systex | 1d4a8bab440fe36b8ddb250afe0a2ff7f7910e8fc13511d1bbce79a84ed0e004

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260930-phtffstx5j
SHA256 1d4a8bab440fe36b8ddb250afe0a2ff7f7910e8fc13511d1bbce79a84ed0e004
MD5 38e64bc9a9c75f0d2fbe35648699b2f9
SHA1 8e8377e6021f36221bfdee58b6268a7a511368c4
SHA512 3a734c62c92294b986ed5b8d646103d0181253c40dee65b7684319bcb40793657c7fe835cfb9335e075f620fe02878dcb9f99312c6dc28c98a1b895dc2da9df0
SSDEEP 6144:BflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:BflfAsiVGjSGecvX
TLSH
T1BC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3308	tnlgdyvqoigaytqo.exe
4540	tnlgdyvqoigaytqo.sys
4384	CreateProcess.exe
5556	vtnlgdyvqo.exe
4448	CreateProcess.exe
796	CreateProcess.exe
4104	i_vtnlgdyvqo.exe
2528	davsnlidav.sys
4452	CreateProcess.exe
4272	xvpnifaysq.exe
1988	CreateProcess.exe
1832	CreateProcess.exe
5620	i_xvpnifaysq.exe
6032	fcxusnhfdx.sys
5144	CreateProcess.exe
1004	causnkfdxv.exe
4568	CreateProcess.exe
5408	CreateProcess.exe
1796	i_causnkfdxv.exe
2284	cxusmkhcau.sys
4104	CreateProcess.exe
3556	zxupmhfzxr.exe
6128	CreateProcess.exe
2064	CreateProcess.exe
1960	i_zxupmhfzxr.exe
3276	hczxrpmhfc.sys
3744	CreateProcess.exe
4968	frpmhbzurm.exe
2440	CreateProcess.exe
5224	CreateProcess.exe
6032	i_frpmhbzurm.exe
2712	ezwrpjhbzw.sys
6008	CreateProcess.exe
2236	ezwrojgezt.exe
5688	CreateProcess.exe
2900	CreateProcess.exe
4208	i_ezwrojgezt.exe
5596	wqoljhbztr.sys
3440	CreateProcess.exe
2436	wtrojgebzt.exe
2344	CreateProcess.exe
4192	CreateProcess.exe
2296	i_wtrojgebzt.exe
4988	mgeywqoiyt.sys
4144	CreateProcess.exe
4800	dbvtolgdyw.exe
4940	CreateProcess.exe
2784	CreateProcess.exe
2492	i_dbvtolgdyw.exe
2932	geyvqnliga.sys
4584	CreateProcess.exe
4844	jgaywqoigy.exe
3112	CreateProcess.exe
2988	CreateProcess.exe
5604	i_jgaywqoigy.exe
2336	vsqlidavtn.sys
4236	CreateProcess.exe
6096	qnlfdxvqni.exe
2976	CreateProcess.exe
4944	CreateProcess.exe
2168	i_qnlfdxvqni.exe
2896	nkfdxvsqki.sys
2800	CreateProcess.exe
2492	nhfaxspnif.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4588_2026577418\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4588_237831751\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4588_2026577418\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4588_2026577418\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4588_2026577418\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4588_1472269142\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4588_1659313935\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4588_1659313935\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4588_237831751\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqoidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaywtoljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtolgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgaywqoigy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurmhezxro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurmhezxro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nligayvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usqkhfzxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlgdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxupmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	frpmhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrojgebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtolgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaywtoljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nligayvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfaxspnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrojgezt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxupmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfaxspnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_frpmhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlgdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causnkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causnkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrojgebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxupmkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlgdyvqoigaytqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwrojgezt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgaywqoigy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxupmkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqoidbv.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3784	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
292	ipconfig.exe
904	ipconfig.exe
124	ipconfig.exe
4456	ipconfig.exe
4500	ipconfig.exe
2736	ipconfig.exe
1264	ipconfig.exe
5888	ipconfig.exe
4560	ipconfig.exe
6044	ipconfig.exe
1808	ipconfig.exe
4476	ipconfig.exe
5600	ipconfig.exe
2624	ipconfig.exe
2196	ipconfig.exe
2328	ipconfig.exe
5708	ipconfig.exe
3376	ipconfig.exe
2096	ipconfig.exe
5952	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-696679853-3915825385-3233721679-1000\{04C58650-2032-41E4-A6B9-A91FF8768A73}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3308	tnlgdyvqoigaytqo.exe
3308	tnlgdyvqoigaytqo.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3308	tnlgdyvqoigaytqo.exe
3308	tnlgdyvqoigaytqo.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3308	tnlgdyvqoigaytqo.exe
3308	tnlgdyvqoigaytqo.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3308	tnlgdyvqoigaytqo.exe
3308	tnlgdyvqoigaytqo.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3308	tnlgdyvqoigaytqo.exe
3308	tnlgdyvqoigaytqo.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4104	i_vtnlgdyvqo.exe
Token: SeDebugPrivilege	5620	i_xvpnifaysq.exe
Token: SeDebugPrivilege	1796	i_causnkfdxv.exe
Token: SeDebugPrivilege	1960	i_zxupmhfzxr.exe
Token: SeDebugPrivilege	6032	i_frpmhbzurm.exe
Token: SeDebugPrivilege	4208	i_ezwrojgezt.exe
Token: SeDebugPrivilege	2296	i_wtrojgebzt.exe
Token: SeDebugPrivilege	2492	i_dbvtolgdyw.exe
Token: SeDebugPrivilege	5604	i_jgaywqoigy.exe
Token: SeDebugPrivilege	2168	i_qnlfdxvqni.exe
Token: SeDebugPrivilege	5320	i_nhfaxspnif.exe
Token: SeDebugPrivilege	5020	i_zxrpnhfzxr.exe
Token: SeDebugPrivilege	4596	i_fzxupmkhcz.exe
Token: SeDebugPrivilege	2728	i_wurmhezxro.exe
Token: SeDebugPrivilege	700	i_rojgeywroj.exe
Token: SeDebugPrivilege	4472	i_geywqoidbv.exe
Token: SeDebugPrivilege	3100	i_gaywtoljdb.exe
Token: SeDebugPrivilege	2552	i_nligayvqoi.exe
Token: SeDebugPrivilege	5024	i_axsqkicavs.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4588	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 3308	4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4828 wrote to memory of 5916	4828	2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 5916 wrote to memory of 4588	5916	iexplore.exe	91
PID 4588 wrote to memory of 3204	4588	msedge.exe	92
PID 4588 wrote to memory of 5980	4588	msedge.exe	94
PID 4588 wrote to memory of 3784	4588	msedge.exe	95
PID 4588 wrote to memory of 5980	4588	msedge.exe	94
PID 4588 wrote to memory of 5980	4588	msedge.exe	94
PID 4588 wrote to memory of 5868	4588	msedge.exe	96
PID 4588 wrote to memory of 5868	4588	msedge.exe	96
PID 4588 wrote to memory of 3436	4588	msedge.exe	98
PID 4588 wrote to memory of 3436	4588	msedge.exe	98
PID 4588 wrote to memory of 4796	4588	msedge.exe	97
PID 4588 wrote to memory of 3436	4588	msedge.exe	98
PID 4588 wrote to memory of 4796	4588	msedge.exe	97
PID 4588 wrote to memory of 4796	4588	msedge.exe	97
PID 4588 wrote to memory of 1448	4588	msedge.exe	99
PID 4588 wrote to memory of 1448	4588	msedge.exe	99
PID 4588 wrote to memory of 1448	4588	msedge.exe	99
PID 4588 wrote to memory of 6036	4588	msedge.exe	100
PID 4588 wrote to memory of 6036	4588	msedge.exe	100
PID 4588 wrote to memory of 6036	4588	msedge.exe	100
PID 4588 wrote to memory of 3664	4588	msedge.exe	101
PID 4588 wrote to memory of 3664	4588	msedge.exe	101
PID 4588 wrote to memory of 1684	4588	msedge.exe	104
PID 4588 wrote to memory of 2800	4588	msedge.exe	105
PID 4588 wrote to memory of 1684	4588	msedge.exe	104
PID 4588 wrote to memory of 2800	4588	msedge.exe	105
PID 3308 wrote to memory of 4384	3308	tnlgdyvqoigaytqo.exe	107
PID 4588 wrote to memory of 4780	4588	msedge.exe	110
PID 5556 wrote to memory of 4448	5556	vtnlgdyvqo.exe	112
PID 4588 wrote to memory of 2900	4588	msedge.exe	117
PID 4588 wrote to memory of 2900	4588	msedge.exe	117
