig.exe
3176	ipconfig.exe
1512	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134344189565000314"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-696679853-3915825385-3233721679-1000\{25390983-D912-407A-8FDB-44F132E2E90D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	cwuomgezwromgezw.exe
4960	cwuomgezwromgezw.exe
4960	cwuomgezwromgezw.exe
4960	cwuomgezwromgezw.exe
4960	cwuomgezwromgezw.exe
4960	cwuomgezwromgezw.exe
4960	cwuomgezwromgezw.exe
4960	cwuomgezwromgezw.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1752	i_ecwuomgeyw.exe
Token: SeDebugPrivilege	5900	i_ljgbywqojg.exe
Token: SeDebugPrivilege	360	i_igdbvtolgd.exe
Token: SeDebugPrivilege	2328	i_dbvtnlfdyv.exe
Token: SeDebugPrivilege	4204	i_ayvqnifays.exe
Token: SeDebugPrivilege	5484	i_usmkfcxvpn.exe
Token: SeDebugPrivilege	3152	i_rpnkeczxup.exe
Token: SeDebugPrivilege	2464	i_zxrmjeczur.exe
Token: SeDebugPrivilege	5140	i_zwrpjhbztr.exe
Token: SeDebugPrivilege	3536	i_trlgeywrom.exe
Token: SeDebugPrivilege	2368	i_igeywqoigb.exe
Token: SeDebugPrivilege	3724	i_aysqlidavt.exe
Token: SeDebugPrivilege	4624	i_bvsnlidays.exe
Token: SeDebugPrivilege	1628	i_icausnkica.exe
Token: SeDebugPrivilege	4744	i_causpkhfzx.exe
Token: SeDebugPrivilege	2808	i_zxrmjhczur.exe
Token: SeDebugPrivilege	4144	i_czurmkebzx.exe
Token: SeDebugPrivilege	2296	i_uomgezwrpj.exe
Token: SeDebugPrivilege	4968	i_wqojgbywqo.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 4960	4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4288 wrote to memory of 4832	4288	2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 4832 wrote to memory of 4664	4832	iexplore.exe	91
PID 4664 wrote to memory of 2576	4664	msedge.exe	92
PID 4664 wrote to memory of 248	4664	msedge.exe	94
PID 4664 wrote to memory of 4136	4664	msedge.exe	93
PID 4664 wrote to memory of 248	4664	msedge.exe	94
PID 4664 wrote to memory of 248	4664	msedge.exe	94
PID 4664 wrote to memory of 5948	4664	msedge.exe	95
PID 4664 wrote to memory of 5948	4664	msedge.exe	95
PID 4664 wrote to memory of 992	4664	msedge.exe	97
PID 4664 wrote to memory of 992	4664	msedge.exe	97
PID 4664 wrote to memory of 992	4664	msedge.exe	97
PID 4664 wrote to memory of 5440	4664	msedge.exe	98
PID 4664 wrote to memory of 5440	4664	msedge.exe	98
PID 4664 wrote to memory of 5440	4664	msedge.exe	98
PID 4664 wrote to memory of 1964	4664	msedge.exe	99
PID 4664 wrote to memory of 1964	4664	msedge.exe	99
PID 4664 wrote to memory of 1964	4664	msedge.exe	99
PID 4664 wrote to memory of 5576	4664	msedge.exe	100
PID 4664 wrote to memory of 5576	4664	msedge.exe	100
PID 4664 wrote to memory of 5576	4664	msedge.exe	100
PID 4664 wrote to memory of 2640	4664	msedge.exe	103
PID 4664 wrote to memory of 2640	4664	msedge.exe	103
PID 4664 wrote to memory of 4384	4664	msedge.exe	105
PID 4664 wrote to memory of 4384	4664	msedge.exe	105
PID 4664 wrote to memory of 1812	4664	msedge.exe	106
PID 4664 wrote to memory of 1812	4664	msedge.exe	106
PID 4664 wrote to memory of 5148	4664	msedge.exe	108
PID 4960 wrote to memory of 524	4960	cwuomgezwromgezw.exe	109
PID 5676 wrote to memory of 4636	5676	ecwuomgeyw.exe	112
PID 4664 wrote to memory of 4112	4664	msedge.exe	115
PID 4664 wrote to memory of 4112	4664	msedge.exe	115
PID 4664 wrote to memory of 1004	4664	msedge.exe	118
PID 4664 wrote to memory of 1004	4664	msedge.exe	118
PID 4960 wrote to memory of 3576	4960	cwuomgezwromgezw.exe	119
PID 4960 wrote to memory of 3084	4960	cwuomgezwromgezw.exe	123
PID 2072 wrote to memory of 4380	2072	ljgbywqojg.exe	125
PID 4960 wrote to memory of 4572	4960	cwuomgezwromgezw.exe	128
PID 4960 wrote to memory of 8	4960	cwuomgezwromgezw.exe	132
PID 2544 wrote to memory of 5800	2544	igdbvtolgd.exe	134
PID 4960 wrote to memory of 3720	4960	cwuomgezwromgezw.exe	137
PID 4960 wrote to memory of 3452	4960	cwuomgezwromgezw.exe	142
PID 5892 wrote to memory of 3156	5892	dbvtnlfdyv.exe	144
PID 4960 wrote to memory of 1720	4960	cwuomgezwromgezw.exe	147
PID 4664 wrote to memory of 2508	4664	msedge.exe	149
PID 4664 wrote to memory of 5792	4664	msedge.exe	150
PID 4664 wrote to memory of 1364	4664	msedge.exe	151
PID 4960 wrote to memory of 2220	4960	cwuomgezwromgezw.exe	154
PID 4344 wrote to memory of 5288	4344	ayvqnifays.exe	156
PID 4960 wrote to memory of 3832	4960	cwuomgezwromgezw.exe	159
PID 4960 wrote to memory of 2052	4960	cwuomgezwromgezw.exe	163
PID 4924 wrote to memory of 3264	4924	usmkfcxvpn.exe	165
PID 4960 wrote to memory of 1400	4960	cwuomgezwromgezw.exe	168
PID 4960 wrote to memory of 5780	4960	cwuomgezwromgezw.exe	172
PID 1248 wrote to memory of 2788	1248	rpnkeczxup.exe	174
PID 4960 wrote to memory of 3792	4960	cwuomgezwromgezw.exe	177
PID 4960 wrote to memory of 4692	4960	cwuomgezwromgezw.exe	181
PID 3196 wrote to memory of 1668	3196	zxrmjeczur.exe	183
PID 4960 wrote to memory of 1288	4960	cwuomgezwromgezw.exe	186
PID 4664 wrote to memory of 5068	4664	msedge.exe	188
PID 4664 wrote to memory of 5068	4664	msedge.exe	188
PID 4960 wrote to memory of 5128	4960	cwuomgezwromgezw.exe	194
PID 3492 wrote to memory of 4544	3492	zwrpjhbztr.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-20_ea12c2d3a0e27fcab775b8ef2bed890d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Temp\cwuomgezwromgezw.exe
  C:\Temp\cwuomgezwromgezw.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwuomgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:524
  - - C:\Temp\ecwuomgeyw.exe
      C:\Temp\ecwuomgeyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5676
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4636
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwuomgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3576
  - - C:\Temp\i_ecwuomgeyw.exe
      C:\Temp\i_ecwuomgeyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljgbywqojg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3084
  - - C:\Temp\ljgbywqojg.exe
      C:\Temp\ljgbywqojg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2072
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4380
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljgbywqojg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4572
  - - C:\Temp\i_ljgbywqojg.exe
      C:\Temp\i_ljgbywqojg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igdbvtolgd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:8
  - - C:\Temp\igdbvtolgd.exe
      C:\Temp\igdbvtolgd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2544
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5800
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igdbvtolgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3720
