systex | a656d6bafb6a05ff70ab340f4ba76c960813be5d245839ac5dd2adb18f42f8df

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260709-twddlset2v
SHA256 a656d6bafb6a05ff70ab340f4ba76c960813be5d245839ac5dd2adb18f42f8df
MD5 d2dc619abb41f7abdd1393bbcee4b9ce
SHA1 c128859dadbcd10ea5fbb59a5da94e52bfd95e54
SHA512 bc10fdef0ea42887fd96a074e74bad73dcfbb88956b2fdd8704d2f7fe3253d19005558a053cafe2d76aa8c0359a0f67d8a12c8ac9de74a29972a1410247e9cf3
SSDEEP 6144:SflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:SflfAsiVGjSGecvX
TLSH
T12A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4232	qljdbvtnlgdyvqni.exe
5084	qljdbvtnlgdyvqni.sys
3984	CreateProcess.exe
4420	qoigdytnla.exe
3184	CreateProcess.exe
2156	CreateProcess.exe
4704	i_qoigdytnla.exe
2164	vpnkidaysq.sys
976	CreateProcess.exe
3876	nifaxsqkid.exe
5792	CreateProcess.exe
2188	CreateProcess.exe
2092	i_nifaxsqkid.exe
5268	hfdxusnkfc.sys
3960	CreateProcess.exe
5664	cxvpnhfaxs.exe
1608	CreateProcess.exe
2516	CreateProcess.exe
3160	i_cxvpnhfaxs.exe
5020	kfcxupmhfc.sys
988	CreateProcess.exe
432	khczxupmke.exe
1196	CreateProcess.exe
5260	CreateProcess.exe
3440	i_khczxupmke.exe
2420	keczusmker.sys
3296	CreateProcess.exe
960	cwupmhezur.exe
5640	CreateProcess.exe
3792	CreateProcess.exe
200	i_cwupmhezur.exe
5940	trmgeczxro.sys
420	CreateProcess.exe
5004	rpmgecztjg.exe
1480	CreateProcess.exe
5312	CreateProcess.exe
2808	i_rpmgecztjg.exe
6108	wtrojgebwt.sys
2528	CreateProcess.exe
5788	ztrojgbztr.exe
1276	CreateProcess.exe
1184	CreateProcess.exe
5020	i_ztrojgbztr.exe
2248	qligbyvtnl.sys
5352	CreateProcess.exe
1236	rligdywqli.exe
1408	CreateProcess.exe
3000	CreateProcess.exe
1284	i_rligdywqli.exe
6084	ykidavsqli.sys
1136	CreateProcess.exe
2040	igaysqlida.exe
5424	CreateProcess.exe
5292	CreateProcess.exe
4092	i_igaysqlida.exe
2652	idbvtnlfdx.sys
5680	CreateProcess.exe
5060	snkifaxsqk.exe
5616	CreateProcess.exe
3068	CreateProcess.exe
4644	i_snkifaxsqk.exe
1308	axsqkicaus.sys
4292	CreateProcess.exe
956	axspnhfaxs.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6048_1820802831\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6048_1820802831\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6048_1132491296\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6048_1132491296\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6048_151707363\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6048_151707363\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6048_1820802831\llm_user_input_extractor_config.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6048_1834802204\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6048_1820802831\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khczxupmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rligdywqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rligdywqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxupmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztromjdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdyvtnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigdytnla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifaxsqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvpnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwupmhezur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmgecztjg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axspnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnifdxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaxsqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axspnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igbywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvpnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmgecztjg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czuspnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhczurmcwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqlidbyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnifdxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljdbvtnlgdyvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigdytnla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysqlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkifaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxupmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igbywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdyvtnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khczxupmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwupmhezur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czuspnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhczurmcwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqlidbyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkifaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztromjdb.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5472	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1724	ipconfig.exe
4592	ipconfig.exe
1376	ipconfig.exe
5528	ipconfig.exe
6052	ipconfig.exe
6008	ipconfig.exe
5268	ipconfig.exe
3388	ipconfig.exe
4976	ipconfig.exe
3012	ipconfig.exe
3276	ipconfig.exe
2908	ipconfig.exe
1144	ipconfig.exe
3808	ipconfig.exe
6024	ipconfig.exe
5552	ipconfig.exe
2324	ipconfig.exe
3276	ipconfig.exe
2504	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{80FCC414-0B82-4327-B2A5-E0535AE8FBAE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4232	qljdbvtnlgdyvqni.exe
4232	qljdbvtnlgdyvqni.exe
4232	qljdbvtnlgdyvqni.exe
4232	qljdbvtnlgdyvqni.exe
4232	qljdbvtnlgdyvqni.exe
4232	qljdbvtnlgdyvqni.exe
4232	qljdbvtnlgdyvqni.exe
4232	qljdbvtnlgdyvqni.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
6048	msedge.exe
6048	msedge.exe
6048	msedge.exe
6048	msedge.exe
6048	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4704	i_qoigdytnla.exe
Token: SeDebugPrivilege	2092	i_nifaxsqkid.exe
Token: SeDebugPrivilege	3160	i_cxvpnhfaxs.exe
Token: SeDebugPrivilege	3440	i_khczxupmke.exe
Token: SeDebugPrivilege	200	i_cwupmhezur.exe
Token: SeDebugPrivilege	2808	i_rpmgecztjg.exe
Token: SeDebugPrivilege	5020	i_ztrojgbztr.exe
Token: SeDebugPrivilege	1284	i_rligdywqli.exe
Token: SeDebugPrivilege	4092	i_igaysqlida.exe
Token: SeDebugPrivilege	4644	i_snkifaxsqk.exe
Token: SeDebugPrivilege	2196	i_axspnhfaxs.exe
Token: SeDebugPrivilege	3156	i_czuspnkfcx.exe
Token: SeDebugPrivilege	2836	i_zxupmhfzxr.exe
Token: SeDebugPrivilege	3952	i_jhczurmcwu.exe
Token: SeDebugPrivilege	3092	i_hbztromjdb.exe
Token: SeDebugPrivilege	3220	i_igbywqoigb.exe
Token: SeDebugPrivilege	4680	i_ysqlidbyvq.exe
Token: SeDebugPrivilege	3228	i_gdyvtnigay.exe
Token: SeDebugPrivilege	3544	i_vpnifdxsqk.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6048	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 4232	3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	85
PID 3448 wrote to memory of 4400	3448	2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	86
PID 4400 wrote to memory of 6048	4400	iexplore.exe	87