PID 4588 wrote to memory of 3356	4588	msedge.exe	118
PID 4588 wrote to memory of 3356	4588	msedge.exe	118
PID 3308 wrote to memory of 796	3308	tnlgdyvqoigaytqo.exe	119
PID 3308 wrote to memory of 4452	3308	tnlgdyvqoigaytqo.exe	123
PID 4272 wrote to memory of 1988	4272	xvpnifaysq.exe	125
PID 3308 wrote to memory of 1832	3308	tnlgdyvqoigaytqo.exe	128
PID 3308 wrote to memory of 5144	3308	tnlgdyvqoigaytqo.exe	132
PID 1004 wrote to memory of 4568	1004	causnkfdxv.exe	134
PID 3308 wrote to memory of 5408	3308	tnlgdyvqoigaytqo.exe	137
PID 3308 wrote to memory of 4104	3308	tnlgdyvqoigaytqo.exe	142
PID 3556 wrote to memory of 6128	3556	zxupmhfzxr.exe	144
PID 3308 wrote to memory of 2064	3308	tnlgdyvqoigaytqo.exe	147
PID 4588 wrote to memory of 6004	4588	msedge.exe	149
PID 4588 wrote to memory of 4880	4588	msedge.exe	150
PID 4588 wrote to memory of 1176	4588	msedge.exe	151
PID 3308 wrote to memory of 3744	3308	tnlgdyvqoigaytqo.exe	154
PID 4968 wrote to memory of 2440	4968	frpmhbzurm.exe	156
PID 3308 wrote to memory of 5224	3308	tnlgdyvqoigaytqo.exe	159
PID 3308 wrote to memory of 6008	3308	tnlgdyvqoigaytqo.exe	163
PID 2236 wrote to memory of 5688	2236	ezwrojgezt.exe	165
PID 3308 wrote to memory of 2900	3308	tnlgdyvqoigaytqo.exe	168
PID 3308 wrote to memory of 3440	3308	tnlgdyvqoigaytqo.exe	172
PID 2436 wrote to memory of 2344	2436	wtrojgebzt.exe	174
PID 3308 wrote to memory of 4192	3308	tnlgdyvqoigaytqo.exe	177
PID 3308 wrote to memory of 4144	3308	tnlgdyvqoigaytqo.exe	181
PID 4800 wrote to memory of 4940	4800	dbvtolgdyw.exe	183
PID 3308 wrote to memory of 2784	3308	tnlgdyvqoigaytqo.exe	186
PID 4588 wrote to memory of 848	4588	msedge.exe	188
PID 4588 wrote to memory of 848	4588	msedge.exe	188
PID 3308 wrote to memory of 4584	3308	tnlgdyvqoigaytqo.exe	194
PID 4844 wrote to memory of 3112	4844	jgaywqoigy.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_38e64bc9a9c75f0d2fbe35648699b2f9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Temp\tnlgdyvqoigaytqo.exe
  C:\Temp\tnlgdyvqoigaytqo.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlgdyvqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4384
  - - C:\Temp\vtnlgdyvqo.exe
      C:\Temp\vtnlgdyvqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5556
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlgdyvqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:796
  - - C:\Temp\i_vtnlgdyvqo.exe
      C:\Temp\i_vtnlgdyvqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnifaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4452
  - - C:\Temp\xvpnifaysq.exe
      C:\Temp\xvpnifaysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4272
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1988
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnifaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1832
  - - C:\Temp\i_xvpnifaysq.exe
      C:\Temp\i_xvpnifaysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causnkfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5144
  - - C:\Temp\causnkfdxv.exe
      C:\Temp\causnkfdxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1004
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4568
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causnkfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5408
  - - C:\Temp\i_causnkfdxv.exe
      C:\Temp\i_causnkfdxv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxupmhfzxr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4104
  - - C:\Temp\zxupmhfzxr.exe
      C:\Temp\zxupmhfzxr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3556
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6128
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxupmhfzxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2064
  - - C:\Temp\i_zxupmhfzxr.exe
      C:\Temp\i_zxupmhfzxr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\frpmhbzurm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3744
  - - C:\Temp\frpmhbzurm.exe
      C:\Temp\frpmhbzurm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4968
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2440
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_frpmhbzurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5224
  - - C:\Temp\i_frpmhbzurm.exe
      C:\Temp\i_frpmhbzurm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezwrojgezt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6008
  - - C:\Temp\ezwrojgezt.exe
      C:\Temp\ezwrojgezt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2236
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5688
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezwrojgezt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2900
  - - C:\Temp\i_ezwrojgezt.exe
      C:\Temp\i_ezwrojgezt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtrojgebzt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3440
  - - C:\Temp\wtrojgebzt.exe
      C:\Temp\wtrojgebzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2436
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2344
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtrojgebzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4192
  - - C:\Temp\i_wtrojgebzt.exe
      C:\Temp\i_wtrojgebzt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtolgdyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4144
  - - C:\Temp\dbvtolgdyw.exe
      C:\Temp\dbvtolgdyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4800
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4940
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtolgdyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2784
  - - C:\Temp\i_dbvtolgdyw.exe
      C:\Temp\i_dbvtolgdyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgaywqoigy.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4584
  - - C:\Temp\jgaywqoigy.exe
      C:\Temp\jgaywqoigy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4844
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3112
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgaywqoigy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2988
  - - C:\Temp\i_jgaywqoigy.exe
      C:\Temp\i_jgaywqoigy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnlfdxvqni.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4236
  - - C:\Temp\qnlfdxvqni.exe
      C:\Temp\qnlfdxvqni.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6096
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2976
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnlfdxvqni.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4944
  - - C:\Temp\i_qnlfdxvqni.exe
      C:\Temp\i_qnlfdxvqni.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfaxspnif.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2800
  - - C:\Temp\nhfaxspnif.exe
      C:\Temp\nhfaxspnif.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2492
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfaxspnif.exe ups_ins
    3⤵
    PID:2204
  - - C:\Temp\i_nhfaxspnif.exe
      C:\Temp\i_nhfaxspnif.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrpnhfzxr.exe ups_run
    3⤵
    PID:464
  - - C:\Temp\zxrpnhfzxr.exe
      C:\Temp\zxrpnhfzxr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3044
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrpnhfzxr.exe ups_ins
    3⤵
    PID:4592
  - - C:\Temp\i_zxrpnhfzxr.exe
      C:\Temp\i_zxrpnhfzxr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxupmkhcz.exe ups_run
    3⤵
    PID:3712
  - - C:\Temp\fzxupmkhcz.exe
      C:\Temp\fzxupmkhcz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1136
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4156
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5600
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxupmkhcz.exe ups_ins
    3⤵
    PID:2932
  - - C:\Temp\i_fzxupmkhcz.exe
      C:\Temp\i_fzxupmkhcz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4596
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wurmhezxro.exe ups_run
    3⤵
    PID:1796
  - - C:\Temp\wurmhezxro.exe
      C:\Temp\wurmhezxro.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5604
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6064
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wurmhezxro.exe ups_ins
    3⤵
    PID:1196
  - - C:\Temp\i_wurmhezxro.exe