  - - C:\Temp\i_igdbvtolgd.exe
      C:\Temp\i_igdbvtolgd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtnlfdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3452
  - - C:\Temp\dbvtnlfdyv.exe
      C:\Temp\dbvtnlfdyv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5892
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3156
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2348
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtnlfdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1720
  - - C:\Temp\i_dbvtnlfdyv.exe
      C:\Temp\i_dbvtnlfdyv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ayvqnifays.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2220
  - - C:\Temp\ayvqnifays.exe
      C:\Temp\ayvqnifays.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4344
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5288
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ayvqnifays.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3832
  - - C:\Temp\i_ayvqnifays.exe
      C:\Temp\i_ayvqnifays.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkfcxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2052
  - - C:\Temp\usmkfcxvpn.exe
      C:\Temp\usmkfcxvpn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4924
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3264
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkfcxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1400
  - - C:\Temp\i_usmkfcxvpn.exe
      C:\Temp\i_usmkfcxvpn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpnkeczxup.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5780
  - - C:\Temp\rpnkeczxup.exe
      C:\Temp\rpnkeczxup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2788
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpnkeczxup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3792
  - - C:\Temp\i_rpnkeczxup.exe
      C:\Temp\i_rpnkeczxup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrmjeczur.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4692
  - - C:\Temp\zxrmjeczur.exe
      C:\Temp\zxrmjeczur.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3196
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrmjeczur.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1288
  - - C:\Temp\i_zxrmjeczur.exe
      C:\Temp\i_zxrmjeczur.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwrpjhbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5128
  - - C:\Temp\zwrpjhbztr.exe
      C:\Temp\zwrpjhbztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3492
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4544
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwrpjhbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1688
  - - C:\Temp\i_zwrpjhbztr.exe
      C:\Temp\i_zwrpjhbztr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trlgeywrom.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5624
  - - C:\Temp\trlgeywrom.exe
      C:\Temp\trlgeywrom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2616
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5056
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trlgeywrom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:800
  - - C:\Temp\i_trlgeywrom.exe
      C:\Temp\i_trlgeywrom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igeywqoigb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5448
  - - C:\Temp\igeywqoigb.exe
      C:\Temp\igeywqoigb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4592
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igeywqoigb.exe ups_ins
    3⤵
    PID:2464
  - - C:\Temp\i_igeywqoigb.exe
      C:\Temp\i_igeywqoigb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqlidavt.exe ups_run
    3⤵
    PID:1132
  - - C:\Temp\aysqlidavt.exe
      C:\Temp\aysqlidavt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5660
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3004
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqlidavt.exe ups_ins
    3⤵
    PID:4296
  - - C:\Temp\i_aysqlidavt.exe
      C:\Temp\i_aysqlidavt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvsnlidays.exe ups_run
    3⤵
    PID:796
  - - C:\Temp\bvsnlidays.exe
      C:\Temp\bvsnlidays.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3236
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3856
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvsnlidays.exe ups_ins
    3⤵
    PID:4504
  - - C:\Temp\i_bvsnlidays.exe
      C:\Temp\i_bvsnlidays.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icausnkica.exe ups_run
    3⤵
    PID:6020
  - - C:\Temp\icausnkica.exe
      C:\Temp\icausnkica.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2612
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5576
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icausnkica.exe ups_ins
    3⤵
    PID:3340
  - - C:\Temp\i_icausnkica.exe
      C:\Temp\i_icausnkica.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causpkhfzx.exe ups_run
    3⤵
    PID:2964
  - - C:\Temp\causpkhfzx.exe
      C:\Temp\causpkhfzx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2580
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2156
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causpkhfzx.exe ups_ins
    3⤵
    PID:4720
  - - C:\Temp\i_causpkhfzx.exe
      C:\Temp\i_causpkhfzx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrmjhczur.exe ups_run
    3⤵
    PID:2748
  - - C:\Temp\zxrmjhczur.exe
      C:\Temp\zxrmjhczur.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4980
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrmjhczur.exe ups_ins
    3⤵
    PID:4256
  - - C:\Temp\i_zxrmjhczur.exe
      C:\Temp\i_zxrmjhczur.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czurmkebzx.exe ups_run
    3⤵
    PID:4428
  - - C:\Temp\czurmkebzx.exe
      C:\Temp\czurmkebzx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4620
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3204
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czurmkebzx.exe ups_ins
    3⤵
    PID:4828
  - - C:\Temp\i_czurmkebzx.exe
      C:\Temp\i_czurmkebzx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomgezwrpj.exe ups_run
    3⤵
    PID:1152
  - - C:\Temp\uomgezwrpj.exe
      C:\Temp\uomgezwrpj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4648
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2368
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomgezwrpj.exe ups_ins
    3⤵
    PID:5936
