systex | 196434efc06b9291c9a0d6b4e5cb022c4f9ade489d5018a251f0fe57226d2269

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 08:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260930-j2nfna1dkd
SHA256 196434efc06b9291c9a0d6b4e5cb022c4f9ade489d5018a251f0fe57226d2269
MD5 bc7c8f891a7f59f9ba4ea3976f3e0021
SHA1 79f374479d75f039a23d07393f3c6233d6508f4c
SHA512 652b12ef9f0a324b8459fd2349cd47bdda64c2ea9d37c3d6af606384f4de5be212771cc0ed540fea10b6eaa2ffa085299a63319ad1bb8d32f6ab99c58f284588
SSDEEP 6144:NflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:NflfAsiVGjSGecvX
TLSH
T12A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1660	hbztrljdbwtolgdb.exe
2860	hbztrljdbwtolgdb.sys
1884	CreateProcess.exe
4804	eywqomgeyw.exe
3376	CreateProcess.exe
3448	CreateProcess.exe
2356	i_eywqomgeyw.exe
2860	toljdbvtrl.sys
2288	CreateProcess.exe
5572	lgdytqljdy.exe
4832	CreateProcess.exe
4680	CreateProcess.exe
1276	i_lgdytqljdy.exe
3948	ytqljdbvtn.sys
3348	CreateProcess.exe
5024	tqlidbvtql.exe
4492	CreateProcess.exe
3980	CreateProcess.exe
5032	i_tqlidbvtql.exe
832	gaysqkicav.sys
1328	CreateProcess.exe
1292	faysqkidav.exe
2140	CreateProcess.exe
4900	CreateProcess.exe
1140	i_faysqkidav.exe
2760	ausqkhfdav.sys
5556	CreateProcess.exe
2092	xsqkicausm.exe
4828	CreateProcess.exe
1360	CreateProcess.exe
120	i_xsqkicausm.exe
4272	nhfcxvpnhf.sys
1668	CreateProcess.exe
1764	ecausmkfcx.exe
2860	CreateProcess.exe
3136	CreateProcess.exe
2148	i_ecausmkfcx.exe
1340	khczxupmke.sys
5048	CreateProcess.exe
4392	kecaurpjhc.exe
3340	CreateProcess.exe
2956	CreateProcess.exe
1896	i_kecaurpjhc.exe
4684	omhezwuomh.sys
3784	CreateProcess.exe
5112	rpjhbztrmj.exe
1928	CreateProcess.exe
1384	CreateProcess.exe
1276	i_rpjhbztrmj.exe
2828	omgeywtrmj.sys
832	CreateProcess.exe
5032	jgbztrljeb.exe
5584	CreateProcess.exe
4560	CreateProcess.exe
5844	i_jgbztrljeb.exe
5272	jhbytrljdb.sys
3196	CreateProcess.exe
2028	wtolgeywqo.exe
1348	CreateProcess.exe
2972	CreateProcess.exe
1428	i_wtolgeywqo.exe
5372	dbvtnlgdyv.sys
5476	CreateProcess.exe
4700	dbvtnljgdy.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_481103565\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_70461886\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_1457165815\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_481103565\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_481103565\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_481103565\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_1870988697\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_70461886\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_1457165815\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtqljgbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqlidbvtql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkifaxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtqljgbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdytqljdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnljgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojhbzwroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbytqomgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdytqljdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecausmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xsqkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecausmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecaurpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkfzxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxuomhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xsqkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecaurpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnljgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkidavqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxuomhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqlidbvtql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkifaxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojhbzwroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbytqomgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbztrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkidavqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrljdbwtolgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbztrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkfzxu.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4360	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3048	ipconfig.exe
5844	ipconfig.exe
4460	ipconfig.exe
1564	ipconfig.exe
5272	ipconfig.exe
3180	ipconfig.exe
1000	ipconfig.exe
2020	ipconfig.exe
6116	ipconfig.exe
2788	ipconfig.exe
5932	ipconfig.exe
5836	ipconfig.exe
4932	ipconfig.exe
4948	ipconfig.exe
204	ipconfig.exe
5172	ipconfig.exe
2800	ipconfig.exe
108	ipconfig.exe
4352	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{7F3C284C-3A64-46D4-9A78-644A78601F54}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1660	hbztrljdbwtolgdb.exe
1660	hbztrljdbwtolgdb.exe
1660	hbztrljdbwtolgdb.exe
1660	hbztrljdbwtolgdb.exe
1660	hbztrljdbwtolgdb.exe
1660	hbztrljdbwtolgdb.exe
1660	hbztrljdbwtolgdb.exe
1660	hbztrljdbwtolgdb.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2356	i_eywqomgeyw.exe
Token: SeDebugPrivilege	1276	i_lgdytqljdy.exe
Token: SeDebugPrivilege	5032	i_tqlidbvtql.exe
Token: SeDebugPrivilege	1140	i_faysqkidav.exe
Token: SeDebugPrivilege	120	i_xsqkicausm.exe
Token: SeDebugPrivilege	2148	i_ecausmkfcx.exe
Token: SeDebugPrivilege	1896	i_kecaurpjhc.exe
Token: SeDebugPrivilege	1276	i_rpjhbztrmj.exe
Token: SeDebugPrivilege	5844	i_jgbztrljeb.exe
Token: SeDebugPrivilege	1428	i_wtolgeywqo.exe
Token: SeDebugPrivilege	624	i_dbvtnljgdy.exe
Token: SeDebugPrivilege	2156	i_ysqkidavqn.exe
Token: SeDebugPrivilege	5836	i_snkifaxvpn.exe
Token: SeDebugPrivilege	6068	i_xusmkecxup.exe
Token: SeDebugPrivilege	952	i_causmkfzxu.exe
Token: SeDebugPrivilege	5820	i_zxuomhecwu.exe
Token: SeDebugPrivilege	240	i_rojhbzwroj.exe
Token: SeDebugPrivilege	5844	i_dbytqomgdb.exe
Token: SeDebugPrivilege	5408	i_bvtqljgbyt.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3700	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5320 wrote to memory of 1660	5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 5320 wrote to memory of 828	5320	2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 828 wrote to memory of 3700	828	iexplore.exe	91
PID 3700 wrote to memory of 5900	3700	msedge.exe	92
PID 3700 wrote to memory of 576	3700	msedge.exe	94
PID 3700 wrote to memory of 4360	3700	msedge.exe	95
PID 3700 wrote to memory of 576	3700	msedge.exe	94
PID 3700 wrote to memory of 576	3700	msedge.exe	94
PID 3700 wrote to memory of 4524	3700	msedge.exe	96
PID 3700 wrote to memory of 4524	3700	msedge.exe	96
PID 3700 wrote to memory of 984	3700	msedge.exe	97
PID 3700 wrote to memory of 984	3700	msedge.exe	97
PID 3700 wrote to memory of 984	3700	msedge.exe	97
PID 3700 wrote to memory of 5124	3700	msedge.exe	98
PID 3700 wrote to memory of 5124	3700	msedge.exe	98
PID 3700 wrote to memory of 5124	3700	msedge.exe	98
PID 3700 wrote to memory of 5924	3700	msedge.exe	99
PID 3700 wrote to memory of 5924	3700	msedge.exe	99
PID 3700 wrote to memory of 5924	3700	msedge.exe	99
PID 3700 wrote to memory of 5476	3700	msedge.exe	100
PID 3700 wrote to memory of 5476	3700	msedge.exe	100
PID 3700 wrote to memory of 5476	3700	msedge.exe	100
PID 3700 wrote to memory of 2992	3700	msedge.exe	101
PID 3700 wrote to memory of 2992	3700	msedge.exe	101
PID 3700 wrote to memory of 1556	3700	msedge.exe	105
PID 3700 wrote to memory of 1728	3700	msedge.exe	106
PID 3700 wrote to memory of 1556	3700	msedge.exe	105
PID 3700 wrote to memory of 1728	3700	msedge.exe	106
PID 1660 wrote to memory of 1884	1660	hbztrljdbwtolgdb.exe	108
PID 3700 wrote to memory of 4684	3700	msedge.exe	109
PID 4804 wrote to memory of 3376	4804	eywqomgeyw.exe	112
PID 3700 wrote to memory of 3984	3700	msedge.exe	115
PID 3700 wrote to memory of 3984	3700	msedge.exe	115
PID 3700 wrote to memory of 4176	3700	msedge.exe	118