PID 6048 wrote to memory of 1108	6048	msedge.exe	88
PID 6048 wrote to memory of 3940	6048	msedge.exe	89
PID 6048 wrote to memory of 5472	6048	msedge.exe	91
PID 6048 wrote to memory of 3940	6048	msedge.exe	89
PID 6048 wrote to memory of 3940	6048	msedge.exe	89
PID 6048 wrote to memory of 5360	6048	msedge.exe	92
PID 6048 wrote to memory of 5360	6048	msedge.exe	92
PID 6048 wrote to memory of 3564	6048	msedge.exe	93
PID 6048 wrote to memory of 3432	6048	msedge.exe	94
PID 6048 wrote to memory of 3564	6048	msedge.exe	93
PID 6048 wrote to memory of 3564	6048	msedge.exe	93
PID 6048 wrote to memory of 3432	6048	msedge.exe	94
PID 6048 wrote to memory of 3432	6048	msedge.exe	94
PID 6048 wrote to memory of 6128	6048	msedge.exe	95
PID 6048 wrote to memory of 6128	6048	msedge.exe	95
PID 6048 wrote to memory of 6128	6048	msedge.exe	95
PID 6048 wrote to memory of 2072	6048	msedge.exe	96
PID 6048 wrote to memory of 2072	6048	msedge.exe	96
PID 6048 wrote to memory of 2072	6048	msedge.exe	96
PID 6048 wrote to memory of 5884	6048	msedge.exe	98
PID 6048 wrote to memory of 5884	6048	msedge.exe	98
PID 4232 wrote to memory of 3984	4232	qljdbvtnlgdyvqni.exe	101
PID 6048 wrote to memory of 4932	6048	msedge.exe	103
PID 6048 wrote to memory of 4932	6048	msedge.exe	103
PID 6048 wrote to memory of 4260	6048	msedge.exe	104
PID 6048 wrote to memory of 4260	6048	msedge.exe	104
PID 4420 wrote to memory of 3184	4420	qoigdytnla.exe	107
PID 6048 wrote to memory of 2872	6048	msedge.exe	108
PID 6048 wrote to memory of 2196	6048	msedge.exe	111
PID 6048 wrote to memory of 2196	6048	msedge.exe	111
PID 6048 wrote to memory of 5976	6048	msedge.exe	114
PID 6048 wrote to memory of 5976	6048	msedge.exe	114
PID 4232 wrote to memory of 2156	4232	qljdbvtnlgdyvqni.exe	116
PID 4232 wrote to memory of 976	4232	qljdbvtnlgdyvqni.exe	120
PID 3876 wrote to memory of 5792	3876	nifaxsqkid.exe	122
PID 4232 wrote to memory of 2188	4232	qljdbvtnlgdyvqni.exe	125
PID 4232 wrote to memory of 3960	4232	qljdbvtnlgdyvqni.exe	129
PID 5664 wrote to memory of 1608	5664	cxvpnhfaxs.exe	131
PID 4232 wrote to memory of 2516	4232	qljdbvtnlgdyvqni.exe	134
PID 4232 wrote to memory of 988	4232	qljdbvtnlgdyvqni.exe	138
PID 432 wrote to memory of 1196	432	khczxupmke.exe	140
PID 4232 wrote to memory of 5260	4232	qljdbvtnlgdyvqni.exe	143
PID 6048 wrote to memory of 3564	6048	msedge.exe	145
PID 6048 wrote to memory of 3444	6048	msedge.exe	146
PID 6048 wrote to memory of 2272	6048	msedge.exe	147
PID 4232 wrote to memory of 3296	4232	qljdbvtnlgdyvqni.exe	150
PID 960 wrote to memory of 5640	960	cwupmhezur.exe	152
PID 4232 wrote to memory of 3792	4232	qljdbvtnlgdyvqni.exe	155
PID 4232 wrote to memory of 420	4232	qljdbvtnlgdyvqni.exe	159
PID 5004 wrote to memory of 1480	5004	rpmgecztjg.exe	161
PID 4232 wrote to memory of 5312	4232	qljdbvtnlgdyvqni.exe	164
PID 4232 wrote to memory of 2528	4232	qljdbvtnlgdyvqni.exe	168
PID 5788 wrote to memory of 1276	5788	ztrojgbztr.exe	170
PID 4232 wrote to memory of 1184	4232	qljdbvtnlgdyvqni.exe	173
PID 4232 wrote to memory of 5352	4232	qljdbvtnlgdyvqni.exe	177
PID 1236 wrote to memory of 1408	1236	rligdywqli.exe	179
PID 6048 wrote to memory of 3272	6048	msedge.exe	182
PID 6048 wrote to memory of 3272	6048	msedge.exe	182
PID 4232 wrote to memory of 3000	4232	qljdbvtnlgdyvqni.exe	183
PID 4232 wrote to memory of 1136	4232	qljdbvtnlgdyvqni.exe	190
PID 2040 wrote to memory of 5424	2040	igaysqlida.exe	192