  - - C:\Temp\i_uomgezwrpj.exe
      C:\Temp\i_uomgezwrpj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqojgbywqo.exe ups_run
    3⤵
    PID:1324
  - - C:\Temp\wqojgbywqo.exe
      C:\Temp\wqojgbywqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1100
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2016
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqojgbywqo.exe ups_ins
    3⤵
    PID:1500
  - - C:\Temp\i_wqojgbywqo.exe
      C:\Temp\i_wqojgbywqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdbvtqgay.exe ups_run
    3⤵
    PID:5804
  - - C:\Temp\lgdbvtqgay.exe
      C:\Temp\lgdbvtqgay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4116
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2308
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2844
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7fffebeec188,0x7fffebeec194,0x7fffebeec1a0
      4⤵
      PID:2576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,2456707189870727416,9096149525298240250,524288 --field-trial-handle=2216,i,10197628125785159827,8663899386960784014,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:11
      4⤵
      System Time Discovery
      PID:4136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,1973564081925315233,5771501780889068602,262144 --field-trial-handle=2216,i,10197628125785159827,8663899386960784014,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:2
      4⤵
      PID:248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,8686996907086144109,10985861767666350214,524288 --field-trial-handle=2216,i,10197628125785159827,8663899386960784014,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:13
      4⤵
      PID:5948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,18087493050987602163,12710885690451162842,2097152 --field-trial-handle=2216,i,10197628125785159827,8663899386960784014,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,547376000805333073,8041307419029538868,2097152 --field-trial-handle=2216,i,10197628125785159827,8663899386960784014,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:5440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4400,i,1101293105506102639,3187327228531990184,2097152 --field-trial-handle=2216,i,10197628125785159827,8663899386960784014,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:1
      4⤵
      PID:1964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4404,i,13941218092322190718,426172554168665102,2097152 --field-trial-handle=2216,i,10197628125785159827,8663899386960784014,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:9
      4⤵
      PID:5576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,15307995082835961554,15143140685690526136,524288 --field-trial-handle=2216,i,10197628125785159827,8663899386960784014,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14
      4⤵
      PID:2640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,17900308864552454008,10979499122028100549,524288 --field-trial-handle=2216,i,10197628125785159827,8663899386960784014,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
      4⤵
      PID:4384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,14801689310153934155,14688048904396776049,524288 --field-trial-handle=2216,i,10197628125785159827,8663899386960784014,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
      4⤵
      PID:1812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,12069598428849822297,12356863035686040781,524288 --field-trial-handle=2216,i,10197628125785159827,8663899386960784014,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
      4⤵
      PID:5980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,12069598428849822297,12356863035686040781,524288 --field-trial-handle=2216,i,10197628125785159827,8663899386960784014,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
      4⤵
      PID:5148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,14371098109771122502,14794156945915612849,524288 --field-trial-handle=2216,i,10197628125785159827,8663899386960784014,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,17469139008428994663,4756993443629511811,524288 --field-trial-handle=2216,i,10197628125785159827,8663899386960784014,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
      4⤵
      PID:1004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,8335953460486736033,10007947408456226483,524288 --field-trial-handle=2216,i,10197628125785159827,8663899386960784014,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
      4⤵
      PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,7732556878631688193,13217590473589104071,524288 --field-trial-handle=2216,i,10197628125785159827,8663899386960784014,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
      4⤵
      PID:5792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,10115404368053891770,6455316504618885464,524288 --field-trial-handle=2216,i,10197628125785159827,8663899386960784014,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
      4⤵
      PID:1364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,6741966272629723099,4222966717990430592,524288 --field-trial-handle=2216,i,10197628125785159827,8663899386960784014,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
      4⤵
      PID:5068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,8768939083122760156,11604268489725797760,524288 --field-trial-handle=2216,i,10197628125785159827,8663899386960784014,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
      4⤵
      PID:2968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=932,i,18165188080208873529,16496775600333410810,524288 --field-trial-handle=2216,i,10197628125785159827,8663899386960784014,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
      4⤵
      PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,9435920478991727472,10183487772262486345,524288 --field-trial-handle=2216,i,10197628125785159827,8663899386960784014,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:14
      4⤵
      PID:4264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6300,i,12241904410777658838,7104127706217876392,262144 --field-trial-handle=2216,i,10197628125785159827,8663899386960784014,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:10
      4⤵
      PID:1336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,11643472503987770201,15837723177470002030,524288 --field-trial-handle=2216,i,10197628125785159827,8663899386960784014,262144 --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:14
      4⤵
      PID:3588