      C:\Temp\i_wurmhezxro.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rojgeywroj.exe ups_run
    3⤵
    PID:1456
  - - C:\Temp\rojgeywroj.exe
      C:\Temp\rojgeywroj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5060
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3036
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rojgeywroj.exe ups_ins
    3⤵
    PID:2332
  - - C:\Temp\i_rojgeywroj.exe
      C:\Temp\i_rojgeywroj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywqoidbv.exe ups_run
    3⤵
    PID:4068
  - - C:\Temp\geywqoidbv.exe
      C:\Temp\geywqoidbv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3376
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2940
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywqoidbv.exe ups_ins
    3⤵
    PID:5992
  - - C:\Temp\i_geywqoidbv.exe
      C:\Temp\i_geywqoidbv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaywtoljdb.exe ups_run
    3⤵
    PID:5828
  - - C:\Temp\gaywtoljdb.exe
      C:\Temp\gaywtoljdb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5952
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3396
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaywtoljdb.exe ups_ins
    3⤵
    PID:5428
  - - C:\Temp\i_gaywtoljdb.exe
      C:\Temp\i_gaywtoljdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nligayvqoi.exe ups_run
    3⤵
    PID:456
  - - C:\Temp\nligayvqoi.exe
      C:\Temp\nligayvqoi.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4252
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5404
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nligayvqoi.exe ups_ins
    3⤵
    PID:596
  - - C:\Temp\i_nligayvqoi.exe
      C:\Temp\i_nligayvqoi.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axsqkicavs.exe ups_run
    3⤵
    PID:3496
  - - C:\Temp\axsqkicavs.exe
      C:\Temp\axsqkicavs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4640
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2972
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axsqkicavs.exe ups_ins
    3⤵
    PID:4516
  - - C:\Temp\i_axsqkicavs.exe
      C:\Temp\i_axsqkicavs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usqkhfzxvp.exe ups_run
    3⤵
    PID:5896
  - - C:\Temp\usqkhfzxvp.exe
      C:\Temp\usqkhfzxvp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2844
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1808
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffaea91c188,0x7ffaea91c194,0x7ffaea91c1a0
      4⤵
      PID:3204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,15143550117631255799,14148016603103097168,262144 --field-trial-handle=3172,i,7002325857557278803,10995604692113364336,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:2
      4⤵
      PID:5980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,16876166881196919968,8922179844303015032,524288 --field-trial-handle=3172,i,7002325857557278803,10995604692113364336,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:11
      4⤵
      System Time Discovery
      PID:3784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,10038542891145873602,13365099517624203639,524288 --field-trial-handle=3172,i,7002325857557278803,10995604692113364336,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:13
      4⤵
      PID:5868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,13594450611502493566,12784743667810719633,2097152 --field-trial-handle=3172,i,7002325857557278803,10995604692113364336,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=2464,i,14122847170540383504,1959477128756214729,2097152 --field-trial-handle=3172,i,7002325857557278803,10995604692113364336,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
      4⤵
      PID:3436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,16961280146036416987,321753222007559788,2097152 --field-trial-handle=3172,i,7002325857557278803,10995604692113364336,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:1
      4⤵
      PID:1448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,15140429706811436425,9395951203468087767,2097152 --field-trial-handle=3172,i,7002325857557278803,10995604692113364336,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:9
      4⤵
      PID:6036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,1194246751456683479,1199803851748229091,524288 --field-trial-handle=3172,i,7002325857557278803,10995604692113364336,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
      4⤵
      PID:3664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,9076862653984785340,664769497401154033,524288 --field-trial-handle=3172,i,7002325857557278803,10995604692113364336,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
      4⤵
      PID:1684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,13226242602686283279,3128097324586676929,524288 --field-trial-handle=3172,i,7002325857557278803,10995604692113364336,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
      4⤵
      PID:2800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,15387692542234806498,8761865279587365867,524288 --field-trial-handle=3172,i,7002325857557278803,10995604692113364336,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
      4⤵
      PID:1580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,15387692542234806498,8761865279587365867,524288 --field-trial-handle=3172,i,7002325857557278803,10995604692113364336,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,645383935315784776,18075287716700016025,524288 --field-trial-handle=3172,i,7002325857557278803,10995604692113364336,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
      4⤵
      PID:2900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,14130874284936928643,17532988559379699342,524288 --field-trial-handle=3172,i,7002325857557278803,10995604692113364336,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
      4⤵
      PID:3356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,6591203000262079567,15448782381638714944,524288 --field-trial-handle=3172,i,7002325857557278803,10995604692113364336,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:14
      4⤵
      PID:6004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,188631164984718192,3599156554950539854,524288 --field-trial-handle=3172,i,7002325857557278803,10995604692113364336,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,1284103377395893858,6932925801089490340,524288 --field-trial-handle=3172,i,7002325857557278803,10995604692113364336,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
      4⤵
      PID:1176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,1103215367536962582,13576230951725496775,524288 --field-trial-handle=3172,i,7002325857557278803,10995604692113364336,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
      4⤵
      PID:848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,15441723995955589757,1952499568438499552,524288 --field-trial-handle=3172,i,7002325857557278803,10995604692113364336,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
      4⤵
      PID:2528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,5756614735170465152,17554878596405430979,524288 --field-trial-handle=3172,i,7002325857557278803,10995604692113364336,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
      4⤵
      PID:5888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,3308722218571579482,424053566423180791,524288 --field-trial-handle=3172,i,7002325857557278803,10995604692113364336,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
      4⤵
      PID:5776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6624,i,16290729790524549936,8614275565270915219,262144 --field-trial-handle=3172,i,7002325857557278803,10995604692113364336,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:10
      4⤵
      PID:4988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,902657443199476898,8024817612005572588,524288 --field-trial-handle=3172,i,7002325857557278803,10995604692113364336,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
      4⤵
      PID:5680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,3369228899955719374,5389667539883441687,524288 --field-trial-handle=3172,i,7002325857557278803,10995604692113364336,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:14
      4⤵
      PID:1176