C:\Users\Admin\AppData\Local\Temp\2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_d2dc619abb41f7abdd1393bbcee4b9ce_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Temp\qljdbvtnlgdyvqni.exe
  C:\Temp\qljdbvtnlgdyvqni.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigdytnla.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3984
  - - C:\Temp\qoigdytnla.exe
      C:\Temp\qoigdytnla.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3184
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6008
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigdytnla.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2156
  - - C:\Temp\i_qoigdytnla.exe
      C:\Temp\i_qoigdytnla.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nifaxsqkid.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:976
  - - C:\Temp\nifaxsqkid.exe
      C:\Temp\nifaxsqkid.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3876
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5792
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nifaxsqkid.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2188
  - - C:\Temp\i_nifaxsqkid.exe
      C:\Temp\i_nifaxsqkid.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxvpnhfaxs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3960
  - - C:\Temp\cxvpnhfaxs.exe
      C:\Temp\cxvpnhfaxs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5664
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1608
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxvpnhfaxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2516
  - - C:\Temp\i_cxvpnhfaxs.exe
      C:\Temp\i_cxvpnhfaxs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khczxupmke.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:988
  - - C:\Temp\khczxupmke.exe
      C:\Temp\khczxupmke.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:432
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1196
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khczxupmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5260
  - - C:\Temp\i_khczxupmke.exe
      C:\Temp\i_khczxupmke.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwupmhezur.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3296
  - - C:\Temp\cwupmhezur.exe
      C:\Temp\cwupmhezur.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5640
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwupmhezur.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3792
  - - C:\Temp\i_cwupmhezur.exe
      C:\Temp\i_cwupmhezur.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpmgecztjg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:420
  - - C:\Temp\rpmgecztjg.exe
      C:\Temp\rpmgecztjg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5004
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1480
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpmgecztjg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5312
  - - C:\Temp\i_rpmgecztjg.exe
      C:\Temp\i_rpmgecztjg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrojgbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2528
  - - C:\Temp\ztrojgbztr.exe
      C:\Temp\ztrojgbztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5788
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1276
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3388
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrojgbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1184
  - - C:\Temp\i_ztrojgbztr.exe
      C:\Temp\i_ztrojgbztr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rligdywqli.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5352
  - - C:\Temp\rligdywqli.exe
      C:\Temp\rligdywqli.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1236
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rligdywqli.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3000
  - - C:\Temp\i_rligdywqli.exe
      C:\Temp\i_rligdywqli.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igaysqlida.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1136
  - - C:\Temp\igaysqlida.exe
      C:\Temp\igaysqlida.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2040
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5424
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igaysqlida.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5292
  - - C:\Temp\i_igaysqlida.exe
      C:\Temp\i_igaysqlida.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snkifaxsqk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5680
  - - C:\Temp\snkifaxsqk.exe
      C:\Temp\snkifaxsqk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5060
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5616
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snkifaxsqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3068
  - - C:\Temp\i_snkifaxsqk.exe
      C:\Temp\i_snkifaxsqk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axspnhfaxs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4292
  - - C:\Temp\axspnhfaxs.exe
      C:\Temp\axspnhfaxs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:956
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1160
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axspnhfaxs.exe ups_ins
    3⤵
    PID:5652
  - - C:\Temp\i_axspnhfaxs.exe
      C:\Temp\i_axspnhfaxs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czuspnkfcx.exe ups_run
    3⤵
    PID:2440
  - - C:\Temp\czuspnkfcx.exe
      C:\Temp\czuspnkfcx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1576
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1300
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czuspnkfcx.exe ups_ins
    3⤵
    PID:5068
  - - C:\Temp\i_czuspnkfcx.exe
      C:\Temp\i_czuspnkfcx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxupmhfzxr.exe ups_run
    3⤵
    PID:5916
  - - C:\Temp\zxupmhfzxr.exe
      C:\Temp\zxupmhfzxr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3224
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3500
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxupmhfzxr.exe ups_ins
    3⤵
    PID:3128
  - - C:\Temp\i_zxupmhfzxr.exe
      C:\Temp\i_zxupmhfzxr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhczurmcwu.exe ups_run
    3⤵
    PID:2016
  - - C:\Temp\jhczurmcwu.exe
      C:\Temp\jhczurmcwu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6108
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhczurmcwu.exe ups_ins
    3⤵
    PID:240
  - - C:\Temp\i_jhczurmcwu.exe
      C:\Temp\i_jhczurmcwu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbztromjdb.exe ups_run
    3⤵
    PID:1504
  - - C:\Temp\hbztromjdb.exe
      C:\Temp\hbztromjdb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5000
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3828
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbztromjdb.exe ups_ins
    3⤵
    PID:1744
  - - C:\Temp\i_hbztromjdb.exe
      C:\Temp\i_hbztromjdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igbywqoigb.exe ups_run
    3⤵
    PID:3932
  - - C:\Temp\igbywqoigb.exe
      C:\Temp\igbywqoigb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3276
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4600
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3012