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3664

C:\Temp\cwuomgezwromgezw.sys
C:\Temp\cwuomgezwromgezw.sys
1⤵
- Executes dropped EXE
PID:5308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3064

C:\Temp\omgeywtolj.sys
C:\Temp\omgeywtolj.sys
1⤵
- Executes dropped EXE
PID:5836

C:\Temp\oigaywqoig.sys
C:\Temp\oigaywqoig.sys
1⤵
- Executes dropped EXE
PID:2180

C:\Temp\nljdbvtnlf.sys
C:\Temp\nljdbvtnlf.sys
1⤵
- Executes dropped EXE
PID:400

C:\Temp\fdxvqnlfda.sys
C:\Temp\fdxvqnlfda.sys
1⤵
- Executes dropped EXE
PID:1064

C:\Temp\avsmkfcxvp.sys
C:\Temp\avsmkfcxvp.sys
1⤵
- Executes dropped EXE
PID:5772

C:\Temp\smkhfzxupm.sys
C:\Temp\smkhfzxupm.sys
1⤵
- Executes dropped EXE
PID:4296

C:\Temp\hczurpjhcz.sys
C:\Temp\hczurpjhcz.sys
1⤵
- Executes dropped EXE
PID:4436

C:\Temp\ecwurmjecw.sys
C:\Temp\ecwurmjecw.sys
1⤵
- Executes dropped EXE
PID:3376

C:\Temp\wromgeywro.sys
C:\Temp\wromgeywro.sys
1⤵
- Executes dropped EXE
PID:1324

C:\Temp\ljdbwtnlgd.sys
C:\Temp\ljdbwtnlgd.sys
1⤵
- Executes dropped EXE
PID:5824

C:\Temp\igdbvtnlgd.sys
C:\Temp\igdbvtnlgd.sys
1⤵
PID:3500

C:\Temp\dbvtnlfdav.sys
C:\Temp\dbvtnlfdav.sys
1⤵
PID:3292

C:\Temp\ifdxvpnhfd.sys
C:\Temp\ifdxvpnhfd.sys
1⤵
PID:4160

C:\Temp\cxusmkhfzx.sys
C:\Temp\cxusmkhfzx.sys
1⤵
PID:5124

C:\Temp\keczxupmkh.sys
C:\Temp\keczxupmkh.sys
1⤵
PID:1500

C:\Temp\jhezxrpjhc.sys
C:\Temp\jhezxrpjhc.sys
1⤵
PID:2380

C:\Temp\uoljhbzwro.sys
C:\Temp\uoljhbzwro.sys
1⤵
PID:3296

C:\Temp\byomgezwqo.sys
C:\Temp\byomgezwqo.sys
1⤵
PID:5620

C:\Temp\lgdbwtnljd.sys
C:\Temp\lgdbwtnljd.sys
1⤵
PID:2528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avsmkfcxvp.sys

Path C:\Temp\avsmkfcxvp.sys
Size 293KB
SHA256 6b44292bed2568108f83788b9e3ce79119273caa791bcd04787f57d861ca4aee
MD5 0ed8ea72185357cc6e6970b0fe90b332
SHA1 fa096fa5c04457e7795bea0ab23dbc182abe7a38
SHA512 5d83cb18a48ee53eb5365da9a3398cc1c519666191262ece578f2928015ebe77f850c1cf8d0d22eab571ac8f7551f3d640997365bb311ea77b8442218e190d12
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E1545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ayvqnifays.exe

Path C:\Temp\ayvqnifays.exe
Size 361KB
SHA256 2fd13b58736e08f143f55ed6382096c7a4837750eaacd8a09d122fb10ed5b3bb
MD5 19532b2ed2e180aeafba851e63638974
SHA1 6bc81faf161791f16710a0d2f7ffc87f4fce57b5
SHA512 f20e446b5450412db91da26643a100086b1f98a5af7741f404e3f5683d015d49edf2a731f8df26443c8666bd0efe266142a26acf8d1b978e4c1e69fb6105fc93
SSDEEP 6144:xflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:xflfAsiVGjSGecvX
TLSH
T1E3747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwuomgezwromgezw.exe

Path C:\Temp\cwuomgezwromgezw.exe
Size 361KB
SHA256 4491cc757d6b63eac121f72767dffe107f5466e17ee94c8105bb71839dc65dce
MD5 c86a168042fc67d35db982f9b308310c
SHA1 5dd58bf989959085f78906da6f007b6e29f537e9
SHA512 e9944275dc48039b59825d0ffd51cea0436913df8deacaf0b404b8a73506561f93145b00120d1de056c6695edac3d1feb596cd06ab225f7719a6472a4d7ea7c0
SSDEEP 6144:FflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:FflfAsiVGjSGecvX
TLSH
T145747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwuomgezwromgezw.sys

Path C:\Temp\cwuomgezwromgezw.sys
Size 293KB
SHA256 02f015442251b0436e452a38727a756c30d7f453da36224ed7aed7a72f9b4969
MD5 10b6405b7d692e9da77799cd6e82f838
SHA1 a47eb9f1c76fa81b1fc3dfd80865f90c58465bde
SHA512 c852d7ee872746cfddc54a437e6ca214459501aa828491bee122e8feb137040b8f6dd51abb257b06f644b1c27ef3a97db6a0d2b36047454968ac207756ecb084
SSDEEP 3072:qtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:qIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtnlfdyv.exe