PID 3700 wrote to memory of 4176	3700	msedge.exe	118
PID 1660 wrote to memory of 3448	1660	hbztrljdbwtolgdb.exe	119
PID 1660 wrote to memory of 2288	1660	hbztrljdbwtolgdb.exe	123
PID 5572 wrote to memory of 4832	5572	lgdytqljdy.exe	125
PID 1660 wrote to memory of 4680	1660	hbztrljdbwtolgdb.exe	128
PID 1660 wrote to memory of 3348	1660	hbztrljdbwtolgdb.exe	132
PID 5024 wrote to memory of 4492	5024	tqlidbvtql.exe	134
PID 1660 wrote to memory of 3980	1660	hbztrljdbwtolgdb.exe	137
PID 1660 wrote to memory of 1328	1660	hbztrljdbwtolgdb.exe	142
PID 1292 wrote to memory of 2140	1292	faysqkidav.exe	144
PID 1660 wrote to memory of 4900	1660	hbztrljdbwtolgdb.exe	147
PID 3700 wrote to memory of 4740	3700	msedge.exe	149
PID 3700 wrote to memory of 1896	3700	msedge.exe	150
PID 3700 wrote to memory of 3748	3700	msedge.exe	151
PID 1660 wrote to memory of 5556	1660	hbztrljdbwtolgdb.exe	154
PID 2092 wrote to memory of 4828	2092	xsqkicausm.exe	156
PID 1660 wrote to memory of 1360	1660	hbztrljdbwtolgdb.exe	159
PID 1660 wrote to memory of 1668	1660	hbztrljdbwtolgdb.exe	163
PID 1764 wrote to memory of 2860	1764	ecausmkfcx.exe	165
PID 1660 wrote to memory of 3136	1660	hbztrljdbwtolgdb.exe	168
PID 1660 wrote to memory of 5048	1660	hbztrljdbwtolgdb.exe	172
PID 4392 wrote to memory of 3340	4392	kecaurpjhc.exe	174
PID 1660 wrote to memory of 2956	1660	hbztrljdbwtolgdb.exe	177
PID 1660 wrote to memory of 3784	1660	hbztrljdbwtolgdb.exe	181
PID 5112 wrote to memory of 1928	5112	rpjhbztrmj.exe	183
PID 1660 wrote to memory of 1384	1660	hbztrljdbwtolgdb.exe	186
PID 3700 wrote to memory of 404	3700	msedge.exe	188
PID 3700 wrote to memory of 404	3700	msedge.exe	188
PID 1660 wrote to memory of 832	1660	hbztrljdbwtolgdb.exe	194
PID 5032 wrote to memory of 5584	5032	jgbztrljeb.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_bc7c8f891a7f59f9ba4ea3976f3e0021_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5320
- C:\Temp\hbztrljdbwtolgdb.exe
  C:\Temp\hbztrljdbwtolgdb.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywqomgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1884
  - - C:\Temp\eywqomgeyw.exe
      C:\Temp\eywqomgeyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4804
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3376
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywqomgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3448
  - - C:\Temp\i_eywqomgeyw.exe
      C:\Temp\i_eywqomgeyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdytqljdy.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2288
  - - C:\Temp\lgdytqljdy.exe
      C:\Temp\lgdytqljdy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5572
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4832
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgdytqljdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4680
  - - C:\Temp\i_lgdytqljdy.exe
      C:\Temp\i_lgdytqljdy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqlidbvtql.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3348
  - - C:\Temp\tqlidbvtql.exe
      C:\Temp\tqlidbvtql.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5024
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4492
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqlidbvtql.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3980
  - - C:\Temp\i_tqlidbvtql.exe
      C:\Temp\i_tqlidbvtql.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faysqkidav.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1328
  - - C:\Temp\faysqkidav.exe
      C:\Temp\faysqkidav.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1292
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2140
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faysqkidav.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4900
  - - C:\Temp\i_faysqkidav.exe
      C:\Temp\i_faysqkidav.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xsqkicausm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5556
  - - C:\Temp\xsqkicausm.exe
      C:\Temp\xsqkicausm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2092
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4828
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xsqkicausm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1360
  - - C:\Temp\i_xsqkicausm.exe
      C:\Temp\i_xsqkicausm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecausmkfcx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1668
  - - C:\Temp\ecausmkfcx.exe
      C:\Temp\ecausmkfcx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1764
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecausmkfcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3136
  - - C:\Temp\i_ecausmkfcx.exe
      C:\Temp\i_ecausmkfcx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kecaurpjhc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5048
  - - C:\Temp\kecaurpjhc.exe
      C:\Temp\kecaurpjhc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4392
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3340
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kecaurpjhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2956
  - - C:\Temp\i_kecaurpjhc.exe
      C:\Temp\i_kecaurpjhc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhbztrmj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3784
  - - C:\Temp\rpjhbztrmj.exe
      C:\Temp\rpjhbztrmj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5112
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1928
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhbztrmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1384
  - - C:\Temp\i_rpjhbztrmj.exe
      C:\Temp\i_rpjhbztrmj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgbztrljeb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:832
  - - C:\Temp\jgbztrljeb.exe
      C:\Temp\jgbztrljeb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5032
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5584
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgbztrljeb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4560
  - - C:\Temp\i_jgbztrljeb.exe
      C:\Temp\i_jgbztrljeb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtolgeywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3196
  - - C:\Temp\wtolgeywqo.exe
      C:\Temp\wtolgeywqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2028
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1348
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtolgeywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2972
  - - C:\Temp\i_wtolgeywqo.exe
      C:\Temp\i_wtolgeywqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtnljgdy.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5476
  - - C:\Temp\dbvtnljgdy.exe
      C:\Temp\dbvtnljgdy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4700
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2696
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtnljgdy.exe ups_ins
    3⤵
    PID:5840
  - - C:\Temp\i_dbvtnljgdy.exe
      C:\Temp\i_dbvtnljgdy.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqkidavqn.exe ups_run
    3⤵
    PID:4620
  - - C:\Temp\ysqkidavqn.exe
      C:\Temp\ysqkidavqn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4376
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5400
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqkidavqn.exe ups_ins
    3⤵
    PID:4740
  - - C:\Temp\i_ysqkidavqn.exe
      C:\Temp\i_ysqkidavqn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snkifaxvpn.exe ups_run
    3⤵
    PID:1404
  - - C:\Temp\snkifaxvpn.exe
      C:\Temp\snkifaxvpn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2732
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snkifaxvpn.exe ups_ins
    3⤵
    PID:3220
  - - C:\Temp\i_snkifaxvpn.exe
      C:\Temp\i_snkifaxvpn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xusmkecxup.exe ups_run
    3⤵
    PID:4736
  - - C:\Temp\xusmkecxup.exe