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4708

C:\Temp\tnlgdyvqoigaytqo.sys
C:\Temp\tnlgdyvqoigaytqo.sys
1⤵
- Executes dropped EXE
PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3424

C:\Temp\davsnlidav.sys
C:\Temp\davsnlidav.sys
1⤵
- Executes dropped EXE
PID:2528

C:\Temp\fcxusnhfdx.sys
C:\Temp\fcxusnhfdx.sys
1⤵
- Executes dropped EXE
PID:6032

C:\Temp\cxusmkhcau.sys
C:\Temp\cxusmkhcau.sys
1⤵
- Executes dropped EXE
PID:2284

C:\Temp\hczxrpmhfc.sys
C:\Temp\hczxrpmhfc.sys
1⤵
- Executes dropped EXE
PID:3276

C:\Temp\ezwrpjhbzw.sys
C:\Temp\ezwrpjhbzw.sys
1⤵
- Executes dropped EXE
PID:2712

C:\Temp\wqoljhbztr.sys
C:\Temp\wqoljhbztr.sys
1⤵
- Executes dropped EXE
PID:5596

C:\Temp\mgeywqoiyt.sys
C:\Temp\mgeywqoiyt.sys
1⤵
- Executes dropped EXE
PID:4988

C:\Temp\geyvqnliga.sys
C:\Temp\geyvqnliga.sys
1⤵
- Executes dropped EXE
PID:2932

C:\Temp\vsqlidavtn.sys
C:\Temp\vsqlidavtn.sys
1⤵
- Executes dropped EXE
PID:2336

C:\Temp\nkfdxvsqki.sys
C:\Temp\nkfdxvsqki.sys
1⤵
- Executes dropped EXE
PID:2896

C:\Temp\pnhfcaxspk.sys
C:\Temp\pnhfcaxspk.sys
1⤵
PID:2736

C:\Temp\fzxusmkeca.sys
C:\Temp\fzxusmkeca.sys
1⤵
PID:3512

C:\Temp\xrpjhbzwup.sys
C:\Temp\xrpjhbzwup.sys
1⤵
PID:4976

C:\Temp\wrpjhbztro.sys
C:\Temp\wrpjhbztro.sys
1⤵
PID:4560

C:\Temp\jhbzwroljd.sys
C:\Temp\jhbzwroljd.sys
1⤵
PID:5076

C:\Temp\dbytrljdbv.sys
C:\Temp\dbytrljdbv.sys
1⤵
PID:5664

C:\Temp\idaysqnljd.sys
C:\Temp\idaysqnljd.sys
1⤵
PID:4776

C:\Temp\fdavsnlfdx.sys
C:\Temp\fdavsnlfdx.sys
1⤵
PID:5880

C:\Temp\aysqnlfcax.sys
C:\Temp\aysqnlfcax.sys
1⤵
PID:4328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

causnkfdxv.exe

Path C:\Temp\causnkfdxv.exe
Size 361KB
SHA256 9cff6fe3b6dca73902f62e7e41d5f556237ed6c7b618158d392a9d4f170e7006
MD5 944a566096e4299968d2ac28be5db968
SHA1 e7937651c48d1ce48e91076d732fab2c69194a6a
SHA512 8fb02991bd4c9ce45b6c2ff83b3b029b0e6b9248ee21472133382ef66c154fb7b2a91e72a4bd4ea6280bb46096ce011c563d013d23490e556c16f0c361551c99
SSDEEP 6144:rflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:rflfAsiVGjSGecvX
TLSH
T104747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxusmkhcau.sys