Path C:\Temp\dbvtnlfdyv.exe
Size 361KB
SHA256 8083a282aa57a500dab69638e833b11348b45dec1e2150691e891ed0645b0e50
MD5 0e267070f62e00b0a08a9cf1a4f1d8a6
SHA1 2127ac6cf0a2ff179469269313e0f5f5a6bbb0e7
SHA512 984f8ee514749cb8d71d7e8e3cfd92d5f7939304458d55a048dc5f129731da59cd520f0fb3a8da6e7345085fee9924387a2c31d885684783a97de25d04ca5270
SSDEEP 6144:AflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:AflfAsiVGjSGecvX
TLSH
T129747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomgeyw.exe

Path C:\Temp\ecwuomgeyw.exe
Size 361KB
SHA256 89d72aab916cd20603cd75bb33fa013bc5f3b71ea22a6915f6a859a812128d31
MD5 c2c37d635bedaea460abaac94aed0cb5
SHA1 945ba683d6fe7abe353aa20c23c6cc033b05b830
SHA512 ac9abab8082e307a527e5ad1b59e51ef0e3eca4c8cbd2ed0290ea6b2ad07caf919f5a8779bfafb62c30ea333e479671da22280c5542c86a7b9c776ce7061fcc3
SSDEEP 6144:1flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:1flfAsiVGjSGecvX
TLSH
T148747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvqnlfda.sys

Path C:\Temp\fdxvqnlfda.sys
Size 293KB
SHA256 f192708756b257e7283deadbe7d537586c0db83e0f3bcaed702d40922ffb7483
MD5 3417fb32a9fbe850c28a304631421da2
SHA1 13541da3c246c36f5aa940eb4a62db8f8a47eaae
SHA512 ddaaaa80075bbf5a6d3486a8d8001dd7c6f789dfb5c52b447e44ca1f397110e5bd9796e43baaccb3898f7bccea197eea5e02fb20dd5347ca3efc19c5add56fcc
SSDEEP 3072:JtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:JIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ayvqnifays.exe

Path C:\Temp\i_ayvqnifays.exe
Size 361KB
SHA256 5d4f7039d67b5e58bddf647f24573cef282254c0b31c76eaa467784eccae90b1
MD5 e4ba0dbcf5456c1790d152e75fa3ea29
SHA1 49326001e8ff7015e6581e31f0bec5edfb9fffdf
SHA512 4a74d9dd8da87a176e709c94e46a7d9ea8d043c0ac9d50fd6db17d6f6a7f854dd145a9535ae269d2492a59d077f5382a798c885ff6c26247d7149bf0d3083d3c
SSDEEP 6144:8flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:8flfAsiVGjSGecvX
TLSH
T1AC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbvtnlfdyv.exe

Path C:\Temp\i_dbvtnlfdyv.exe
Size 361KB
SHA256 3567f8b4b7c23d176e0b2205c7b4626e77a99d237092a94ce703ddc29264c345
MD5 ad76203e14aa0302dc32438b1d81f639
SHA1 8b7cc503bdeb56b966994a0dbd11b1e5874ee2b9
SHA512 bf2c7fafacf781bd6897eb9381a4fb2852e8d2c203f71408e62260a40316c5f94e4f10a04992a66883cae9ef5b4249a57599db1d3a37309c41b1bce6213f99bb
SSDEEP 6144:vflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:vflfAsiVGjSGecvX
TLSH
T1EE747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecwuomgeyw.exe

Path C:\Temp\i_ecwuomgeyw.exe
Size 361KB
SHA256 be9651fdd25a57ae6c611de22dffc6f097f9c18c318e82d286b5f7f1956dc990
MD5 cb08b8c4d5b451c853b612f1a2a6f478
SHA1 c042b36af8ddeef59a2a74f7c44969b1672cf64f
SHA512 dde0ceb21a2d4026b549eff00c0315b9a86c5f073cb0075720fd6b7e24d4fc31afb9dcfbeaa8270c8fdf90529328fe3ef35c8335710fae34c9eac4bedf6f5d0d
SSDEEP 6144:cflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:cflfAsiVGjSGecvX
TLSH
T188747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igdbvtolgd.exe

Path C:\Temp\i_igdbvtolgd.exe
Size 361KB
SHA256 cffe61f4cd06776cff6678ae3e1484e08ee892c4f6bdd17bce2b69978122bbc9
MD5 aaf3d869697146bb319725424e2f64c6
SHA1 0f3bfc7a570b55f9200ce9ca085e7c1c47ac3571
SHA512 6b3bb157685a61ac4e2004c56a380cd93edb6850fa968df4d42ab49f9b488a10c8821133c6f057f28360731910cf5db54bc4a077369083f4451c19da3a05c026
SSDEEP 6144:rflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:rflfAsiVGjSGecvX
TLSH
T190747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljgbywqojg.exe

Path C:\Temp\i_ljgbywqojg.exe
Size 361KB
SHA256 8f974411175a1c16ff5bb36ca31eb5f76b40c401e3affd62ed2c34f61e43517d
MD5 f0f23d8a3626bfa36384bbeb9641874e
SHA1 c389e3d8044e11fba04dc64ca1502c1f1d51757a
SHA512 1c488289f11eac6b2a812b86f160b5c3e2c203896d8efcfe8b76748f739d7f14d56ca9b52a14dd6124d670504fd3ffaf8f62e1025ddbeaac502322136ba1cc13
SSDEEP 6144:cflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:cflfAsiVGjSGecvX
TLSH
T116747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igdbvtolgd.exe