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igbywqoigb.exe ups_ins
    3⤵
    PID:3808
  - - C:\Temp\i_igbywqoigb.exe
      C:\Temp\i_igbywqoigb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqlidbyvq.exe ups_run
    3⤵
    PID:1456
  - - C:\Temp\ysqlidbyvq.exe
      C:\Temp\ysqlidbyvq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5336
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4116
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqlidbyvq.exe ups_ins
    3⤵
    PID:2808
  - - C:\Temp\i_ysqlidbyvq.exe
      C:\Temp\i_ysqlidbyvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdyvtnigay.exe ups_run
    3⤵
    PID:3952
  - - C:\Temp\gdyvtnigay.exe
      C:\Temp\gdyvtnigay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3492
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5856
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdyvtnigay.exe ups_ins
    3⤵
    PID:3144
  - - C:\Temp\i_gdyvtnigay.exe
      C:\Temp\i_gdyvtnigay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnifdxsqk.exe ups_run
    3⤵
    PID:3444
  - - C:\Temp\vpnifdxsqk.exe
      C:\Temp\vpnifdxsqk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3400
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4772
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnifdxsqk.exe ups_ins
    3⤵
    PID:3428
  - - C:\Temp\i_vpnifdxsqk.exe
      C:\Temp\i_vpnifdxsqk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3544
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffbd592c188,0x7ffbd592c194,0x7ffbd592c1a0
      4⤵
      PID:1108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,1207939167521213018,12112424811215473367,262144 --field-trial-handle=2244,i,14548035382502887093,5470226010185988174,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
      4⤵
      PID:3940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,10816056319190015217,8552058367317137641,524288 --field-trial-handle=2244,i,14548035382502887093,5470226010185988174,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:11
      4⤵
      System Time Discovery
      PID:5472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,13617896019660953782,5132787190541005875,524288 --field-trial-handle=2244,i,14548035382502887093,5470226010185988174,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:13
      4⤵
      PID:5360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,1527922561151309189,7966438097639004324,2097152 --field-trial-handle=2244,i,14548035382502887093,5470226010185988174,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,8880126134746579194,3620968048176805921,2097152 --field-trial-handle=2244,i,14548035382502887093,5470226010185988174,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:3432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,12429500746224438788,1972633053064161184,2097152 --field-trial-handle=2244,i,14548035382502887093,5470226010185988174,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:1
      4⤵
      PID:6128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,8657595566920003072,6066082970115019605,2097152 --field-trial-handle=2244,i,14548035382502887093,5470226010185988174,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:9
      4⤵
      PID:2072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,422518858625875714,1363539235118315157,524288 --field-trial-handle=2244,i,14548035382502887093,5470226010185988174,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
      4⤵
      PID:5884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,2758087734868926420,5952242727189108437,524288 --field-trial-handle=2244,i,14548035382502887093,5470226010185988174,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
      4⤵
      PID:4932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,9285908165569439119,16001184088003396715,524288 --field-trial-handle=2244,i,14548035382502887093,5470226010185988174,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
      4⤵
      PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,9076342161941158974,2359602229340106272,524288 --field-trial-handle=2244,i,14548035382502887093,5470226010185988174,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
      4⤵
      PID:6096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,9076342161941158974,2359602229340106272,524288 --field-trial-handle=2244,i,14548035382502887093,5470226010185988174,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
      4⤵
      PID:2872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,1559970763033404820,14236343773129730293,524288 --field-trial-handle=2244,i,14548035382502887093,5470226010185988174,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
      4⤵
      PID:2196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,11317423876148115336,2124744648759168539,524288 --field-trial-handle=2244,i,14548035382502887093,5470226010185988174,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
      4⤵
      PID:5976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,17060827833394260263,6699892790573250161,524288 --field-trial-handle=2244,i,14548035382502887093,5470226010185988174,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
      4⤵
      PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,16492721319419510607,7433445931325196677,524288 --field-trial-handle=2244,i,14548035382502887093,5470226010185988174,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
      4⤵
      PID:3444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,1762141588158758541,5890833772737258169,524288 --field-trial-handle=2244,i,14548035382502887093,5470226010185988174,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
      4⤵
      PID:2272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,15750364139410040889,3198460846061730757,524288 --field-trial-handle=2244,i,14548035382502887093,5470226010185988174,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
      4⤵
      PID:3272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,17917240985117871248,1050944693632140097,524288 --field-trial-handle=2244,i,14548035382502887093,5470226010185988174,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
      4⤵
      PID:2580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,3263186399249117507,6808508252968053741,524288 --field-trial-handle=2244,i,14548035382502887093,5470226010185988174,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:14
      4⤵
      PID:3816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,15788569151802165236,4450807037454476302,524288 --field-trial-handle=2244,i,14548035382502887093,5470226010185988174,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
      4⤵
      PID:4504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5792,i,14275498834500174262,10099368703393827601,262144 --field-trial-handle=2244,i,14548035382502887093,5470226010185988174,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:10
      4⤵
      PID:3156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,8152176466531713662,10513587425326855454,524288 --field-trial-handle=2244,i,14548035382502887093,5470226010185988174,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:14
      4⤵
      PID:4276