Path C:\Temp\cxusmkhcau.sys
Size 293KB
SHA256 47a9957985ea9f1e90a678babc7bcd5c361da087d8c47a6449f88732e87ca578
MD5 70de293573ddaf58a2f4903af44e7975
SHA1 56b6b30eaad2a0ac9dd65338bfb8865894064247
SHA512 811d9f1e2f0b15be8ea627b0320a9c17a1d24e65cd7e446b0519d22fd62bddf6eee42a057adff42734a5e752299c51dc3ff692d8f6061bea5ab4d2b7096b9b87
SSDEEP 3072:FtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:FIJjiJcbI03GBc3ucY5DCSj
TLSH
T179545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

davsnlidav.sys

Path C:\Temp\davsnlidav.sys
Size 293KB
SHA256 6307a611638265f323728a66500c7d18cdde3116810209cf5fc9ee0c44afd27c
MD5 d774fc942d83ec756c319e2e65393165
SHA1 a02f8a4fa38e626904dcbc02921b646181c463c7
SHA512 8ff0ea9cfbd10fd72b8a72140afa94b58198e6bf126207a437ecc8fd39563daf3a0e8fa079f6e4516617ddfcae17c8dc1503165a2bab0d756509e5794c5e75f3
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezwrojgezt.exe

Path C:\Temp\ezwrojgezt.exe
Size 361KB
SHA256 736d8516f818b78475984020afacf6caaebbadb66f3ce05d03c3f973f3feeb50
MD5 c657aacea56c1afbf5d093740b682665
SHA1 d0f161dfa6039ec0a544e4ce99e0f91349c06820
SHA512 1a24399b208be9403e72802a46d1c7a232fb96bde25586d7e3636c7f2cd8272b64cfb2f4c2a827a8c7ddcb3625d0d21f8925e08fa268b7809dbe2c5611dd1ae2
SSDEEP 6144:SflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:SflfAsiVGjSGecvX
TLSH
T1A5747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezwrpjhbzw.sys

Path C:\Temp\ezwrpjhbzw.sys
Size 293KB
SHA256 31cbc45cbf3885b401d817f2b96e65c8965096563da08a766ae3469ec8e9a616
MD5 226d0e41dac01e11b9f865396a80d135
SHA1 10e4b46a0f34c2dda0674e4c07c00b06450a310f
SHA512 5f846e358eb5aead4aad4118e360d393aadae795244897db7c0c6d2e763ef02c710dcc61b3e2c0c8c39ae651a251e08ae9fac398d67fab67cf6e52be04726ce7
SSDEEP 3072:6tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:6IJjiJcbI03GBc3ucY5DCSj
TLSH
T14B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxusnhfdx.sys

Path C:\Temp\fcxusnhfdx.sys
Size 293KB
SHA256 1c5bcd3c0256ccb2ddfd7e86160c70141c2b45ea94ac8dbce4c19cd45ba2e56f
MD5 f395a606deac03e1b8318be6f8c8f9f1
SHA1 7e6bd4c6228bea29e989163271805024ff0148fe
SHA512 bafd06e7f7bbad1a6832c5000e57c8da47207d51c874e63ad684d9d3e0e937ab32373841cc05acb4576471c4a3c3e8a6bb5d1a12c16b9c295ab8cbad935e7ad3
SSDEEP 3072:TtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:TIJjiJcbI03GBc3ucY5DCSj
TLSH
T190545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

frpmhbzurm.exe

Path C:\Temp\frpmhbzurm.exe
Size 361KB
SHA256 faf9a7284029327cbbeba47fab5843e0057eb3e935f83f8bf50efbc81cd10f29
MD5 4c401d34cc5cda66544ab2a7d862a78f
SHA1 8c76e44468f67c120abd0cbec7873172299fc618
SHA512 80a73658ac674e474919d438e735c45b8dd97cd43ca02ae4251127840f6410e022d5a15caf589547ee632e390f5076aa73d1500f3521c8b412eda6674723a813
SSDEEP 6144:RflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:RflfAsiVGjSGecvX
TLSH
T1AC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczxrpmhfc.sys

Path C:\Temp\hczxrpmhfc.sys
Size 293KB
SHA256 fd186aa6e75780e67d3bcba858e1d00787dc6afcc244a72d39219304afb49828
MD5 97ef7f3491a6eaf8f54293482b9724f9
SHA1 62a0105d9f38245d7bd0df19380b3521725dd678
SHA512 d19aa74b2fb913d6545df5e82de06a8e6e6eb3d89bd0e0feba1fba1eedf2e846d98e5fc3332f3078561c35da6f56b021a6028583b25714bce342364cd73c148e
SSDEEP 3072:8tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:8IJjiJcbI03GBc3ucY5DCSj
TLSH
T1F4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_causnkfdxv.exe

Path C:\Temp\i_causnkfdxv.exe
Size 361KB
SHA256 bbb0c3c8f76447d75675e9ac65f50f2cba0ca628ccb95ca3854e0562890e1cc4
MD5 a75fea4cba2ae21ca2c05d318d17d25c
SHA1 aeeb5edc682e88574e511d19f983b4fe20839d0c
SHA512 429580a9fbe274bc84b3db64ca844eba4b429cbc3042c8e0d443f29c5f7696fd124592e525f8b38d3f15faed03f710ffddd8cb6e48d008e31adebeb6cf48dfba
SSDEEP 6144:bflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:bflfAsiVGjSGecvX
TLSH
T190747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_frpmhbzurm.exe