Path C:\Temp\igdbvtolgd.exe
Size 361KB
SHA256 a6712d0eab5ed6b68e191178122e9ef09702688f37710a8efd15817227efe7da
MD5 04c7b63e3db42839ec573927c50f7803
SHA1 3bc0b143acb8fcf594075a795a00394874927569
SHA512 e863e8005d5a6bf886e436b100ed47f738ef3bb1e10b6e11af76d80c305eb21f3b7defcc4d82c288da799d4114ca172b339387a2e4999c1565ad46bb232eab3b
SSDEEP 6144:fflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:fflfAsiVGjSGecvX
TLSH
T11B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljgbywqojg.exe

Path C:\Temp\ljgbywqojg.exe
Size 361KB
SHA256 7a1c4dd94f253abdc0cf25d0b1b0c066a90f4ebe99e2b43659432c5acfb95ad6
MD5 782a894255bc7af3500d4b7352ec5231
SHA1 1b8bf89f688502c914edb9bfd19d8060ec372928
SHA512 32df9abfec82d6945bc7194e3fef9af38321408a42cd382b3a0d656758b4819331344a990251d926806b5c0c520deb11f6bf5d91e2d5a42de303dfd67757089e
SSDEEP 6144:qflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:qflfAsiVGjSGecvX
TLSH
T135747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nljdbvtnlf.sys

Path C:\Temp\nljdbvtnlf.sys
Size 293KB
SHA256 4de3a64ea69a307b0da8b9215df53d0885a6a0a5b36b50ff68cbd003ed0dbad6
MD5 2981ea9248d8598b1d9d15dbcb14acf3
SHA1 53a5c4d093f304812677f13d54a3cfb2e5fcc53c
SHA512 777a16d2fd1f0af82ddc97782e6ac9fcaa552a29a5d1f136da4ddccfd6ef9978288097d96f08761fd4151e267356bca1368e0fee012d2567d26f8e130d1e5a7b
SSDEEP 3072:htKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:hIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigaywqoig.sys

Path C:\Temp\oigaywqoig.sys
Size 293KB
SHA256 4ee027cf7c91af32f8d67466472cec7d1776c56839fef5f3199ac67596d11183
MD5 e9426d6edd118f7430d62c3b9f0dd70c
SHA1 f1bbd9ca12e4e1ed98bd85911d5a9bdd82428221
SHA512 e65692b6332932492010af11fa49a8fce241084004b3f0e98e41500811d26b087060c8e4c4ef2a1164d46b194ef3545649f40f2645b5f303d018ec96aed0baa2
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T13A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgeywtolj.sys

Path C:\Temp\omgeywtolj.sys
Size 293KB
SHA256 88c9ca5c9662b5c8ebaafa9ec2d0906d7824b9516d3b8ad1dc42ebb24bfe4389
MD5 18efaafa391b9db5600f891c1ac8377f
SHA1 15a4ba955dbbec705bd310166f8a0f04f882e047
SHA512 653e56c5b5f15f8cb9d1bda1a133ab2c84a2d7fc739317067ca84a65b53aecb1c456c2f46dfb9faa8bf420e1492b759bcf4d380f83e801147fb6e89a0a0e8db4
SSDEEP 3072:PtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:PIJjiJcbI03GBc3ucY5DCSj
TLSH
T113545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkfcxvpn.exe

