systex | 25dfefbb2b748b35ba3bd9927c737ca413d98c94686d6e03d59897f91360f38c

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260709-qa9m5sa12j
SHA256 25dfefbb2b748b35ba3bd9927c737ca413d98c94686d6e03d59897f91360f38c
MD5 1f3d6a65127a1c82d32b257d40192b5b
SHA1 d6c9aa05b700ab7fb036e374214afc30c5f663b5
SHA512 d7a150fb62e310c32056c6dc3685c936fa9ddeb752493b43dacb21b84464e5b81543fcce1e1070e6a2a59aceec7fee85144727d5c6a033227d1516f86fb6b7aa
SSDEEP 6144:eflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:eflfAsiVGjSGecvX
TLSH
T179747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5076	ywqomgebztroigdb.exe
6036	ywqomgebztroigdb.sys
1420	CreateProcess.exe
5436	mgebvtomgy.exe
1336	CreateProcess.exe
5092	CreateProcess.exe
2516	i_mgebvtomgy.exe
1880	ywqoigaywq.sys
2676	CreateProcess.exe
4740	tnlfdyvtql.exe
1908	CreateProcess.exe
4364	CreateProcess.exe
5948	i_tnlfdyvtql.exe
1232	vtnlfdyvqn.sys
5136	CreateProcess.exe
5888	lfdxvqnlfd.exe
3084	CreateProcess.exe
2116	CreateProcess.exe
4272	i_lfdxvqnlfd.exe
696	lfcavsqkif.sys
1328	CreateProcess.exe
5152	kfdxvpnifa.exe
2140	CreateProcess.exe
5084	CreateProcess.exe
3036	i_kfdxvpnifa.exe
4916	kifaxspnhf.sys
4936	CreateProcess.exe
3068	fdxupnkfcx.exe
5564	CreateProcess.exe
4160	CreateProcess.exe
4824	i_fdxupnkfcx.exe
4888	cwupmkecxu.sys
1528	CreateProcess.exe
1700	xupmhfzxup.exe
2180	CreateProcess.exe
5592	CreateProcess.exe
2912	i_xupmhfzxup.exe
3692	eczxrpmkec.sys
4272	CreateProcess.exe
5748	wurmkezwrp.exe
2004	CreateProcess.exe
1040	CreateProcess.exe
1800	i_wurmkezwrp.exe
1076	kecwuomhez.sys
5704	CreateProcess.exe
3248	hezwrpjhez.exe
4656	CreateProcess.exe
1312	CreateProcess.exe
468	i_hezwrpjhez.exe
5116	geywuomjhb.sys
5648	CreateProcess.exe
6136	ywrojeywto.exe
6124	CreateProcess.exe
4784	CreateProcess.exe
3284	i_ywrojeywto.exe
5936	bywqoigbyt.sys
2120	CreateProcess.exe
3692	bvtnlgdywq.exe
6012	CreateProcess.exe
2860	CreateProcess.exe
696	i_bvtnlgdywq.exe
4680	jdaytqljdb.sys
1296	CreateProcess.exe
2012	yvtnligdxv.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4216_1356782804\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4216_1356782804\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4216_1637168227\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4216_1729764988\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4216_1729764988\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4216_651327134\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4216_1356782804\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4216_1356782804\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4216_651327134\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqomgebztroigdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezwrpjhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljebwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoljdbytqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoljdbytqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvqnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtnligdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xurmkeczxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgebvtomgy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupmhfzxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywrojeywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtnligdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkhfcxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czukeczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgebvtomgy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxupnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkhfcxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfdxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezwrpjhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idbvqnigdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdbytqlige.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvqnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupmhfzxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurmkezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurmkezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywrojeywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsqkifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czukeczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaytqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdyvtql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfdxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsqkifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xurmkeczxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljebwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdyvtql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxupnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idbvqnigdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdbytqlige.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5232	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5544	ipconfig.exe
4796	ipconfig.exe
1240	ipconfig.exe
3016	ipconfig.exe
5568	ipconfig.exe
5228	ipconfig.exe
5988	ipconfig.exe
2252	ipconfig.exe
4560	ipconfig.exe
1204	ipconfig.exe
1392	ipconfig.exe
964	ipconfig.exe
2684	ipconfig.exe
5860	ipconfig.exe
3464	ipconfig.exe
4392	ipconfig.exe
4800	ipconfig.exe
5816	ipconfig.exe
2420	ipconfig.exe
5988	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280758908493099"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{4A25C07A-1CB1-427B-9670-051EB24A9D92}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5076	ywqomgebztroigdb.exe
5076	ywqomgebztroigdb.exe
5076	ywqomgebztroigdb.exe
5076	ywqomgebztroigdb.exe
5076	ywqomgebztroigdb.exe
5076	ywqomgebztroigdb.exe
5076	ywqomgebztroigdb.exe
5076	ywqomgebztroigdb.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2516	i_mgebvtomgy.exe
Token: SeDebugPrivilege	5948	i_tnlfdyvtql.exe
Token: SeDebugPrivilege	4272	i_lfdxvqnlfd.exe
Token: SeDebugPrivilege	3036	i_kfdxvpnifa.exe
Token: SeDebugPrivilege	4824	i_fdxupnkfcx.exe
Token: SeDebugPrivilege	2912	i_xupmhfzxup.exe
Token: SeDebugPrivilege	1800	i_wurmkezwrp.exe
Token: SeDebugPrivilege	468	i_hezwrpjhez.exe
Token: SeDebugPrivilege	3284	i_ywrojeywto.exe
Token: SeDebugPrivilege	696	i_bvtnlgdywq.exe
Token: SeDebugPrivilege	4448	i_yvtnligdxv.exe
Token: SeDebugPrivilege	5404	i_idbvqnigdy.exe
Token: SeDebugPrivilege	3504	i_faxsqkifax.exe
Token: SeDebugPrivilege	3040	i_ausmkhfcxs.exe
Token: SeDebugPrivilege	4380	i_czukeczurm.exe
Token: SeDebugPrivilege	2124	i_xurmkeczxr.exe
Token: SeDebugPrivilege	4512	i_trljebwtom.exe
Token: SeDebugPrivilege	4112	i_qoljdbytqo.exe
Token: SeDebugPrivilege	2504	i_gdbytqlige.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6100 wrote to memory of 5076	6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 6100 wrote to memory of 3888	6100	2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 3888 wrote to memory of 4216	3888	iexplore.exe	90
PID 4216 wrote to memory of 2436	4216	msedge.exe	91
PID 4216 wrote to memory of 5232	4216	msedge.exe	92
PID 4216 wrote to memory of 5792	4216	msedge.exe	93
PID 4216 wrote to memory of 5792	4216	msedge.exe	93
PID 4216 wrote to memory of 5644	4216	msedge.exe	94
PID 4216 wrote to memory of 5644	4216	msedge.exe	94
PID 4216 wrote to memory of 5644	4216	msedge.exe	94
PID 4216 wrote to memory of 1284	4216	msedge.exe	96
PID 4216 wrote to memory of 3868	4216	msedge.exe	97
PID 4216 wrote to memory of 1284	4216	msedge.exe	96
PID 4216 wrote to memory of 1284	4216	msedge.exe	96
PID 4216 wrote to memory of 3868	4216	msedge.exe	97
PID 4216 wrote to memory of 3868	4216	msedge.exe	97
PID 4216 wrote to memory of 2088	4216	msedge.exe	98
PID 4216 wrote to memory of 3468	4216	msedge.exe	99
PID 4216 wrote to memory of 2088	4216	msedge.exe	98
PID 4216 wrote to memory of 2088	4216	msedge.exe	98
PID 4216 wrote to memory of 3468	4216	msedge.exe	99
PID 4216 wrote to memory of 3468	4216	msedge.exe	99
PID 4216 wrote to memory of 4916	4216	msedge.exe	101
PID 4216 wrote to memory of 4916	4216	msedge.exe	101
PID 4216 wrote to memory of 1632	4216	msedge.exe	104
PID 4216 wrote to memory of 1632	4216	msedge.exe	104
PID 4216 wrote to memory of 4908	4216	msedge.exe	105
PID 4216 wrote to memory of 4908	4216	msedge.exe	105
PID 5076 wrote to memory of 1420	5076	ywqomgebztroigdb.exe	107
PID 4216 wrote to memory of 2492	4216	msedge.exe	108