      C:\Temp\xusmkecxup.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5392
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4484
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xusmkecxup.exe ups_ins
    3⤵
    PID:4432
  - - C:\Temp\i_xusmkecxup.exe
      C:\Temp\i_xusmkecxup.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causmkfzxu.exe ups_run
    3⤵
    PID:4316
  - - C:\Temp\causmkfzxu.exe
      C:\Temp\causmkfzxu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1356
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4424
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causmkfzxu.exe ups_ins
    3⤵
    PID:4244
  - - C:\Temp\i_causmkfzxu.exe
      C:\Temp\i_causmkfzxu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxuomhecwu.exe ups_run
    3⤵
    PID:4000
  - - C:\Temp\zxuomhecwu.exe
      C:\Temp\zxuomhecwu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2924
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxuomhecwu.exe ups_ins
    3⤵
    PID:6036
  - - C:\Temp\i_zxuomhecwu.exe
      C:\Temp\i_zxuomhecwu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rojhbzwroj.exe ups_run
    3⤵
    PID:2016
  - - C:\Temp\rojhbzwroj.exe
      C:\Temp\rojhbzwroj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2624
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rojhbzwroj.exe ups_ins
    3⤵
    PID:3204
  - - C:\Temp\i_rojhbzwroj.exe
      C:\Temp\i_rojhbzwroj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbytqomgdb.exe ups_run
    3⤵
    PID:3320
  - - C:\Temp\dbytqomgdb.exe
      C:\Temp\dbytqomgdb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3208
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbytqomgdb.exe ups_ins
    3⤵
    PID:3216
  - - C:\Temp\i_dbytqomgdb.exe
      C:\Temp\i_dbytqomgdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtqljgbyt.exe ups_run
    3⤵
    PID:1188
  - - C:\Temp\bvtqljgbyt.exe
      C:\Temp\bvtqljgbyt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1060
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:108
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtqljgbyt.exe ups_ins
    3⤵
    PID:1964
  - - C:\Temp\i_bvtqljgbyt.exe
      C:\Temp\i_bvtqljgbyt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5408
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd10d5c188,0x7ffd10d5c194,0x7ffd10d5c1a0
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1956,i,17832435169516977338,9155380161485117431,262144 --field-trial-handle=2620,i,11730836703778206569,6017794387299792159,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:2
      4⤵
      PID:576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2112,i,1420247742815335648,2160225792067870995,524288 --field-trial-handle=2620,i,11730836703778206569,6017794387299792159,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:11
      4⤵
      System Time Discovery
      PID:4360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2672,i,6631515977119147452,12931412136808771834,524288 --field-trial-handle=2620,i,11730836703778206569,6017794387299792159,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:13
      4⤵
      PID:4524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,3717680481395721087,15701990305639740591,2097152 --field-trial-handle=2620,i,11730836703778206569,6017794387299792159,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,13082921181687380863,4279630733041657840,2097152 --field-trial-handle=2620,i,11730836703778206569,6017794387299792159,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:5124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,1307782008632110868,13255532460184853340,2097152 --field-trial-handle=2620,i,11730836703778206569,6017794387299792159,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
      4⤵
      PID:5924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,6466927454967731892,12583183852545113506,2097152 --field-trial-handle=2620,i,11730836703778206569,6017794387299792159,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:9
      4⤵
      PID:5476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,12144014916941707364,5194556379489541830,524288 --field-trial-handle=2620,i,11730836703778206569,6017794387299792159,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
      4⤵
      PID:2992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,15869658001786584167,6459967973849614597,524288 --field-trial-handle=2620,i,11730836703778206569,6017794387299792159,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,989516182821511210,2913706281911528647,524288 --field-trial-handle=2620,i,11730836703778206569,6017794387299792159,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
      4⤵
      PID:1728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,6793070002784602490,10778395330483250457,524288 --field-trial-handle=2620,i,11730836703778206569,6017794387299792159,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,6793070002784602490,10778395330483250457,524288 --field-trial-handle=2620,i,11730836703778206569,6017794387299792159,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
      4⤵
      PID:4684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,5403109293054515495,17493287779364607897,524288 --field-trial-handle=2620,i,11730836703778206569,6017794387299792159,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
      4⤵
      PID:3984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,6565643144521838413,8577407360222028344,524288 --field-trial-handle=2620,i,11730836703778206569,6017794387299792159,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
      4⤵
      PID:4176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1432,i,5517370757770201115,6555097283442349260,524288 --field-trial-handle=2620,i,11730836703778206569,6017794387299792159,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:14
      4⤵
      PID:4740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1440,i,7804192473577464203,834119017022587307,524288 --field-trial-handle=2620,i,11730836703778206569,6017794387299792159,262144 --variations-seed-version --mojo-platform-channel-handle=1408 /prefetch:14
      4⤵
      PID:1896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1448,i,16346965782867799422,9448415546486323224,524288 --field-trial-handle=2620,i,11730836703778206569,6017794387299792159,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
      4⤵
      PID:3748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,12656785671431250154,4332409351698729712,524288 --field-trial-handle=2620,i,11730836703778206569,6017794387299792159,262144 --variations-seed-version --mojo-platform-channel-handle=1296 /prefetch:14
      4⤵
      PID:404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,1505435145121334471,16078241525690204494,524288 --field-trial-handle=2620,i,11730836703778206569,6017794387299792159,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
      4⤵
      PID:4116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,4547276789808762403,16345668002046266413,524288 --field-trial-handle=2620,i,11730836703778206569,6017794387299792159,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
      4⤵
      PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,10906928362203846123,7731878991652696200,524288 --field-trial-handle=2620,i,11730836703778206569,6017794387299792159,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:14
      4⤵
      PID:4180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5552,i,12308563061222650340,15533566954696759979,262144 --field-trial-handle=2620,i,11730836703778206569,6017794387299792159,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:10
      4⤵
      PID:5696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,6774475200900578758,697505241910158118,524288 --field-trial-handle=2620,i,11730836703778206569,6017794387299792159,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:14
      4⤵
      PID:952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2772