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5708

C:\Temp\qljdbvtnlgdyvqni.sys
C:\Temp\qljdbvtnlgdyvqni.sys
1⤵
- Executes dropped EXE
PID:5084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4564

C:\Temp\vpnkidaysq.sys
C:\Temp\vpnkidaysq.sys
1⤵
- Executes dropped EXE
PID:2164

C:\Temp\hfdxusnkfc.sys
C:\Temp\hfdxusnkfc.sys
1⤵
- Executes dropped EXE
PID:5268

C:\Temp\kfcxupmhfc.sys
C:\Temp\kfcxupmhfc.sys
1⤵
- Executes dropped EXE
PID:5020

C:\Temp\keczusmker.sys
C:\Temp\keczusmker.sys
1⤵
- Executes dropped EXE
PID:2420

C:\Temp\trmgeczxro.sys
C:\Temp\trmgeczxro.sys
1⤵
- Executes dropped EXE
PID:5940

C:\Temp\wtrojgebwt.sys
C:\Temp\wtrojgebwt.sys
1⤵
- Executes dropped EXE
PID:6108

C:\Temp\qligbyvtnl.sys
C:\Temp\qligbyvtnl.sys
1⤵
- Executes dropped EXE
PID:2248

C:\Temp\ykidavsqli.sys
C:\Temp\ykidavsqli.sys
1⤵
- Executes dropped EXE
PID:6084

C:\Temp\idbvtnlfdx.sys
C:\Temp\idbvtnlfdx.sys
1⤵
- Executes dropped EXE
PID:2652

C:\Temp\axsqkicaus.sys
C:\Temp\axsqkicaus.sys
1⤵
- Executes dropped EXE
PID:1308

C:\Temp\hcaurpkeca.sys
C:\Temp\hcaurpkeca.sys
1⤵
PID:1588

C:\Temp\hfzxjhecwu.sys
C:\Temp\hfzxjhecwu.sys
1⤵
PID:2264

C:\Temp\jhbzurmjec.sys
C:\Temp\jhbzurmjec.sys
1⤵
PID:496

C:\Temp\geywurljhe.sys
C:\Temp\geywurljhe.sys
1⤵
PID:1308

C:\Temp\ojgbywqoig.sys
C:\Temp\ojgbywqoig.sys
1⤵
PID:5036

C:\Temp\olgdytqljd.sys
C:\Temp\olgdytqljd.sys
1⤵
PID:3772

C:\Temp\daysqolfdy.sys
C:\Temp\daysqolfdy.sys
1⤵
PID:5908

C:\Temp\xspnifaysq.sys
C:\Temp\xspnifaysq.sys
1⤵
PID:1860

C:\Temp\qkicaxspnh.sys
C:\Temp\qkicaxspnh.sys
1⤵
PID:3692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cwupmhezur.exe