Path C:\Temp\i_frpmhbzurm.exe
Size 361KB
SHA256 7b3b58cda099bfb10a4ebe5d89ca9b5f0ca6ef4e2d80c741a5b72f8f67335bdf
MD5 565c9cf064ea16a685ee661cde64b9b9
SHA1 4c0c3e72a6ca6560f1dfe03b6d31c03d58566306
SHA512 b06e6fae520d5ae7a97f00f81944d6866ebfbcd11a9e38041846b9b0cfe573329f462c130fe5f386542d782f77200c68ca9c673e05ec21f11087da841bd64a67
SSDEEP 6144:6flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:6flfAsiVGjSGecvX
TLSH
T105747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtnlgdyvqo.exe

Path C:\Temp\i_vtnlgdyvqo.exe
Size 361KB
SHA256 019e873c9c8d5afc338ce89009aedbf52cf2566ce46e663bfb7ced1e76cf61fd
MD5 d5b63320d80f9478416258a28916a21f
SHA1 4883a6e4d194bfed51118dd031612fafaa714033
SHA512 baf197074e4da5d466f78160e573b682dae5b60c18d5f3b90b3759b31fd15afb8dfc0d18581e753d7b065a67cef59add273b4d75cd725cc1335e740d47b82f1f
SSDEEP 6144:dflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:dflfAsiVGjSGecvX
TLSH
T144747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvpnifaysq.exe

Path C:\Temp\i_xvpnifaysq.exe
Size 361KB
SHA256 ec8d6d3fd05968fc3db4679b3ec4f0d146dc8673bfdaa82ee11f0263baf41026
MD5 10c05df348b974f66762cb9d68bd12af
SHA1 09fd6b63b6acdb145ccb9bdf2236a9094afeab75
SHA512 9b4abcc07b79125da7922510633347023da09f56be1f00a2358685be6261915b6df4eba94d1b2be90a636403e2ebfd3d99cd71c7485419198d8528140afef5aa
SSDEEP 6144:cflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:cflfAsiVGjSGecvX
TLSH
T1C5747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxupmhfzxr.exe

Path C:\Temp\i_zxupmhfzxr.exe
Size 361KB
SHA256 4c3c0f17a8f65e3e8db9a15585d0f5996a58602ef94d16477a52c408f66667dc
MD5 943d3d4c5677c5e9344f7e85b3712aaf
SHA1 34f2a614ee785abfeb667984632ca192c6734efd
SHA512 cd887df4559eef5d28f624ab77f650b7e7cc15517db845ab9a482d9e8c3ec27bce3ebaf0614ffc5da772d280d7f359b72a01a421d3798dd3f328d33eae9d62eb
SSDEEP 6144:/flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:/flfAsiVGjSGecvX
TLSH
T13C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlgdyvqoigaytqo.exe

Path C:\Temp\tnlgdyvqoigaytqo.exe
Size 361KB
SHA256 63a72d3d12b58dab873a5b74a71860f216a558743115e99d14e5bf16edaef9e0
MD5 01b79b55bb03b86c087655f427dff3a5
SHA1 51af90c13fba8ff49671b58374e563eb71aea372
SHA512 e853e050a8ac9ec35703d9642f25f8c825dc8d47862d992b11e931100a5837fe9d82fd945cc14f7e658387de1265475954a2b5b966bcc429b207f255bf5e6b4a
SSDEEP 6144:wflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:wflfAsiVGjSGecvX
TLSH
T10B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlgdyvqoigaytqo.sys

Path C:\Temp\tnlgdyvqoigaytqo.sys
Size 293KB
SHA256 023f521c3e6a79eeef4c4d902bdabcf33b85cae00f0371db25674b6d5c7c24a3
MD5 e86a2afd3cc8a30fa7870a4b66e23840
SHA1 f1d9c5b272239fa6088beca3254b44ade0c62883
SHA512 300e9c409d710c2d0972710f5c6ac9ffe7935c280b26ec372633e101ed571ba3254e85170aefddaea39835a4c0b20296704bcb1a7ee4ffd1c0596f3cb0687102
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlgdyvqo.exe

Path C:\Temp\vtnlgdyvqo.exe
Size 361KB
SHA256 e00dd2e4e872465d4143a9729c0173252264ca88e73a60775a5d44c46209c1a4
MD5 a4135b1bc45377e20d8558189bc23aee
SHA1 6661e5d228e2ab078dfb9ebac9e5a010016051c9
SHA512 ecbd1803727de3a8b3b6331f7da5694da4bc79b192e7291aae7b87cda0eea51b842c3488496fbb163536eb99e96cb46f008e0225c3dd3cf54fd8eb79d7720ce0
SSDEEP 6144:jflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:jflfAsiVGjSGecvX
TLSH
T1A4747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnifaysq.exe

Path C:\Temp\xvpnifaysq.exe
Size 361KB
SHA256 20b10fa3239c2a2e61c1bded562ca247128a5bd647726c7b739787f0a41ef486
MD5 1822b76bb31f28ce7aa58f281a26acea
SHA1 dd80ec8a16ed124834954abbac42212dc632ccf4
SHA512 161e9d56cb13eab68fc75ddb73a0a9991ac533cdd651dbcdeb9e2145f3c8698b15a4826e2e544d4f2df357ede77e5b0feacb4e4366ad160d1a5f23948679edab
SSDEEP 6144:BflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:BflfAsiVGjSGecvX
TLSH
T1E8747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxupmhfzxr.exe