PID 5436 wrote to memory of 1336	5436	mgebvtomgy.exe	111
PID 4216 wrote to memory of 3040	4216	msedge.exe	116
PID 4216 wrote to memory of 3040	4216	msedge.exe	116
PID 4216 wrote to memory of 3124	4216	msedge.exe	117
PID 4216 wrote to memory of 3124	4216	msedge.exe	117
PID 5076 wrote to memory of 5092	5076	ywqomgebztroigdb.exe	118
PID 5076 wrote to memory of 2676	5076	ywqomgebztroigdb.exe	122
PID 4740 wrote to memory of 1908	4740	tnlfdyvtql.exe	124
PID 5076 wrote to memory of 4364	5076	ywqomgebztroigdb.exe	127
PID 5076 wrote to memory of 5136	5076	ywqomgebztroigdb.exe	131
PID 5888 wrote to memory of 3084	5888	lfdxvqnlfd.exe	133
PID 5076 wrote to memory of 2116	5076	ywqomgebztroigdb.exe	136
PID 5076 wrote to memory of 1328	5076	ywqomgebztroigdb.exe	141
PID 5152 wrote to memory of 2140	5152	kfdxvpnifa.exe	143
PID 5076 wrote to memory of 5084	5076	ywqomgebztroigdb.exe	146
PID 4216 wrote to memory of 4708	4216	msedge.exe	148
PID 4216 wrote to memory of 468	4216	msedge.exe	149
PID 4216 wrote to memory of 5128	4216	msedge.exe	150
PID 5076 wrote to memory of 4936	5076	ywqomgebztroigdb.exe	153
PID 3068 wrote to memory of 5564	3068	fdxupnkfcx.exe	155
PID 5076 wrote to memory of 4160	5076	ywqomgebztroigdb.exe	158
PID 5076 wrote to memory of 1528	5076	ywqomgebztroigdb.exe	162
PID 1700 wrote to memory of 2180	1700	xupmhfzxup.exe	164
PID 5076 wrote to memory of 5592	5076	ywqomgebztroigdb.exe	167
PID 5076 wrote to memory of 4272	5076	ywqomgebztroigdb.exe	171
PID 5748 wrote to memory of 2004	5748	wurmkezwrp.exe	173
PID 5076 wrote to memory of 1040	5076	ywqomgebztroigdb.exe	176
PID 5076 wrote to memory of 5704	5076	ywqomgebztroigdb.exe	180
PID 3248 wrote to memory of 4656	3248	hezwrpjhez.exe	182
PID 5076 wrote to memory of 1312	5076	ywqomgebztroigdb.exe	185
PID 4216 wrote to memory of 5128	4216	msedge.exe	187
PID 4216 wrote to memory of 5128	4216	msedge.exe	187
PID 5076 wrote to memory of 5648	5076	ywqomgebztroigdb.exe	193
PID 6136 wrote to memory of 6124	6136	ywrojeywto.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_1f3d6a65127a1c82d32b257d40192b5b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6100
- C:\Temp\ywqomgebztroigdb.exe
  C:\Temp\ywqomgebztroigdb.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgebvtomgy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1420
  - - C:\Temp\mgebvtomgy.exe
      C:\Temp\mgebvtomgy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5436
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1336
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgebvtomgy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5092
  - - C:\Temp\i_mgebvtomgy.exe
      C:\Temp\i_mgebvtomgy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnlfdyvtql.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2676
  - - C:\Temp\tnlfdyvtql.exe
      C:\Temp\tnlfdyvtql.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4740
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1908
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnlfdyvtql.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4364
  - - C:\Temp\i_tnlfdyvtql.exe
      C:\Temp\i_tnlfdyvtql.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdxvqnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5136
  - - C:\Temp\lfdxvqnlfd.exe
      C:\Temp\lfdxvqnlfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5888
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3084
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdxvqnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2116
  - - C:\Temp\i_lfdxvqnlfd.exe
      C:\Temp\i_lfdxvqnlfd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kfdxvpnifa.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1328
  - - C:\Temp\kfdxvpnifa.exe
      C:\Temp\kfdxvpnifa.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5152
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2140
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kfdxvpnifa.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5084
  - - C:\Temp\i_kfdxvpnifa.exe
      C:\Temp\i_kfdxvpnifa.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxupnkfcx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4936
  - - C:\Temp\fdxupnkfcx.exe
      C:\Temp\fdxupnkfcx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3068
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5564
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxupnkfcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4160
  - - C:\Temp\i_fdxupnkfcx.exe
      C:\Temp\i_fdxupnkfcx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xupmhfzxup.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1528
  - - C:\Temp\xupmhfzxup.exe
      C:\Temp\xupmhfzxup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1700
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2180
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xupmhfzxup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5592
  - - C:\Temp\i_xupmhfzxup.exe
      C:\Temp\i_xupmhfzxup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wurmkezwrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4272
  - - C:\Temp\wurmkezwrp.exe
      C:\Temp\wurmkezwrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5748
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2004
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wurmkezwrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1040
  - - C:\Temp\i_wurmkezwrp.exe
      C:\Temp\i_wurmkezwrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hezwrpjhez.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5704
  - - C:\Temp\hezwrpjhez.exe
      C:\Temp\hezwrpjhez.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4656
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hezwrpjhez.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1312
  - - C:\Temp\i_hezwrpjhez.exe
      C:\Temp\i_hezwrpjhez.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywrojeywto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5648
  - - C:\Temp\ywrojeywto.exe
      C:\Temp\ywrojeywto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6136
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywrojeywto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4784
  - - C:\Temp\i_ywrojeywto.exe
      C:\Temp\i_ywrojeywto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtnlgdywq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2120
  - - C:\Temp\bvtnlgdywq.exe
      C:\Temp\bvtnlgdywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3692
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6012
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtnlgdywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2860
  - - C:\Temp\i_bvtnlgdywq.exe
      C:\Temp\i_bvtnlgdywq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvtnligdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1296
  - - C:\Temp\yvtnligdxv.exe
      C:\Temp\yvtnligdxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2012
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3300
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvtnligdxv.exe ups_ins
    3⤵
    PID:824
  - - C:\Temp\i_yvtnligdxv.exe
      C:\Temp\i_yvtnligdxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idbvqnigdy.exe ups_run
    3⤵
    PID:6008
  - - C:\Temp\idbvqnigdy.exe
      C:\Temp\idbvqnigdy.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3652
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3208
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_idbvqnigdy.exe ups_ins
    3⤵
    PID:5940
  - - C:\Temp\i_idbvqnigdy.exe
      C:\Temp\i_idbvqnigdy.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faxsqkifax.exe ups_run
    3⤵
    PID:3232
  - - C:\Temp\faxsqkifax.exe
      C:\Temp\faxsqkifax.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4840
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4292
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faxsqkifax.exe ups_ins
    3⤵
    PID:4820
  - - C:\Temp\i_faxsqkifax.exe
      C:\Temp\i_faxsqkifax.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ausmkhfcxs.exe ups_run
    3⤵
    PID:3124
  - - C:\Temp\ausmkhfcxs.exe
      C:\Temp\ausmkhfcxs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4168
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2052
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ausmkhfcxs.exe ups_ins