C:\Temp\hbztrljdbwtolgdb.sys
C:\Temp\hbztrljdbwtolgdb.sys
1⤵
- Executes dropped EXE
PID:2860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4180

C:\Temp\toljdbvtrl.sys
C:\Temp\toljdbvtrl.sys
1⤵
- Executes dropped EXE
PID:2860

C:\Temp\ytqljdbvtn.sys
C:\Temp\ytqljdbvtn.sys
1⤵
- Executes dropped EXE
PID:3948

C:\Temp\gaysqkicav.sys
C:\Temp\gaysqkicav.sys
1⤵
- Executes dropped EXE
PID:832

C:\Temp\ausqkhfdav.sys
C:\Temp\ausqkhfdav.sys
1⤵
- Executes dropped EXE
PID:2760

C:\Temp\nhfcxvpnhf.sys
C:\Temp\nhfcxvpnhf.sys
1⤵
- Executes dropped EXE
PID:4272

C:\Temp\khczxupmke.sys
C:\Temp\khczxupmke.sys
1⤵
- Executes dropped EXE
PID:1340

C:\Temp\omhezwuomh.sys
C:\Temp\omhezwuomh.sys
1⤵
- Executes dropped EXE
PID:4684

C:\Temp\omgeywtrmj.sys
C:\Temp\omgeywtrmj.sys
1⤵
- Executes dropped EXE
PID:2828

C:\Temp\jhbytrljdb.sys
C:\Temp\jhbytrljdb.sys
1⤵
- Executes dropped EXE
PID:5272

C:\Temp\dbvtnlgdyv.sys
C:\Temp\dbvtnlgdyv.sys
1⤵
- Executes dropped EXE
PID:5372

C:\Temp\davtnlfdxv.sys
C:\Temp\davtnlfdxv.sys
1⤵
PID:3452

C:\Temp\xvpnifdxvp.sys
C:\Temp\xvpnifdxvp.sys
1⤵
PID:5932

C:\Temp\cavsmkifdx.sys
C:\Temp\cavsmkifdx.sys
1⤵
PID:3420

C:\Temp\fzxrpkhcau.sys
C:\Temp\fzxrpkhcau.sys
1⤵
PID:4688

C:\Temp\zusmjhezxu.sys
C:\Temp\zusmjhezxu.sys
1⤵
PID:2776

C:\Temp\wrojgecwuo.sys
C:\Temp\wrojgecwuo.sys
1⤵
PID:2828

C:\Temp\mgebwtrojh.sys
C:\Temp\mgebwtrojh.sys
1⤵
PID:4224

C:\Temp\jdbvtroigb.sys
C:\Temp\jdbvtroigb.sys
1⤵
PID:3332

C:\Temp\sqoigdyvtn.sys
C:\Temp\sqoigdyvtn.sys
1⤵
PID:1276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ausqkhfdav.sys