Path C:\Temp\zxupmhfzxr.exe
Size 361KB
SHA256 b2c8d57d3242dc66e9a58e33a8bd50860ecb531484398395bd633f580bc0d7e4
MD5 59ee1b832eac004b1d3d8e7ff33cfcee
SHA1 06298e40a9245329385da9aa99e5443d89ddc93d
SHA512 ca835faa236d2a0dff8f11a0b742996f9b6ca60b6804fbee8066e46e2b02760e72caa84f8e42e8881caf7a62631210904b789d73efb85ea7290627f51b9c0f6d
SSDEEP 6144:5flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:5flfAsiVGjSGecvX
TLSH
T1E2747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 91a032a4ffcdd10503afdeb5220904a7e7cea899c3a55606bb3e90180ed9472e
MD5 f04321ebc7aa4a8f91bb5362a6c4c79b
SHA1 c98d3283204e4a0453e416a04c3ae56e4c3feed8
SHA512 c2faa7fae738d85299e6f63b9eaf33c25db5a255ea3f5f6a8551842b7e0cec73c7e8b5e86a9cfb9714287d2b382b57b7249bc70671dbfde2815d5937243570af
TLSH
T1DED02B71F678E8D2C140043C00420920705035061F6801C207034038040324B55012C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 59619e39464102fa53912dd9a15237954c5125d546c48a72b8bdb58ad9eb9753
MD5 f80a0057aa895d42a15b594d07d09f76
SHA1 2478a67794a5362ccf809b7a2c8f64a03c72fa32
SHA512 4a9ec8459a11d9e573883d5eacfd5386cf838bad2bd0b33ff1b37017f5f2cf6bfcef877344a87892e3c49ce624e0cae52791ded1593b8233138de87fd2e5e634
TLSH
T1C6D02B75F668E9D2C140043C00410920706035066F6801C206030038040324B55022C7
MD5 SHA1 SHA512 TLSH