    3⤵
    PID:5372
  - - C:\Temp\i_ausmkhfcxs.exe
      C:\Temp\i_ausmkhfcxs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czukeczurm.exe ups_run
    3⤵
    PID:256
  - - C:\Temp\czukeczurm.exe
      C:\Temp\czukeczurm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6060
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czukeczurm.exe ups_ins
    3⤵
    PID:5860
  - - C:\Temp\i_czukeczurm.exe
      C:\Temp\i_czukeczurm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xurmkeczxr.exe ups_run
    3⤵
    PID:5236
  - - C:\Temp\xurmkeczxr.exe
      C:\Temp\xurmkeczxr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5228
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3340
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xurmkeczxr.exe ups_ins
    3⤵
    PID:1192
  - - C:\Temp\i_xurmkeczxr.exe
      C:\Temp\i_xurmkeczxr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljebwtom.exe ups_run
    3⤵
    PID:952
  - - C:\Temp\trljebwtom.exe
      C:\Temp\trljebwtom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5496
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2444
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljebwtom.exe ups_ins
    3⤵
    PID:2988
  - - C:\Temp\i_trljebwtom.exe
      C:\Temp\i_trljebwtom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoljdbytqo.exe ups_run
    3⤵
    PID:5108
  - - C:\Temp\qoljdbytqo.exe
      C:\Temp\qoljdbytqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2984
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5768
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoljdbytqo.exe ups_ins
    3⤵
    PID:1500
  - - C:\Temp\i_qoljdbytqo.exe
      C:\Temp\i_qoljdbytqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdbytqlige.exe ups_run
    3⤵
    PID:468
  - - C:\Temp\gdbytqlige.exe
      C:\Temp\gdbytqlige.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5388
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2580
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdbytqlige.exe ups_ins
    3⤵
    PID:3048
  - - C:\Temp\i_gdbytqlige.exe
      C:\Temp\i_gdbytqlige.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igaytqlidb.exe ups_run
    3⤵
    PID:1232
  - - C:\Temp\igaytqlidb.exe
      C:\Temp\igaytqlidb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1736
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5412
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1204
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffe2265c188,0x7ffe2265c194,0x7ffe2265c1a0
      4⤵
      PID:2436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1960,i,9505166714904843992,11281418026010307995,524288 --field-trial-handle=2792,i,11310735361348492985,3822941796699912244,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:11
      4⤵
      System Time Discovery
      PID:5232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2256,i,1535121928366433732,100781398230094355,524288 --field-trial-handle=2792,i,11310735361348492985,3822941796699912244,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:13
      4⤵
      PID:5792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,15515471526194217599,12794871778127831789,262144 --field-trial-handle=2792,i,11310735361348492985,3822941796699912244,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:2
      4⤵
      PID:5644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,13901457680911775947,8786195036211191839,2097152 --field-trial-handle=2792,i,11310735361348492985,3822941796699912244,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:1284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,3174378125150663637,7552791033026979423,2097152 --field-trial-handle=2792,i,11310735361348492985,3822941796699912244,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:3868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,16884405640460897938,11809745547877761415,2097152 --field-trial-handle=2792,i,11310735361348492985,3822941796699912244,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:9
      4⤵
      PID:2088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,7127591825968685017,2874305925981430225,2097152 --field-trial-handle=2792,i,11310735361348492985,3822941796699912244,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:1
      4⤵
      PID:3468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3820,i,2901689912842676922,7689047325244356715,524288 --field-trial-handle=2792,i,11310735361348492985,3822941796699912244,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:14
      4⤵
      PID:4916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5352,i,6692422797878724965,3685232184050032327,524288 --field-trial-handle=2792,i,11310735361348492985,3822941796699912244,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
      4⤵
      PID:1632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5404,i,14853955969187698123,10621231021460854600,524288 --field-trial-handle=2792,i,11310735361348492985,3822941796699912244,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
      4⤵
      PID:4908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6104,i,6341686921041873800,4594180759906517170,524288 --field-trial-handle=2792,i,11310735361348492985,3822941796699912244,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:3232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6104,i,6341686921041873800,4594180759906517170,524288 --field-trial-handle=2792,i,11310735361348492985,3822941796699912244,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:2492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6348,i,16386296002648725559,8611965333044103650,524288 --field-trial-handle=2792,i,11310735361348492985,3822941796699912244,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
      4⤵
      PID:3040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6636,i,4627942285303996172,13230759202106342273,524288 --field-trial-handle=2792,i,11310735361348492985,3822941796699912244,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
      4⤵
      PID:3124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4600,i,5461232327781402415,7456677633119648649,524288 --field-trial-handle=2792,i,11310735361348492985,3822941796699912244,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:14
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5016,i,12816673944265178023,6990131636362884939,524288 --field-trial-handle=2792,i,11310735361348492985,3822941796699912244,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
      4⤵
      PID:468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5136,i,2666425592493417567,15500130799573398924,524288 --field-trial-handle=2792,i,11310735361348492985,3822941796699912244,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
      4⤵
      PID:5128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2032,i,17089308322170738976,10121459432105447662,524288 --field-trial-handle=2792,i,11310735361348492985,3822941796699912244,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:14
      4⤵
      PID:5128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6068,i,6766793096401681125,8641205752450506245,524288 --field-trial-handle=2792,i,11310735361348492985,3822941796699912244,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
      4⤵
      PID:1940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=932,i,6914565326468043607,18044884976159693062,524288 --field-trial-handle=2792,i,11310735361348492985,3822941796699912244,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
      4⤵
      PID:1372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5024,i,4534537293322714268,2184544625972522408,524288 --field-trial-handle=2792,i,11310735361348492985,3822941796699912244,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
      4⤵
      PID:5596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6192,i,15415694260135938952,5242995340763998953,262144 --field-trial-handle=2792,i,11310735361348492985,3822941796699912244,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:10
      4⤵
      PID:4684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5972,i,15359202457778960589,16914151721310218628,524288 --field-trial-handle=2792,i,11310735361348492985,3822941796699912244,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:14
      4⤵
      PID:3040