Path C:\Temp\usmkfcxvpn.exe
Size 361KB
SHA256 b5a72f758d4d3445ac981940cf64e966ca1a8f367db0eb7f69cdac2a60f3c60b
MD5 9fe6b1ab70a1dc8e74a56fa0864a036d
SHA1 ca947e87dcaa12ccba1641854c32022ebf0be3b3
SHA512 ca0f0350b3e398280d00fee288cf1a2d1c38fbb6910fd8b3d2ccd253e91809f36054c8660e1091dc5597d50249863ab9ab9340db241b5deae590f1657ee8e570
SSDEEP 6144:gflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:gflfAsiVGjSGecvX
TLSH
T1AE747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2cc4d7e322cd532050e695d02a9a049c5c546b4bd38721ea486719c4b5d56f10
MD5 5242980dbf71303ae3d825a0c9924b34
SHA1 31bbaa219768703af7592cb936b2a2b973580362
SHA512 5ef1153919ef5c1e4af5e170f3ba1edad428c8a416754264166ced4fffe220f0489789002a31cc55a8ecdb1aa965f0a0a0b3f3fc3b55297bbc3f84eb214d9a42
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7u:fwUQC5VwBIiElEd2K57P7u
TLSH
T17BB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 91a032a4ffcdd10503afdeb5220904a7e7cea899c3a55606bb3e90180ed9472e
MD5 f04321ebc7aa4a8f91bb5362a6c4c79b
SHA1 c98d3283204e4a0453e416a04c3ae56e4c3feed8
SHA512 c2faa7fae738d85299e6f63b9eaf33c25db5a255ea3f5f6a8551842b7e0cec73c7e8b5e86a9cfb9714287d2b382b57b7249bc70671dbfde2815d5937243570af
TLSH
T1DED02B71F678E8D2C140043C00420920705035061F6801C207034038040324B55012C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 59619e39464102fa53912dd9a15237954c5125d546c48a72b8bdb58ad9eb9753
MD5 f80a0057aa895d42a15b594d07d09f76
SHA1 2478a67794a5362ccf809b7a2c8f64a03c72fa32
SHA512 4a9ec8459a11d9e573883d5eacfd5386cf838bad2bd0b33ff1b37017f5f2cf6bfcef877344a87892e3c49ce624e0cae52791ded1593b8233138de87fd2e5e634
TLSH
T1C6D02B75F668E9D2C140043C00410920706035066F6801C206030038040324B55022C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 dd898237161c492e388aa3b45b43cdcd796cdc5f10f27231855669a68b969456
MD5 2fd28c00b9e1857c52aa59f1be5a4122
SHA1 e32aeac089f02008c737a8b65fff8e3469454769
SHA512 d98fdbe3e5e85959ec8d865733f2d656b5a648d128e881c140ec04e944f465990c6c7fbe02714243164ba86275a17d390d81e7a63990241bce002dd6b359c4ed
TLSH
T13D51D7425A50C251FB9823FB86DCDC97FB324482A7C7DF9027A8D4BB984337570784A8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 806ac1a9ad4f3722b99f018e17ffd40f63342583e543d7b6f20690ac90bfd231
MD5 3c125e9a2b77cce4799fd4341e247311
SHA1 78a4e84d384c4c2ca1ac07bc0cd57a92706a2419
SHA512 1e711f5d5e7e21e9dd0d4c1d743013d4ad978cadbefa9871dc8a4fb6276215db7aed1b7c02f0d85c06de47a13f8994dfd9810ccbd8804636fd88d45be935691b
TLSH
T1D941A0F7C3E4866EC90156F0AA186E2BCE1D0915832C3D5AC9E4EF5B93E34B1E14155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f67c015b8c1297f72a68a3442599ea8519e36742033026715671370bff7fbc48
MD5 ad36b752c9327340467ecb31f5625f93
SHA1 80af21012180d45455765e9666eb424f03b77deb
SHA512 cb1e5be669ee9d96acc96136fe4ffb05de59385d511057eacbe21d31346790a1ee44d63df1f33755ae1d2c4bb1e9f569df2e489192e6b0793c3f02fff28c0a3d
SSDEEP 192:sxRpRBCT/f5sDtuZMnWlzzoA8p93/g6+WNCDI/YiKaDGyPIgD1J:sxRpCT/f5spI+Wlix/51/Xv7
TLSH
T12D42C959AE28B93B4CCBD219FB55BF53D2F9113250D51E48BAFC8A1C04E76DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e96d05aab7213710e903ce813b0ca0e8e82eee6904fcc5a8d2e3a10ca17a4c72
MD5 102a3988cb9685d6175d0f01c4292118
SHA1 765c620e2ad650b078484ded5dce6777211cd477
SHA512 dfad4453a91e616ba7f7a9056df4556ac93b987638ba34d64489ac545d63974605e61336e3c63362e891bac53481e6ae027c117252ad08877fb4af1612a5f8f6
SSDEEP 192:sxRpRBCT/f5sDFuZMnWlzzoA8p93/g6+WNCDI/YikaDGyPIgDPJ:sxRpCT/f5sxI+Wlix/51/1vN
TLSH
T1A532C955AE28B93B4CCBD219FB55BF53D2F9113251D51E48BAFC8A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0f2d3a55e1828c951b018bca9b2183970ab9062c2762ca10960e1ae47fa27f3f
MD5 c4784f2d533d921b3951c68221f3ae5d
SHA1 f216cd6c5f8932eaf635ca453928d95c495d3999
SHA512 ca575b1670a18ee51c66861f0dc7b65b959cb18f8b114d4dae447ab088be1720cb86cc96f25859225c2f0be9fec28761d1cc8fe44d7006a1cfc778a6a6e5f489
SSDEEP 192:sxRqRBCT/f5sdFuZMnWlzzoA8p93/g6+WNCDI/YikaDGyPIgtJ:sxRqCT/f5szI+Wlix/51/1v3
TLSH
T16A32B955AE28A93B4CC7D219FB65BF53D2F9113261D51E48FAFC8A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 2c5f4d9b68c30df33807535a0d2160d6b5fd95a7fbd5adb444c33d9f50dd3478
MD5 3dd675305e230c97ebde48abf264610f
SHA1 21c7d1e4b5061b43a7bc3be493e19fa1effada8b
SHA512 7a440e46deaad74b3bcacbb6ee6109c0b89cfdf44906cb76f7c40f58008f21e8bb4d5266d4186151ffc494e751cff94b606c540be1c11c565949720d22f9e2c4
SSDEEP 768:XIDmj17pLuLbdoWgvHfnv8F1+UoAYDCx9Tuqh0VfUC9xbog/OVyYDIljTroTrDl:XIDmjDEbdoWgvHfnvu1ja1YDmjgTrx
TLSH
T181D2EA7B640CCA7F4F800ADDAC297A9B6DA802CB9698C94047FA941C02D6BEF51164DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9daa34fa2d2ba54108dce6ae9cfaf54f2a64693887e08ce69c48164997efe3e2
MD5 51d646c348ac5ef3b76c86b7b4982356
SHA1 4c3df00f6bfbd5c23afcf70cd43b19945844acc8
SHA512 df23557bb40c575cba5dfbcbf536f420d0042ae3248222ade2a6f998c9cda1adc6eebf9255842d55176a55e5a047393262cc6c424540b5f5f8d3c0c2ec4d10dc
SSDEEP 24:KEsles3sys6Bs/EsmsCsL/sysn1s6ISsOsLKpsEhBsYsL1bsUsbSds1jsQzsCs4r:KUoIvK1+cTyFxIhKyc8ryJeIfKjysn
TLSH
T1FB91B22431361240783F395CA0E4A7EE464175637438EA6F7FE914568E2BE084EFE5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a3421.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a3421.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 f062b9aa8a9ffe16cd4268fd4cd49fc13a3e583c4380531620230372140234a0
MD5 2aa551b55825fa45933276a99dcf1a55
SHA1 295240d19f9a377ea5469d7042b0e53e99710d01
SHA512 c4cdfde98878fc8349a1832c8c5c2813a25e39f58a8e7a97d42f2544edf0ea36bbdb083866ee7b92052c538ea8ce47b8271fff527436301fb73ec71405eecaa6
SSDEEP 768:n130qEcZ0rfZWMYo8SJYo4XBw4Ot5AEl94BHYjHwVoUV:n130MXBVa5AEncHYjQ+UV
TLSH
T114F2A078DC769D238CFBE2C5B6073641AEF5A5A3E4905DC4F8E85A0E098729E170B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 90a2d8c4d818062e2812e1e21f68685e52cc7b579dd16c556fbd4c5eaa6e471b
MD5 8bc86c3c041a1bef65ec423a24afaf1b
SHA1 2664444ebba53e0516614b7a0995b15a45d0ec3a
SHA512 4183076bdd4320433e6d40834652d6834f2cb3122b2cb1298e46b6e3a87d7de6199f8db66be3723eb467b78df7a7671c98d84de4b43d7cfa59c3945dee19488b
SSDEEP 768:w/UxvxjgC+c3vOEcZ0rfZWMYo8SJYo4XBw4Ot5AEl94BHYjHwVoUzN:dZj3+c3vYXBVa5AEncHYjQ+UzN
TLSH
T11F13BF38D8655C2398F7E2C4B7173382EEF155A3A4C16DD4A9E95A0E0E8739E134B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 07fca65ccfeaa2b086b5aaa5c5b874a052c82f4b64f6dd308d48660bca345cfa
MD5 68d04a86e8add9f624c2d53e3f9ae5be
SHA1 44c5ec89c86f7089106f29c3f5e0faab84c323da
SHA512 0191d71b41b19db5308a41485644549577668b4ef7d0ae00e35a94949d2aba421fac9cb71a4492e276dff52be6a406108310a431b2b57f4607b050bc0b2a3255
SSDEEP 768:g131qEcZ0rfZWMYo8SJYo4XBw4Ot5AEl94BHYjHwVoUV:g131MXBVa5AEncHYjQ+UV
TLSH
T122F2A078DC759D238CFBE2C5B7073641AEF595A3E8905DC4F8E85A0E098729E170B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 2c15aeb89af75919fe634bbfca06a61bb94b7052f0833a71fd9845952f2e73da
MD5 b8b2d1a841cb509ad15b0de8d8e4382e
SHA1 ed76e8f7c8e998e5f5b7349c608e05e615b23949
SHA512 68b5b3f92f7edf4d803fb8da2f7f84bc8cc02b17ddd927bae3007a590001a717fce2bf485f30c1671d19e6ec34393c2ed3f3232d04c4c8324db7f82482fed594
SSDEEP 768:MFQH3twg+zQ0bcWMYo8SJYo45Bw4Ot5AEl94BHYjHwVoUV:/H3Cz5BVa5AEncHYjQ+UV
TLSH
T18B1317F998E38937D8EE9783A73D2E419DBDD163B4845984BBD45D0DCC861BFC20A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