Submit Download

7cc6b790-4fde-442b-957c-8b3aaa6ea0f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7cc6b790-4fde-442b-957c-8b3aaa6ea0f2.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b5f7da5d4b048d9587a8d309a017d34c8c8985019989f93a9f7c4fb7aa00448f
MD5 66faf092a3acf9a4a910f3e39d854b6b
SHA1 02427e82d6e4efe192519650959a818b53d27dac
SHA512 c8842036dea28bf61ef48cf64de1d38a361e01f347ae35e1ae0a9393eeb3b0261ced184623d429a02cea6e36a401e35a30476ca5a0aeed90404f33bff9487a28
TLSH
T1D651D94099A44085FF98023197F53E873E34968F65D70FA1418DC5B8DB0E7F9C174798
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bb8bb3a8d578afac74c4ed1bb0eee6bf39834e00d49dcddfae5eaac313120a55
MD5 f7a7a6e44d8250675425214d0e61b6c9
SHA1 bd1e9a5ce9b3ae6cdc9d34e705577e4fa6041fe0
SHA512 4c3117f97ebb5d4fa6a8c393792e9790563457cf9a0c124d38e80ef7b678295517e18aa4f319c8e2fd91e3f1e3fa83ce8497dc4e42245393890be70ee4d4e28f
TLSH
T17151ADF3C3E8862E890156F4A6186E2FCE1D0914432C3D5AC9E4EF5B93E24B1E14169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c7fbfc528b049099b5287db8254b69d3aebe5d34708fe8ec13f6c6274a23d76d
MD5 c11b69fa22b7c483745d629dd32a3085
SHA1 3e9f891f6d4f608bd1b4b5c0f177d29b8ae47a5e
SHA512 b98e947029ad2f4fe0bce84bc16edbea6cfd4f6c905c646c0a4abfdb43f692181f6b26f4a7dc98c654964334102a131e0cccfabb0a6f04d521ac07eb9a7e068c
SSDEEP 192:sxRRR0C//fxs8RZ3znhPzoA8p9T/g6+WNCv1/YiYdAGGIgDV3J:sxRRR//fxs8/Dnhm9/5s/1r
TLSH
T1B542D855AD68A97B8CC7D21DBB65BF13D2F91032A0951E48A6FC8A1C04FB7DD2207C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 db068cf7316b15a34b73d4fe9b59ab78e0e1b2f87d282164c0fc3d52d1182191
MD5 8f2bdc777eec31f0bb2d36afd7ab1b85
SHA1 eb48c26f6dd769fef8bbe776d96fe1a0d08ae3e6
SHA512 3925eb3aac1629cf8ed24b228787606ee1ba7b5e87ebfa4993ff5a09fbd2b447ee011d5c3a4a77d95259b4209856d5af842112a46e68acdcdc50616a7ba7bf7b
SSDEEP 192:sxRRR0C//fxsXRZ3znhPzoA8p9T/g6+WNCv1/YizdAGGIgDv3J:sxRRR//fxsX/Dnhm9/5s/Sd
TLSH
T15C42C855AD68A97B8CC7E21DBB55BF13D2F9103290951E48A7FC8A1C04FB6DD220784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2071989ae594804fafd6746fa8fadcbddb2fbaa3714aba769b573c199072c3a6
MD5 fb567fdd23aaebba64a9fa99544674a9
SHA1 47c49d7dbf4a62c732a01c23ca3e9289abeb6f20
SHA512 4fa8477405ed59255e5084891ea302097f827664df90e2b11a045c2d72293694d196e248dd803397f5130fa56410e8ec9a592e37bd1275993722db63c8ff138c
SSDEEP 192:sxRSR0C//fxsoRZ3znhPzoA8p9T/g6+WNCv1/YiYdAGGIgV3J:sxRSR//fxso/Dnhm9/5s/1/
TLSH
T14D42C855AD68A97B8CC7D21DBB65BF13D2F91032A0951E48B6FC8A1C04FB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 34f1ba2f2bfef14cf6b08f8819cb3157e63e60ea0ba9b5aa305684661365c2c0
MD5 f8c9bb740bc6c7941462be7bffcc21e5
SHA1 7ef198a7c861b1630a6ba5cec57982b34fd602f9
SHA512 278f1678a12939c576ecf5d341291f2cd92f9fd6713c13e9a39d50afc8fcd7401b2e4d627285ed3785446780bfc59be3625cca461f0e5c9eb3c9c637bbb92e9e
SSDEEP 768:XIDmj17pLuLbdoWgvHfnv8F1+UoAYDCx9Tuqh0VfUC9xbog/OVq7MIljnroTRlY7:XIDmjDEbdoWgvHfnvu1jap7Mmj0TRy7
TLSH
T115D2EC7B640DCA7F4F800ADDEC297A9B6DA802CB9A98C94047FE841C02D67EF51164DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6bb38ce6b422b0b9aa40a892b66a36e123f9bccaabd5e972e64f061c472d8608
MD5 107ba177d7c5247882974ea43e109ea2
SHA1 92fb3e965957803463eb796013b3688d83596395
SHA512 fe9580a819aeca312b4ddf5d863166ef140834885ffa1876a92b6a6d5e83ecee2b98c06dd7668ef7473ce11c8fe7f414eb00bcedeeabe3201037ed5a1eeac9e0
SSDEEP 96:KUowK1+Kklcxl3X3qxP+Zr1qKzfrLqXFt2TVhebKKkMmBcvbpro:qj35RLBcvbpro
TLSH
T1ED913821303B2280397E3519D0E4A77E434171673169FA6B7FEA41A28E2BE441DFD5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b4c10282-3cab-40af-b111-41d65784516f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b4c10282-3cab-40af-b111-41d65784516f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 c76b2eb66430082eb07930cdeeb7c4075e678026cdbe3aa15e3be367ca072f2c
MD5 55f2e5929c4929c1ac1f4e7d1122ec6f
SHA1 8fddc35ea2608f759ac8447ea488619fbc4ff82b
SHA512 db20293c3bdacb282f177cc93b56078236a4fa658c0d93a7fe3f626ac6c2bb732a8823864e6f7b91ba17f1485085c7b1a1e9718868fe7a5c5e61917d4a366b03
SSDEEP 768:lFQv34wgb2O0qcWnYo/VYoydBw4Ot5AEl94BHYjH32sLS2:Ev3ssdBVa5AEncHYjX2su2
TLSH
T10E1317F588E38977D8EE9787A73D2E425EBCC163B4859984BBD45D0DCC421BFC20A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6d5393efac6c850c7d1de8f64a2f7fcdc08180a1c87868f8e8a52c83cbf40937
MD5 93673ab0c78d67d205530d13aa9fc451
SHA1 fee92920f91befd8eacad05c466310ce77fc9be3
SHA512 a85a313cea8cf45fee50d151c5cd485a4d52b944097cf8acc473d4d73e4f49e27496d20a15514d792725df0ec81278761bfbe802b9e2f198aca6bf696a341766
SSDEEP 768:z/UxvxjgC+b3wjcZ0rfZWnYo/tBw4Ot5AEl94BHYj/OAFTN/:GZj3+b3XBVa5AEncHYj2AFB/
TLSH
T1CD03CF39DCA59D23CCF69785770A3347AEF19463A5C25ED48DDC2E1E0A8725D130B84B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 abf2d0e9f1bf1cb0fd90d58f6b853852a5174fe319f0d2f350ad5036d30aa0db
MD5 08ee271b6467650a768eacb2301c5cdc
SHA1 885d3e904ddb550d6e579ddf7d37f26b46fa1974
SHA512 01992491809ae4839b7ec91ab7b1b52f6e0987ce98d340f5ec18222bf9c2465f1d6023baa94322fe69b9e51d86a1b818c196880629007352a405c7f98f57d8c1
SSDEEP 768:P/UxvxjgC+K39xqcZ0rfZWnYo/VYoy2Bw4Ot5AEl94BHYjH32J:iZj3+K39m2BVa5AEncHYjX2J
TLSH
T1F403C038E8A59D638DF6E385B70A37879FF05463A8C15DE49CD85E0E0A4739E174B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 383647aa3f850a117e4a0f5e4a0b7f65444b518a4ab24cc0d5d2794cfdb0e26d
MD5 282a2739564ce65ce9a951aaaf020906
SHA1 39e6b3499cf3abe6a5fb3d00dbb38d53240b1353
SHA512 3042eea6ea72c656ca23676e9acfb57e55c1ab4bd3ec9b60caf33782d96e2e68806d1c9b466e3cb1f05f4c552fc820e688142387eeebd22271f00b978a77d1a3
SSDEEP 768:jn392qcZ0rfZWnYo/VYoy2Bw4Ot5AEl94BHYjH32sLS2:jn39T2BVa5AEncHYjX2su2
TLSH
T1C1F2AF74DCB58DB39CFAD389B60637426FF15563E8819E94E8E85A0E094329F174F80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 3d7ea92de574b4bd8c39388d3f549a9f111bdeb1209e9cec0adf931f6559f38e
MD5 77af0466b089dc4c1932f2bde8c7511d
SHA1 3d821386f01e34bfb222cc55f3514286c5f13a7d
SHA512 7fad250f7976989ebd79d7ffd046222c1ae8f89afd7149d7dd57001f290fcc1eda376f179e01efa866a8c53a27d30f6c9234f6c1ff8ff7f5b0ddef9e732ca101
SSDEEP 768:Dn3m2qcZ0rfZWnYo/VYoy2Bw4Ot5AEl94BHYjH32sLS2:Dn3mT2BVa5AEncHYjX2su2
TLSH
T1BBF2AF74DCB58DA39CFAE385B60637426FF15563E8819E94E8E85A0E094329F174F80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

d4e6a310-9ce1-4a59-9ae9-e2d35365eb89.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d4e6a310-9ce1-4a59-9ae9-e2d35365eb89.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4588_577407599\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 a0c190cdda9f60f74652823769a4efd911e27e6af29ec787c5c2de2d87ffff4b
MD5 ab559b48de6d41df7fa88c235a4d1f41
SHA1 136ba5442fbfb9269265c67eb3ce2f834488715e
SHA512 898e37faa0a3282ddac426213f28c6671df67abad3d307d8f02167d3173bf59123a9cc5b291ff27b46d828fca3a0d992d547e253472efcb535ac002404323ee2
TLSH
T11171278356ADC5B3C1DE5FF102839144F6FB22380763302407915587A770E3A54B8F44
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2284-259-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2336-332-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2528-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2712-283-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2736-388-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2896-390-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2896-361-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2932-328-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3276-271-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3276-300-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3512-422-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3512-402-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4328-494-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4540-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4560-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4776-469-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4776-491-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4976-414-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4988-313-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5076-446-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5596-309-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5664-464-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5880-489-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6032-234-0x0000000000010000-0x00000000000AB000-memory.dmp

Download