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5988

C:\Temp\ywqomgebztroigdb.sys
C:\Temp\ywqomgebztroigdb.sys
1⤵
- Executes dropped EXE
PID:6036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5796

C:\Temp\ywqoigaywq.sys
C:\Temp\ywqoigaywq.sys
1⤵
- Executes dropped EXE
PID:1880

C:\Temp\vtnlfdyvqn.sys
C:\Temp\vtnlfdyvqn.sys
1⤵
- Executes dropped EXE
PID:1232

C:\Temp\lfcavsqkif.sys
C:\Temp\lfcavsqkif.sys
1⤵
- Executes dropped EXE
PID:696

C:\Temp\kifaxspnhf.sys
C:\Temp\kifaxspnhf.sys
1⤵
- Executes dropped EXE
PID:4916

C:\Temp\cwupmkecxu.sys
C:\Temp\cwupmkecxu.sys
1⤵
- Executes dropped EXE
PID:4888

C:\Temp\eczxrpmkec.sys
C:\Temp\eczxrpmkec.sys
1⤵
- Executes dropped EXE
PID:3692

C:\Temp\kecwuomhez.sys
C:\Temp\kecwuomhez.sys
1⤵
- Executes dropped EXE
PID:1076

C:\Temp\geywuomjhb.sys
C:\Temp\geywuomjhb.sys
1⤵
- Executes dropped EXE
PID:5116

C:\Temp\bywqoigbyt.sys
C:\Temp\bywqoigbyt.sys
1⤵
- Executes dropped EXE
PID:5936

C:\Temp\jdaytqljdb.sys
C:\Temp\jdaytqljdb.sys
1⤵
- Executes dropped EXE
PID:4680

C:\Temp\gdyvtqniga.sys
C:\Temp\gdyvtqniga.sys
1⤵
PID:2024

C:\Temp\faxvpnifdx.sys
C:\Temp\faxvpnifdx.sys
1⤵
PID:1580

C:\Temp\khfspnhfzx.sys
C:\Temp\khfspnhfzx.sys
1⤵
PID:4388

C:\Temp\nkecxupnhf.sys
C:\Temp\nkecxupnhf.sys
1⤵
PID:468

C:\Temp\czurmjecwu.sys
C:\Temp\czurmjecwu.sys
1⤵
PID:2920

C:\Temp\romjecwuom.sys
C:\Temp\romjecwuom.sys
1⤵
PID:3756

C:\Temp\zwromjebom.sys
C:\Temp\zwromjebom.sys
1⤵
PID:2824

C:\Temp\ebvtqoigdb.sys
C:\Temp\ebvtqoigdb.sys
1⤵
PID:3768

C:\Temp\idbvtnlgdy.sys
C:\Temp\idbvtnlgdy.sys
1⤵
PID:4304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cwupmkecxu.sys