Path C:\Temp\ausqkhfdav.sys
Size 293KB
SHA256 66a1266709b5e5d9cff831e18a033efdb7c99eae93b732f1361a8da2894933a3
MD5 4d99776ed1c524e6c1e15699cf636b08
SHA1 18c34ed3e601bcb1a4db0f2cf04da493d029a812
SHA512 dd2a4538e9843833cc9d85a6b302c1311af25dfb4965f685bed9eacf8efe8b46df16bc51e20a8ad14e4a846db723ab81ec24d4352ba8fb1cef5e96d759500476
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecausmkfcx.exe

Path C:\Temp\ecausmkfcx.exe
Size 361KB
SHA256 22e590fc0d146816be4e06db8d0afb8b3f724d7aebafaf563e04026b2c506129
MD5 f254a783245b1d03237b36e3dde69890
SHA1 05359256641000b292259c53c5d3a4f6eb21643c
SHA512 7bdd43d312f3e8f79ec8521d888c2d27ce42fae6e4be06a843bbaa4ed570c745f59675fbeb6ada871222b65a42a38e180a0196a1eaf974a686ae01a7c13d068d
SSDEEP 6144:fflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:fflfAsiVGjSGecvX
TLSH
T156747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywqomgeyw.exe

Path C:\Temp\eywqomgeyw.exe
Size 361KB
SHA256 6b4c6b5440c547d50ecc93b9c83a287e8ccc761a4796c5dee0c492d02d3eba68
MD5 5c0b1430719783879e1a51c811d933c3
SHA1 72d7a7a8de41f1dc5ab96688bc96908ee06e633a
SHA512 2a9e5f7afb5594db2eb0896add68504c9b727c30ebbdb9c38619009007f9d14d680d0f566767968f95b34aa89bbfa2922e539fe8b7d4fa45641567c846e7bc8b
SSDEEP 6144:DflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:DflfAsiVGjSGecvX
TLSH
T1D2747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faysqkidav.exe

Path C:\Temp\faysqkidav.exe
Size 361KB
SHA256 03257de5e0c589ba7cac9db382f73017d11a8bfb89d3fea69b2f0397a938c8a7
MD5 723d69d8b72e09446ba3842d6cf7f3d2
SHA1 7e81464606cfa7af129659a3353195a6b942720f
SHA512 d2fcaf890067d257ae255034f8c5fa7cf7f1a44499c0b16592a932528771429653e080eea6aa85f076a47d0658f5aaff90eb30fff30a2b7fa60f2db388e24fb2
SSDEEP 6144:NflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:NflfAsiVGjSGecvX
TLSH
T143747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaysqkicav.sys

Path C:\Temp\gaysqkicav.sys
Size 293KB
SHA256 ef2dab39e214ba694089ce192faf1784dc4787227e0bf7a09fbc856dc30f6b89
MD5 60340f9069dda9a7bd23d1432a876110
SHA1 d9d7b34ed07c74833d8dbccc1eb8bad758c99e17
SHA512 4986b0beb76877afcc653d02eafbd84236908fcbdc77ac673f5e91a1a8d09097a660757a6c1ca177376266d7e73fe507449c397fa99f8ed49d033920c64db7bf
SSDEEP 3072:ktKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:kIJjiJcbI03GBc3ucY5DCSj
TLSH
T196545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbztrljdbwtolgdb.exe

Path C:\Temp\hbztrljdbwtolgdb.exe
Size 361KB
SHA256 6c7e847103b385b0f4dd58b31b0601d68b1672c94acfa125c2c7c1cb9dd7768d
MD5 b081e072296d355ca5b27cabe3fa7688
SHA1 125543d3cb5678ef05469dc4ec507453a76776d3
SHA512 12f17117f3cd171af345b86f80182da21a9f92aa53ba0a1873f58a2a333cd65b201e3203a472970868d4966895a6ae37ee9fb86afcb5386f31f52926a20ac6e4
SSDEEP 6144:xflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:xflfAsiVGjSGecvX
TLSH
T137747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbztrljdbwtolgdb.sys

Path C:\Temp\hbztrljdbwtolgdb.sys
Size 293KB
SHA256 47e0324aa66cfcc6d4da5ac04c0aae3cfc6fbb03c92f14d3eee289aaaf86c32a
MD5 77c7ef396b252cfa298dce6ef443e44f
SHA1 73fc2fd7d5fde5ec690f174e05dc25d3064609ec
SHA512 cc8370e44fa4af1b02db3c24458f9b73fff5819f1a43cf7be59f548d98aac24bf39f7556b3caf594310b19afada66ad04e19b3b6f3ec3a9f38a18b40bf689bd7
SSDEEP 3072:VtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:VIJjiJcbI03GBc3ucY5DCSj
TLSH
T145545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eywqomgeyw.exe

Path C:\Temp\i_eywqomgeyw.exe
Size 361KB
SHA256 326d671dfc651a6c6328ffe0ff9fc1c5cad5153eae291e4069c60fa405508aba
MD5 0d93f1641ec1095f94b5cec442534931
SHA1 57990453eba233949b555829ee8d3def568a5eca
SHA512 8593eb19f29af59cb5a8654a5ef4ac5be7a1127fee878a7fddfbb9adecb6751e0ebe111926376609acd2d20010b4e7932db134b10184648271e5b6d427c4b277
SSDEEP 6144:aflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:aflfAsiVGjSGecvX
TLSH
T161747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_faysqkidav.exe

Path C:\Temp\i_faysqkidav.exe
Size 361KB
SHA256 bdf23ca10817667079970f8d50c593b81aa39d519142dc57764bf25ce799d011
MD5 aed4a80863f3904ecc382d17215c37ee
SHA1 38cea54dc08adcc36f4f2057c899f6752d498e08
SHA512 d71db7ba9adf2bfb8f8bcb0059624dd0d3fbc34dd1126ae44f824da4394d9f9789befe8124583383a0263599a534877009bd97f29d1e265921172b7c2f084d1e
SSDEEP 6144:SflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:SflfAsiVGjSGecvX
TLSH
T10D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgdytqljdy.exe