e22e6c3d-81c6-45bd-b40d-82a685bd935c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e22e6c3d-81c6-45bd-b40d-82a685bd935c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fab117c6-94bb-4ad5-ab78-88dbd4dc2448.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fab117c6-94bb-4ad5-ab78-88dbd4dc2448.tmp
Size 38KB
SHA256 f636008a96cb494ecf8574349d7eaa23322e6e7f0c334bf1d148892b8668fd93
MD5 36fc2df5202bdc8fcb34b750075e4736
SHA1 b4d8644477052a08b684eebdabbc15a91c29f698
SHA512 e7f193220abe423b1ff7f6a75c0669e6e919dd644ca9a38cc34f543b0566cb02a2ec2586e213850aae3755f9a2bc5d9e5e248f8cf16a2c275b9c8ec2a3e91720
SSDEEP 768:z/UxvxjgC+b3rKcZ0rfZWMYo8SJYo4KBw4Ot5AEl94BHYjewAFTN/:GZj3+b3BKBVa5AEncHYjPAFB/
TLSH
T18E03C038DCA59C238CFAA6C5771B3387AEF154A3A5C15DD4DDE82D1E0A8738E174B806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4664_1865746027\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 7c59db18bb41a839e3dc9d5498b5ae19a1ab26a40935ab89965470dd27b1595f
MD5 d990abf26defbe1ca9ec7f603ab647fd
SHA1 533b0177243f3dc82ec5c7acd5ab6e199efcf8eb
SHA512 3612f69f99623cd14a54138dd75a94b5ad21f8a6e7809c7e2405be5212df930877137ce91087867a78588f352cf28b61af0148b5460df213810c4c09eac7948a
TLSH
T1CB71008357B9C9B2C2DE5FF402835648F5BB22384B2330350B515586AB30A7A58B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/400-261-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1064-273-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1324-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1500-438-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2180-236-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2380-443-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2528-485-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3292-403-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3296-464-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3376-356-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3500-383-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4160-407-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4296-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4436-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5124-427-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5308-61-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5308-221-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5620-468-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5772-286-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5824-363-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5836-188-0x0000000000010000-0x00000000000AB000-memory.dmp

Download