Path C:\Temp\cwupmkecxu.sys
Size 293KB
SHA256 4c7ec2925d98b983f37299c26f8dd15d88a5cea18004ef32937319b0ac887a37
MD5 804b012bcdc11ac5bc972013c28effbd
SHA1 3c00235dad7c6efb4d37ad4f3f10d7e6a3ebe0ff
SHA512 2832fc6d8a12d5f30486f9c4efec889b9186b4d1d41a2371da010064e1fa05fe3456780cef18f6261903ff538dcc18b1c331629616aa725d57bb8a4de9b5acf3
SSDEEP 3072:7tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:7IJjiJcbI03GBc3ucY5DCSj
TLSH
T128545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxupnkfcx.exe

Path C:\Temp\fdxupnkfcx.exe
Size 361KB
SHA256 e90f7c20af43f3110719a8283368f90a71cccc6c6888ca8bf42859cf2b1fe1ca
MD5 b5891ffad58e902ada47006d9c0164ea
SHA1 192de44c1b4775ae84236963a97356c50a6883e3
SHA512 2e7fa93604337a7f431aa805b890f15c077c1c1008688d00f32c9b7ad100260c65d1e5421cfafdb0bb839c37528ec7c888dbee35894b5b53bb1f968c6912a578
SSDEEP 6144:vflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:vflfAsiVGjSGecvX
TLSH
T170747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxupnkfcx.exe

Path C:\Temp\i_fdxupnkfcx.exe
Size 361KB
SHA256 9dc5b06f1bc906930353019bfc4721d6a31ef674bc306ed83c562ede35b2ada6
MD5 79efd572fac0d07bf93a9185ff263485
SHA1 ded687967e12a5965e203ae878d79ce2745b244f
SHA512 f4e5f45f6233293911a9b98343ca02c8ba1b8c0b9759bfa41f74469bc6b0aee938301ae858f342cd71898327cfb059e4ebb40046b790c8d6e8d484559a45a5de
SSDEEP 6144:TflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:TflfAsiVGjSGecvX
TLSH
T1BE747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kfdxvpnifa.exe

Path C:\Temp\i_kfdxvpnifa.exe
Size 361KB
SHA256 4501e709d8b9c998834a9d87b689ced486d94e69db9917dd7cf73e333293caba
MD5 72330f2a65890b9ad057601567a1e43f
SHA1 fc5f2c8803404cf0a47d984391741bdd2b2c10bb
SHA512 204d6731ca80865089dc653a79db359d5b5d073e70fe4f89439bfb179b031bc63f912eaf24005ff6a8f48008f21a48e1191611bd0b684bc86486824c42c2e2b2
SSDEEP 6144:rflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:rflfAsiVGjSGecvX
TLSH
T182747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdxvqnlfd.exe

Path C:\Temp\i_lfdxvqnlfd.exe
Size 361KB
SHA256 1d4e529e2dcc2e2ae028fca0f566cfbeec930c82271769f39bded4a61c582719
MD5 2aa5384bc530529840553ba066f055f8
SHA1 6fd718c19a5dec50df0e02e80e778c578ca3ddbe
SHA512 16d8c1f219b8f6a87f524d36b9a36a08dcd76b1e650638e896e56c84a3532e884e5260b4550dcad11c93e265c329820a70a86aaf97b037b9da174ed53ebad282
SSDEEP 6144:hflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:hflfAsiVGjSGecvX
TLSH
T12D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mgebvtomgy.exe

Path C:\Temp\i_mgebvtomgy.exe
Size 361KB
SHA256 d1da17ee4054dba4ad44a829f54d1d41c2769a46bd67b6119974b423ad1536b0
MD5 8ad45505de352e175b705a43caefbdba
SHA1 c1735f834fc7a9986c3f5a5a96bae54c05502748
SHA512 4904b731df3b816edde738c3a2bd15989069d338e17c8a58b8dc68fba6b06c62b97edac712452045db69917b4525a187d4615d22f0b60844571100445f075b9c
SSDEEP 6144:kflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:kflfAsiVGjSGecvX
TLSH
T155747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnlfdyvtql.exe

Path C:\Temp\i_tnlfdyvtql.exe
Size 361KB
SHA256 f778df6d6ed641473364ef882fc50814ceb017a32cc010ac4d3e2e2699ef4919
MD5 2a6250ae3b823f7e76249f1781520df4
SHA1 bc3a3900b65f0ffb4f0cc16328000ed96c6a2222
SHA512 f7ff57d0cd7cdf304d2792d5ee78d7fe1ae7ec0fa65f985887003f22622dc8db03e04310554137fcfa0ed99a986915dc9f2dd7624d95b585ff7a2f5b14c941f0
SSDEEP 6144:MflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:MflfAsiVGjSGecvX
TLSH
T1E8747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfdxvpnifa.exe

Path C:\Temp\kfdxvpnifa.exe
Size 361KB
SHA256 4cdb0e55bfeaaa585ec889fa600633b0a1775045cd063995cac3fe86a0084033
MD5 971a24608b25d2424c5352b693e03fca
SHA1 3dde5157a14d1e351e7ee5f628a0fee30e023ef0
SHA512 a665c26c9d763b71fe6da8b81ca32425f726c3b58f91b1c230fd9056d1e2dd0ca7086480569fbb23371c77e41d203e286f3cf6a8b0739cabf837d3b5706d1f13
SSDEEP 6144:4flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:4flfAsiVGjSGecvX
TLSH
T153747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kifaxspnhf.sys

Path C:\Temp\kifaxspnhf.sys
Size 293KB
SHA256 e5e823365f2dd16d4f944d5c518cfb611db9f4c4ce43047f5175cfb45afc2e0f
MD5 935c8474133c7a2bcc326e9b9a695e75
SHA1 9246501a8e5c41037cea483a8822dbcef9365f05
SHA512 25855ace0fde27a40b3e8de52689e43818716e97512a2bc360577289b1b2d026f45e9f4b70f84106a523d4f9d258af27fcd155d5751b984bd46be139836984a6
SSDEEP 3072:3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:3IJjiJcbI03GBc3ucY5DCSj
TLSH
T19B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfcavsqkif.sys