Path C:\Temp\i_lgdytqljdy.exe
Size 361KB
SHA256 46730fa53a017f021bee4bd30b8cd1903e536d936f7322be1bde60672960bb8e
MD5 d1992a12cf98fe85693509a147d9ef9f
SHA1 275d48204d70eb946487ce63d46bb7fac8166a30
SHA512 33b65a6bd9d590d8da55a1248fc740118271d05f8cf86d4d25329384c784d99defe2ca89f76c4034ffaae8d9089646a9f4e86f2d35939c905ab238d8d5355bba
SSDEEP 6144:rflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:rflfAsiVGjSGecvX
TLSH
T1AF747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tqlidbvtql.exe

Path C:\Temp\i_tqlidbvtql.exe
Size 361KB
SHA256 b28bb68a2db8078843dda608d8592062da3f0ae2309a1dcb1e4506a5134a8762
MD5 1a98006257c72539e164311b0b081985
SHA1 f03e97d422e3c5f422ef88096cf03f0b7f09563e
SHA512 b2b28ffc9f94760388c04a19ddf501db30c5654b58579ec63356dc9cbcca56655caf383b12b281d46d14867320b088eb9bc7491f8fa28e89e01478bc8dc0e84e
SSDEEP 6144:BflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:BflfAsiVGjSGecvX
TLSH
T1C2747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xsqkicausm.exe

Path C:\Temp\i_xsqkicausm.exe
Size 361KB
SHA256 c55c2219e538bacc4b67cc68349ddcaf12a8b650e941cf03628608f1f2f29881
MD5 b97f2f10183cfe37d7cdb20633651f22
SHA1 779b1ef0bafd542d53bfaf74af5a7066ce6b5c75
SHA512 afa94260378e290d6357331df2253c139bf14d4aee0eb95cdaaf6cbc9276e84facc905c3b3bda449bac460cb80acf5feec117595d7011f9d811ec696870b4997
SSDEEP 6144:0flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:0flfAsiVGjSGecvX
TLSH
T1A7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdytqljdy.exe

Path C:\Temp\lgdytqljdy.exe
Size 361KB
SHA256 a6c0dab3d2983768728c98385da045886275b7df96a0ceed774bcc8055e308f4
MD5 b067254e37547c90861ac82c023df4d8
SHA1 ce4340862af73287011a17435a9ca9a8de3c0436
SHA512 db91f323df5007feb088a9d1ffe5d73650b670913bb5000864c1a4646e278faf6a4c4521967db55e82f4799a30b8d2d5547d62192938347e8489f05780ce80f1
SSDEEP 6144:1flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:1flfAsiVGjSGecvX
TLSH
T1D4747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfcxvpnhf.sys

Path C:\Temp\nhfcxvpnhf.sys
Size 293KB
SHA256 9999498b4ca6922c861136aed99c4a4d98186f929af868932321a620217647ac
MD5 c58f025d2709e9e90f6390415d8efec0
SHA1 6f4f776eabdacf80bf14f701a6279adbd27f5089
SHA512 0c5ce9e7707e8bda3cf195fd793e5aa9569dc37a8d0da39f7f30947900ebb53a7438a73dfd27bb675d80f35d2d0047e6a656d414834b0d6aa2232a70afd5ce7e
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T14B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

toljdbvtrl.sys

Path C:\Temp\toljdbvtrl.sys
Size 293KB
SHA256 a5058e5ad4addc51dece6c60c5ba8faff7d407d2b443c7533680866842a7213c
MD5 f2188c8dabae68f76ac088aa8e34c29c
SHA1 6316f72ba52c768688647dc16557194f9c7d79a9
SHA512 e197d33d27f09016be8fe5f99bfcb2e8e75f4d4ed0303951a5b9446805f0cf0c56ac306619f28af1da6fbc8edea27283df9760f2e825a24f8f7f47126a326e0f
SSDEEP 3072:KtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:KIJjiJcbI03GBc3ucY5DCSj
TLSH
T121545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqlidbvtql.exe

Path C:\Temp\tqlidbvtql.exe
Size 361KB
SHA256 de9b678b3811380814a20f176ecae9456b3c0f3ec3a13be5cef1185bb729c4cb
MD5 b2111e545e46914215e9a4b06c695faa
SHA1 9246f4174ebaefc9456514f6216eb0f10d7d6937
SHA512 1eaf92d682e42667dd7616b088f200fd31b6e5d48cec81309b0c3af39661ae16a18f77e28d7bf658d28b908f24feff51cc723243dde78d3fc44e8b9d4af7dee0
SSDEEP 6144:pflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:pflfAsiVGjSGecvX
TLSH
T19A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xsqkicausm.exe

Path C:\Temp\xsqkicausm.exe
Size 361KB
SHA256 0d76f8258525dfdd38f14a9c76ba04e2b4ce921ce32f8472d88ad8c32cffb752
MD5 ce460156647cf654b75d84dc09764b73
SHA1 7be31bef40f41e91ffb6c6d5f49bfbeaf52578a3
SHA512 c5691d010a157dd7f96b9d45c59391f9611884f1682c3748dae375d9a478ea3124e434b15bfd76df7f8141c1d0f56a52825037247d67d44bebc2a1bdc8901c0f
SSDEEP 6144:6flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:6flfAsiVGjSGecvX
TLSH
T13F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqljdbvtn.sys