Path C:\Temp\lfcavsqkif.sys
Size 293KB
SHA256 6123814ef30c7193791764a62e4b0ed31174de7513837f9f3a13937a3aafa303
MD5 43ab90bb80b45b28de56734208569d66
SHA1 5772419b38d4a497289d7f92f62020f5f6e77377
SHA512 657dd0cbf9792890b21027ab995fac4d5aa551de5e905cc82f3c55dad2ddc173f339c93adf1a01b702b33647d6a3aa46544422ff6c043f05a1b0a35b44dd5aea
SSDEEP 3072:ktKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:kIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvqnlfd.exe

Path C:\Temp\lfdxvqnlfd.exe
Size 361KB
SHA256 80e1f1fe3c9a43a355eaa433e3d51bb14da7851eff6ed2a74ea9a444f773c2f7
MD5 4fc31320ba82f07da1ed6d312be7f932
SHA1 6945ad00b7b874ae59df43665d7afa3ff4350fb3
SHA512 18748930fd97976dee912073629b2b623cc8700d1a866e2a90c8d44310cb2c0abb3344fbe04abc761598a7e1dc2bfe1b460a7fbc1fc607193bfc3c5073caeacc
SSDEEP 6144:KflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:KflfAsiVGjSGecvX
TLSH
T11F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgebvtomgy.exe

Path C:\Temp\mgebvtomgy.exe
Size 361KB
SHA256 0f825ab1c140a407c8ad1a33fe3c88b33b5af82b4d073a48caa49c718d87fc15
MD5 a7f3c9fb0e41c97928cf78ff26af9df3
SHA1 fbeafa6146d9d18d6b5478ce8c6daacf1c5a1007
SHA512 d91e7d05d7b405703aad6bac178a79d0bd17fed50614f92cc007688281068c24c353ab8594406a65d017cecc1a18177f228edc57bb06231a62e42fb6e5d8d1cc
SSDEEP 6144:QflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:QflfAsiVGjSGecvX
TLSH
T169747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdyvtql.exe

Path C:\Temp\tnlfdyvtql.exe
Size 361KB
SHA256 c24c7080764a82bc13f5b21d1d9f9b1819b2716b10ca16d70ad7891efd255ae4
MD5 215154112fd6d08f159b8438ced69004
SHA1 4fb78f02bf1fce3f83ee5a07e794b533862e73bd
SHA512 ba536ee360e0a14ab9d8c767d2123e0e5d9286e90a8441e668903430057b177dae0da3b5a4c834f1fce49d4466a279fbebc78a7f253d100a71b44f7a83407bf6
SSDEEP 6144:7flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:7flfAsiVGjSGecvX
TLSH
T135747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdyvqn.sys

Path C:\Temp\vtnlfdyvqn.sys
Size 293KB
SHA256 3f408b2d5a9776fa0bae5a205738c3d75827023d8fcd648a977cac1605efb95f
MD5 f2aaeff08453e3b69645ad9043a0726b
SHA1 0d366088056e9d39f71f1e7408021053eeda99f6
SHA512 20ef8b52d777d67e0b7220c0efd650ef4b01f7ca9e1d27d2745a76900364565055534fd32097d22ca6beb958ee3ad5d3b4365ddbd1e4d2ba0a1f1932c1148647
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xupmhfzxup.exe

Path C:\Temp\xupmhfzxup.exe
Size 361KB
SHA256 0e7957f6845e9413e22d1f828b553753f70d3835621465feaa77bfe1d4c23dea
MD5 aec2d65250927d4886f2c7a7b99a1f9b
SHA1 4087d067fcc02d889d1be5f08275ff56894b4396
SHA512 99643e10dffe08b4b36beb393ac416e1b33584a4448c7c5b8f2b5317059fc49b40be1f46df8e500e70c2cb8216899b2486356434506966070fef775c1e087a16
SSDEEP 6144:bflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:bflfAsiVGjSGecvX
TLSH
T149747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqoigaywq.sys

Path C:\Temp\ywqoigaywq.sys
Size 293KB
SHA256 562f9809a59e526d34233f535d4c68c9eab1fa8469c2ef9385ba9e1cd18fa6ca
MD5 9280a3834bd1a7604330a7a8263c0bc2
SHA1 a1b1e79bb0ee49f66d52d84a6fdded2344fa48f9
SHA512 bab251f58b0ecef770823fc4adca100e64c1ecfc2ce1f63faea6d20d44388a4775a2e846466f78723503ca878f0d470509ff79389b2a6fdab922a465f710d41d
SSDEEP 3072:ztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:zIJjiJcbI03GBc3ucY5DCSj
TLSH
T176545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqomgebztroigdb.exe

Path C:\Temp\ywqomgebztroigdb.exe
Size 361KB
SHA256 08ad4c31ed1ec05a83b47094869dd04e4cfbb89ba7ce3d3bb1ba498ec4d33e37
MD5 8b4fb884d46a0da5e26c18d7f7a08789
SHA1 334785f5e74aaa375c7ba86d2e47bbff6ddae7ea
SHA512 bce6dd85b1c0490b99e7f7017bd4b701aedd80bb18d20132a9a396dd20d69b164a25c80ecbbf0f2eff78d6746884c410b0f1eb38f8d02470da6acf5cbc2ce4cf
SSDEEP 6144:hflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:hflfAsiVGjSGecvX
TLSH
T1FD747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqomgebztroigdb.sys

Path C:\Temp\ywqomgebztroigdb.sys
Size 293KB
SHA256 edc4572ea02f871406b5748a7d9077f9b07c131a07a4187122d535eb55ff14bf
MD5 07a6367f96df88be80413c0deec0e5df
SHA1 39e6dc582893f2357f2545ea74ffc87eeaaef0bb
SHA512 98b3d107e1999f33711ea2ca96c8ed8629174832c7636c8ef402b0c1afb336d512d9d52e7dd82e71cd76cb57d181beae9af4e88c3eb7fa15a2142645335ed0ff
SSDEEP 3072:btKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:bIJjiJcbI03GBc3ucY5DCSj
TLSH
T17D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 174576d263d17c1ded542f85fe22b729d39689265635c9c57a2bfd1af11bcb69
MD5 e54a3dd3758ae26f8eb9c7149476114c
SHA1 dd4159ecc029af9dd3da72970ac8bfa500a0651c
SHA512 eabda803f8f816ad2a6d57d3ce37f9c8cf72ef9a0a1ebecd6f39990ef65120d12a76e6ae5a2cb62c423511cbb36f0da6835b1dfa5907c5559c0ead5b0735873c
TLSH
T1E6D092757764A90CC9A5B0322CA7B29AA322A8300495860444E5F2A8CDB6A82567B5AE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2cfb77611c6372588cbb86850301c7d4d2a98bc9870148a0233cb9ff0ba848ae
MD5 30dd1402eab1adcd1b7a879da690d903
SHA1 5ad2617a2f54fb4647f217e450aa852cfab95912
SHA512 396e3e6a4f4d2b6cdab94a4fc9fcd07b5b3b76f067ce5666b89e9fb8d48b00e16fe2a2e9189c9d96e3f8d9d2f1a719132c8694f2859c94a22a5b7ecb4e74a3fc
TLSH
T1A3D02B343300650CC89070321C52B249532158300440420000D0B158CC7168102370AE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1532d35fad9b21f0cc2a221da2abdc6ad4eadd4827efa9fccd2133b29db26255
MD5 05b88257f88f98867ceb7354d53402fd
SHA1 93a40c6fe5a740f864f8c3d3f0e0f1647413d286
SHA512 8c56db5079adf28e5e2584ebdf2c949b5f25850e21a8cb720b329dcd2e29d9ef85496bf2d0a939bdf32f81bffc9f65623899717ecb343b68badc0c3b13010461
TLSH
T1136183D4AF9DE5D2C36A4C3051E8C0A5BE70C8793AC35E3E0B8CA179847FB82508381B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b656.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b656.TMP
Size 3KB
SHA256 840588c9c9cdb48c9092a49a79bcb21a307f2508c297590df189089d2d6f34b7
MD5 a1e1f542ef3da134ab864e50c49f7f39
SHA1 7291e830e0623c420a71e5ea8ec59600332efbcf
SHA512 0cfe5a2ed5ebf5286f3962afe0758ab5d092ecfabc9e0760c8430e09eeda69a18e9e8fa513273b90740f9bce53c5e994da3ad122e245643cc6e17bc77e77deaa
TLSH
T1C76185D4AF9DE5D2C36A4C3051E8C0A5BE30C8793AC35E3E0B8CA179847FB82508381B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 cc11adb9078e0df8052c409e8bbdfe657de76097fd8a6f14c6e11ca09ff692c7
MD5 37a1e9c40c51790fcd3b15abf015cfab
SHA1 615103765564ba1e39f1951dc9382a80a21adfe5
SHA512 2cffa1415be7354674b530412c7720c9defa7abf4a33c5cba09ea56e43fdc4d69ad8a51bdb53e9ac0d89e4f9936cd2f6c9b6df9d713882ed21bc396aa5b09679
TLSH
T1C051CEF3C3E8956D9A0146F4AA147E2BCE2D0914432C3C5AC9E4EF5B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7afa51fb4e681fef182306298e345f3ce6bfd10d6df53863ab80e206498ebee9
MD5 7be2763e53381c1039beb0ff38c30f98
SHA1 f55081ec5ba8be9b55b06683a92aaebabfc9f58a
SHA512 3cdba18d3749b6ce0a7f3cb147aa7a7cc8b04958e0518e20513ba0d018f7aff4945026a21427f808b8d5a8d9bb5aedfc670040e53d745e8fbff08cd82631358a
SSDEEP 192:sxRxRkyM/jK1Ml8wC3/fJ+slH1IMZdfzoA8p9a/g6+WNCHM/YtZIAl9WqKG3IgtJ:sxRxu83/fsslHmyd2U/5t/sikXN3
TLSH
T1A062FB156A3499379CDBD208FA557F93D2F81533A2941E48AAFCCB0C00E76ED621782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1dd528b46a843631a08dd35ea701b3aa645167b3e3179fb3c7779c2a633d44c9
MD5 46de6b10fb4047bb555efd775710100c
SHA1 ba75edb5c726a9ba657cb69349f87d681e8c8762
SHA512 d113eaad8e7f5a84d2e936db168d65e5bf3410f262aebad02454e0074b45548cbb532152ce7eff9adcd6a6fec13489a81a9e2d4eaabb2662797ba39985b22e47
SSDEEP 192:sxRCRkyM/jK1Ml8wC3/fJ+sGH1IMZdfzoA8p9a/g6+WNCHM/YtZIAl9WqKG3IgD5:sxRCu83/fssGHmyd2U/5t/sikXNN
TLSH
T1A262FB15AA3499379CDBD208FA557F93D2F80573A2941E48AAFCCB0C00E76DD621782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a478fc7ba4afd78e72385da33316ce72b42b3809f80c9eca300df17f59f71d85
MD5 690c3f6e1092f6538c8136266b1b26b3
SHA1 7fbcf21f40f0bc955bc4b500fbe6bde5c156d488
SHA512 3a280dd79022d64aa98aaebff0e40adf323b7ed8dd8125ee7d772325e4e4dea6358ea20002c82aac8ddaaa1c847cb124051060f01425a2e8b9c8efc1547301fc
SSDEEP 192:sxRCRkyM/jK1Ml8UQbC3/fJ+sGH1uMZdfzoA8pra/g6+WNCHM/YtZIkl9WqKG3I0:sxRCuqu3/fssGHQyd2G/5t/sioXN7
TLSH
T1C062E915AA3499379CDBD208FA517F93D2F84573A2941E48AAFCCB0C00E76DD621782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 0ac66e1e2e76b7e5322b22bb261b32be66ce67cdd20f285851db0718ed93cb02
MD5 521aa8342f98bcb9804d48b36c7de156
SHA1 8431b1ae4ed2c4690d2a1b83ee1c278a2d126f6d
SHA512 a7c2eca8cb9bfa66fa9a60329e3dea42527a89c09155e342505a32535d897393266ddba689943a5fc35e1362cf92a65673f284f6c271d7bdfa43364f955ed1e3
SSDEEP 768:dOwS1wBzwRbU7pLuL761wiWg1zwsfMZwK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPY:dOwS1wBzwRbYE761wiWg1zwsfMZwKu1e
TLSH
T18BE2EB3B684CCB7F4F804A9CAC297E9B6DE801CF56D8895447FA880C03C66EB551B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