Path C:\Temp\ytqljdbvtn.sys
Size 293KB
SHA256 eb210e7a3a6b9bfc979a246c5e63fde7250aade75d966960eb2b8a5bdfcf76a7
MD5 a5a14a3726e4dcaf3c5f1f61a8a9c4cc
SHA1 9f0521d2bf241bb4fab822c778a4525c4b00b8b4
SHA512 c801c4b9aa47afbdc2c3b853bcfd732f7d262e599201f74a1144ea79b677a3618e7e1aaa09191c198ed57a5e1b105c6007f791ea1929b4a4f39f0826062d0906
SSDEEP 3072:RtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:RIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b0e7a2b-a070-459f-b9fd-b2bdbda5abab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6b0e7a2b-a070-459f-b9fd-b2bdbda5abab.tmp
Size 34KB
SHA256 e9aa2bc6e305216c1cbf1e437f81231716745749d1fa12da37e1acd52b2e5cba
MD5 6f90d93dc0f88bbf32162f7516fe1ed8
SHA1 d905785950ef5e08596125633365a1ea3c322fa4
SHA512 aea0ef77542872c94329cf229350c7d05af3c5ac62139a67ffa6763126f3935446bdf10da1a6889be7225c1bc746ea00ffb4875594f6139d45ca16e5e6d2b047
SSDEEP 768:MI3+lwOC1rqRe5fgGM1TnXMqOa3O4YGHtC:MI3ZUsfgt1TnxOCO4YUtC
TLSH
T195F2BF71A9659CB35CF6E285F21AB2927EF140A3C5890E98D5EDAF0E008764F171BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6a4f25194d7df920f023b94035789770d82b866f099f5b5c173cc54b917115
MD5 3f1c1794ec8ced524804973bbce2d4ac
SHA1 6590c89953e8a722e5a484b9a6cf54a706728368
SHA512 4d64e702748a9bdaaf0d9e615e1a53c00d60b36678bc7c8cbf081669c63c3b8c23886cf0b3633e50e54853f273a2e585b73bb1a35f53ef1493bf40ac357ee359
TLSH
T1F1D02BF0B7ECD443C084507800F21574112571301518C2F02311E18805042810511315
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08b551008bdcc4de6c80e8d8ffe37c1b7477ababb9604ca97c52b81aed70fdae
MD5 4cd8e5e902146ba19eacbbf4f2e5586c
SHA1 94f807b68c16fd008173350beb37c8686810bcbd
SHA512 6381a86b9ddf9099cf403e36e8c774a996a2a9e547c95e0b2070ef6e2e5e94028cf8284c9fb284f5f80b523066ed68d34895e768192628c20598a4e881c034ca
TLSH
T1D5D02BF4B7DCD543C084507400F11574113571306918C2F02311E18805042810512329
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 578b6321be6cd6257b87cdd6d03d9b6ce0295bd551673ac9d9ee6f4a1d3eaeb8
MD5 8067b35686ad67b193c1f31af2fa38e4
SHA1 db7c899121a6b4222dc6a05c3314fb1191459559
SHA512 aad1cad7e6869cdf5a9b51d56493b73586db773dbcc14311c566b8249ff3817f421c0602e60d6849dd62c49a9826e28fd5e4ceb6d9cd34873f4ca926b7d31d14
TLSH
T13C513DC4824BCA66FBD8607498E6CCCFFAB47BE1A543EF2929B4CD355CA2366405507C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9f7932e9bb99973097f15003d31700d47591c117c7e0588c96ee5e7cd88ae3e3
MD5 2d4b26115932d499f679a441d79ff4da
SHA1 0b3a393fb37232a3550120ba8f479933fb5f3d35
SHA512 c36e6fddf26b35d06ec113eb8f7eaa44a2172fb0e442c453a830012372a7f3002565a72d8c885021e57bd6d70e59d143fcf43fcf69d24bede44476dab90092ad
TLSH
T194518EF3C3E8966D890196F0AA186E2BCE2D0914432C3D5AC9E4EF1B93E3471D141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a13fd3dfadb2e33d6666c5f46018f33aac6843ffc61f6ca91fcdc8a40fd01486
MD5 9a2c49284ebf0161bd4b3e3a0e4d694c
SHA1 668d55f08f9e0482ce3fb6a5e5a5af48d41332e7
SHA512 b1b72be331e8d18166849bfda032c400b30347eac417b97bfc84d8991af51b489c0b35b95c6edb92f4bbd5c38c091112c3ddcaa950af7d3a17f0ed24065e88d2
SSDEEP 192:sxR2RfCN/fYsPZZDA9VzoA8p96/g6+WNC/1/YRufcjHGAIgDooJ:sxR2gN/fYsP3DX8/5s/OFt
TLSH
T1A842D819AD68A9BB4CC7D31DBB157F53E6F91032A0D11E48AAFC8B1C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 80a84696fa4bdba13899510cc39cb343ee1cd2a55a541665e63bc4f3c86895ed
MD5 f2a2b21ed63e790bd38f7e64e7ee33ac
SHA1 f6861ac9f25a20369843699a3d9db8a12186d938
SHA512 b1b727000bf18849cfe0f10eb5968f1a90047840b5b24c2629f3c2388c51f9456237655f895294a40a3ab75ec0ccf8c1d007c99b4d92c2aef2b9ea80c9c7b570
SSDEEP 192:sxR2RfCN/fYsAZZDA9VzoA8p96/g6+WNC/1/YRuScjHGAIgDKoJ:sxR2gN/fYsA3DX8/5s/hFz
TLSH
T15D42D919AD68A9BB4CCBD31DBB157F53E6F9103260951F48AAFC8B1C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 28581d8ff20fabe7c741dceaa907ec10614a48368221e4612d3a0b436b10289d
MD5 6757fdf9ed3e48c3bdd1a1c3f1428331
SHA1 f90ce8c5c73189938a7f99d952dc325e6f704465
SHA512 cff94f4ea0b669a6de2973c9a6faf5043cf785e76aa738e969ce4ccd646cd06d2bf4d55637f95ab78e33a3978dafd417a08a3bf9819cb46f3bc70458d8189938
SSDEEP 192:sxRFRfCN/fYsdZZDA9VzoA8p96/g6+WNC/1/YRufcjHGAIgVoJ:sxRFgN/fYsd3DX8/5s/OFe
TLSH
T11842C819AD68A97B4CC7D31DBB157F53E6F91032A0D51E48AAFC8B1C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 5a6ea6ff5f31ab09015a0d12ecdc2738fa7971aa1b6a6b2a9480bf77591467f6
MD5 5dce3088bed8477e5d9d91bb1a24367d
SHA1 03ce87cba872be606a8663a0ff6f9bb4e789cdb6
SHA512 21d91e05fa624dc70a0715af546a380ce95aa5737a1cc0eb240674eb8b79cd5e45c938a536f1e74a432126ff1b1d6725db9f1e41f531ac9dc44300e8c84f74d5
SSDEEP 768:UEg+pC7pLuLb7uWgf/fXH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVr5+6tyAroqYAu:UEg+paEb7uWgf/fXHu1ja05+4yL7
TLSH