43b90cdb-b8bc-4af9-a177-8803fed68eef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\43b90cdb-b8bc-4af9-a177-8803fed68eef.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 34a095b82b1a921b88de1903f6d6837865b6268a7e3e43d402e2afc6eaab5e77
MD5 0a6a452ff7098caae4772357f9c93f35
SHA1 7b9ec62de605e32d9080db55e72f7f866cffd614
SHA512 8067595cb12654772515df8ca461a2ec657928289c9b444abf0c7138c866076a547b711451a0d80c473d438382094dadbad0d98f001e070deb466b93b8f77f11
SSDEEP 384:nAHtNn/s3n9Si38NB7BKqvKiEtP6z2fppPOuafm1Dvuh3n39WoBtAdEF7jgHKX3E:AHj+993EOy4hOsu37BtAwjUSzFIb9MM3
TLSH
T1C1F2BF31AC418E639CE78299B26A2BC3DFF0517785C92F94D9E96F0D04C726C174B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ea92ed857c973b57620cc539e19969334bf3aa0d95aaf6adab3b84a7e40fa275
MD5 cafe8c146cfa3047063549f2e80c3e5c
SHA1 7dd563983330491174b5511938f2a00c41fbf330
SHA512 f3445c8235ef6962f593488cb3e751c3359ecc39a91ca6181958fc303dd63f54f1df63524008094fad1efb785c2474ec38dd6488048e443c73be52b33a75855d
SSDEEP 768:p6rv+4UNbdH3I6y4hORu37BtAwjUSzFIn:p6bsb53Iz4uuoTtn
TLSH
T12303BF31E8589D739CF79289F25A2B83AFB4506388C51F94D8E92B0D458B1AD270FD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ba3c1aa70bbefff965965634cd1ba8e43d75fb9e55dc3f590cd3a6957a082db5
MD5 26cb805ed0424da59cf29a8a25d793d8
SHA1 6a9baa8fefb943d2c65af7bad0ef0d8a4aaba368
SHA512 09f8e3f7cd0c9b7556d09bc0b8bcc21ee2fd14e006eaa571cd94afe019761d201402ae23e477c76e23489f94b2271c554d9648dbc9344c31e9ad8be70ab0f8fd
SSDEEP 384:npHtNn/s3n9Si38NBmBKqvKiEtP6z2fppPOuafm1Dvuh3n39WoBtAdEF7jgHKX3E:pHj+993JOy4hOsu37BtAwjUSzFIb9MM3
TLSH
T189F2BF31AC418E639CE78299B26A2FC3DFF0517785C92F84D9E96B0D04C326C174B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 78cd8002da8ce7ad2807b99b504f54d0c1ee14eb704d8c9aff9963d0e877f09c
MD5 018a22a411e090b39c8566beac00b690
SHA1 2233b534e0d5a7f0b45934b3c62f61c566d92e32
SHA512 a82afbee0ddf34e04c8f17a2c49af025983b8a4670068d9af4f4f457d3e298d3bd8a2a2a6e3b0733674bda4e05f25f33d0a77fd8c543ed011879bc55ecd23ede
SSDEEP 768:CIrv+4UNbdX3UoHf4hOpu37BtAwjUSzZNUikB+:CIbsbR3UUf4EuoTIUJI
TLSH
T10303CF3298548937DCF7D289B25B2B43AFB4506385C91F94C8ED2B0D828B16D234BE77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 44a5c420d57c2a1b77b6d8084c17f1e7efcc0df595b04540af5e1b80855a05bc
MD5 7da98c4177eeb22eb1106a6585ef2b2c
SHA1 c8cc5c570c4d4febf4f07f1aeaf1e26eac0e51a3
SHA512 70a941e3977b2080ea2f2678d77301efa7bf21dbcab4ecf887114bfe7587edd13b6cb68a40258f5a874268f68f0ed6f35f5fe4571b2282e8e06d3df5b717ceaf
SSDEEP 768:YDF1j+9S3UwgPE2cO6u37BtAwjUSzFIb9MM3:YS9S3GiuoTtb+M3
TLSH
T12B1318F598C38977D8AE4787A33D2E869EBCC163B5885984B7D51E0CCC831BFD606816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

b4877117-e23d-4adb-ac4d-1a3b049e22e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b4877117-e23d-4adb-ac4d-1a3b049e22e2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4216_1168602880\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 3c1fc969b0c45c66048171fbba2c1787109f2dfa6e5c875a75e364457481341d
MD5 10692f2510ef07d1623ed68126933d03
SHA1 a448842d180b229aeb0049df3b01e8d5ee82d351
SHA512 0498f300a6808d0d8c49958446f5d235bbe3c6cdb5b23cccf7e593cb2f6f2fabd96109061d3b19d39dcab97d39e4aa967877059ef57c937ffafdb6f32fae80ab
TLSH
T15171274357A8D5B3C1DE9BF003835204F5FB227C472370244BA15946A730A7964B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/468-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/696-268-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1076-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1232-240-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1580-405-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1880-193-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2024-385-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2824-465-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2920-439-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3692-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3756-467-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3756-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3768-478-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4304-495-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4388-417-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4680-372-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4888-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4888-295-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4916-280-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5116-339-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5936-374-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5936-343-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6036-63-0x0000000000010000-0x00000000000AB000-memory.dmp

Download