T1B9D2DA7B744CCB7E4FC00A9D9C1A7E9B6DA802CB9698CD8047FE855C02C67EA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 342fe0a927968ec9f5139dcc27f234f4690f55ae8870c0b67d61ddf2b5db2d81
MD5 4387b1b79dbfc84cbf9cf874c488ba5d
SHA1 519706502572c1d01a8dc70954ca3430426977de
SHA512 b4d5ebb760cf8a896486003fbdded595f45ca9e2ccc1ad8907294c74143caddfed13918295da405a33b8dae6264983195d4dfa5dd50abca2fbb52e79cf90ccbd
SSDEEP 48:KIZIpKyM87yt/IR+gKW1+QgKOwXFw/hIBKC0MzyE:KIZGKyMKW/mKKYth+KC0KX
TLSH
T126914261357F460139BD390895A8A7AE069271B33124FE2B3BF950728E2AE058DFC5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a4826.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a4826.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 7c57c5fff86a6563879594766dee0f286b229261bde9154c3a3472389a68c3a3
MD5 95c4c9219b439249af580631ea8b33b9
SHA1 72b0911d8e2e740e09bc7ddc7cc61fed5c7125bc
SHA512 519628c0d9c67b6fad1e9718f484a2336e0db368d4d832105b2e47392c4a89e2d467a92bc2e297660530d17251a642b50129049f2298ac624a0c940ea67795ff
SSDEEP 768:5/UxvxjgC+934BwOC1rRu5fgGM1TnXMqOerAaP8:sZj3+93/Rcfgt1TnxO0AG8
TLSH
T19B03B036AC956C779CF2D384B20EA296AEF140A3C5C51EA889EC3D0E05DB35D530BC53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 1e6c03c26af77fa72bfef5d47bc55a40a56b48fa4a0041efdd96108596f91b1c
MD5 ed94ec7d02d28ce7bf0b7b797216c8fd
SHA1 cb2556be0c959a58a51c2338805e9404ce3567c9
SHA512 cf5595827b527ce3378e4e5868e0c761978a34d3d95e4a6e23b3515c482461f875a26b720a44ed1b671cfb3d3410ee26509be94374c2682f38fb84055cecc09e
SSDEEP 768:k/UxvxjgC+d3WlwOC1rqRe5fgGM1TnXMqOa3O4YGH+K:RZj3+d3RUsfgt1TnxOCO4YU+K
TLSH
T1FB13BF36A8596C635CF7E245B21AA3D7AEF104A3C4C51EACD9ED6E0E058724E170BD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 d246dce91eb4c17627dd3779274aaf750d42fd1077eb9bc2e35e4e9d6a0900ea
MD5 d430bad5cec76d98919eb078bb5c0324
SHA1 00a5b6fc56c5b6b32c5a3b7e1b0fe1fe07d42eab
SHA512 5b968d4554609f0bb336923ce70c86035aa72457ff2ef459486586dd43ac72123dbcb60cc78a36041dddf908f668b306343e257d35c550221a2e0a6536fbf0e9
SSDEEP 768:8I3dlwOC1rqRe5fgGM1TnXMqOa3O4YGHtC:8I3KUsfgt1TnxOCO4YUtC
TLSH
T1C0F2BF71A9659CB35CF6E285F21AB2927EF140A3C5880E98D5EDAF0E008764F171FD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 48a0fdb2f10645e5f9b93b47fb1c7bd016377c125714ebfc4f0b8333c9d1be2e
MD5 82340f34a2d3a8fcb59429b5298c6ae6
SHA1 cffa402933ac66f8df7ac9101f1c58e6898839a4
SHA512 daf57bacb7c4ed51b01a3121cef5fe0fd2f35a7c925b2a079d64b9b5645e259cd87299013dbae09ba5c10923b428eaaaa349983cde2a74d892663c090ae4f1c1
SSDEEP 768:hFQb3HwgKvIOC1rqJ5fgGM1TnXMqOa3O4YGHtC:wb3rsfgt1TnxOCO4YUtC
TLSH
T1221328F698D78976D8AE9783A33D6E4259FCC063B4884994B7D85D0DCC821BFC70AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

bac16419-74cc-4a02-8c66-0057973dfd58.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bac16419-74cc-4a02-8c66-0057973dfd58.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3700_1524112394\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 f31f7bfbcfc3d31881eab827bf7cddc27ef00f2927f2dd643397dd7986283cc6
MD5 132983bcbf4efe37b7529755680a253c
SHA1 7623f5b41b410410e4dca7e71987ef5621a46aec
SHA512 84b990221e491168a1ae29083b1bc51280884b87a6ab519f3b6d4ae908d1e438be12f462fafca078f1a5baf3a518edd08afc9d898e2b877353f4cb46fa01a3de
TLSH
T1CB71008356B9D5B3C5DA9BF502835648F6BB22780B2370200BA55546AA30A7A14B8F48
MD5 SHA1 SHA512 TLSH

Submit Download

memory/832-259-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1276-485-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1340-309-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1340-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2760-271-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2776-438-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2828-329-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2828-355-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2828-459-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2860-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2860-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3332-468-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3420-407-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3452-383-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3948-234-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4224-464-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4272-284-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4684-313-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4688-427-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5272-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5372-363-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5932-403-0x0000000000010000-0x00000000000AB000-memory.dmp

Download