Path C:\Temp\cwupmhezur.exe
Size 361KB
SHA256 28c70741acdd0cf50df3b0c9148a864caacfe6f5e42e3df2732cf6e98053a544
MD5 1aa6c9743e1c6499c21280ca607aa603
SHA1 5e54e2ac6a44dcbb3d2bf100a20832fd2a4f0d05
SHA512 3d8f256ce952d295807ad97d187d525d2baae239c854ce3783874e874c242fba8d7518441434034aaa851690a493842b02d4ab5ce97d4e97daf00238fc2dd355
SSDEEP 6144:oflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:oflfAsiVGjSGecvX
TLSH
T1D1747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxvpnhfaxs.exe

Path C:\Temp\cxvpnhfaxs.exe
Size 361KB
SHA256 d894162085917fba53c4414719614da7336d9d8a804e75b16c8a9ef8d5fa44d5
MD5 ad04e23b5675cda43d33d831b299a0e7
SHA1 84913ae453614bcdb3ab1e904b0b5aff9dee046a
SHA512 5bc5833c750fe91ef1c53532105efaec10186892438e5bfbe9874a4fb9e11e9bcbc180a03caf85b7a17029f60ad44f045f6028ac93f645558fcfcc109542e69e
SSDEEP 6144:uflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:uflfAsiVGjSGecvX
TLSH
T18C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfdxusnkfc.sys

Path C:\Temp\hfdxusnkfc.sys
Size 293KB
SHA256 1be75a5912c26fc006d3dbdde2a1c3df89f75b829b1ba06948ccae71a840aacb
MD5 dc7bb828e95de83367d4a64a21e79a64
SHA1 7634bcbed47976f02dd2dbd72bd827d26c5bc621
SHA512 c0a5594204d0526c767de0a1db60c71e834da8b5f4bfa1e41a382fd361a2150951cb4ede322f43a8d09b94ef082ad3c884667920cee8e45cb47901a28305c9a2
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cwupmhezur.exe

Path C:\Temp\i_cwupmhezur.exe
Size 361KB
SHA256 8c6d3fa2a6ca1c03c0ff52c27ba5d82fb3bd59d9d7110b153491a7e80617b886
MD5 a29ca623fa5b99a45eba690b7141b4d8
SHA1 f87eab71eb6276002377e703b0f33d6bd6ddfbae
SHA512 21ba1c748e8fef520e2cd0000dbe69534fad5fa5e876fb5a589bd006cdc8a2ccdfc4ce709c280130a3cc351f1178a3619002349d5d3fc635455003675edfe576
SSDEEP 6144:+flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:+flfAsiVGjSGecvX
TLSH
T1FF747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cxvpnhfaxs.exe

Path C:\Temp\i_cxvpnhfaxs.exe
Size 361KB
SHA256 c016e93325a8e3df0f953a59229c42c1014f8549a5778170a2b650e7607a528a
MD5 e6710bf61c98877b38f955cbad72d21a
SHA1 7945cced0f6b1d9a8a614369f48efc6faca83b64
SHA512 bfd6f07acf06f36d16b92b526c0efac9155d3d094bef4c6df3002c5ee735c051549154530b6a3a8fbbeb1eef280d9952aaa25fd3718d1db96479db4903873958
SSDEEP 6144:GflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:GflfAsiVGjSGecvX
TLSH
T13B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_khczxupmke.exe

Path C:\Temp\i_khczxupmke.exe
Size 361KB
SHA256 f04d7873484fe80d640aa667568225815a8eb1c59969159a6562f0c0a3952a19
MD5 182a812708db2c284c7d0787068e1a29
SHA1 929137db1ef1fd1f25f9c6ee1b09075fe4795c91
SHA512 d8fd053c02e5b31946376cb1afcb44a14eba891e60523c9174b92885ce70cf849fa229b90128a48243c5625b94af1bc5f5fd50ce70844dced22a283f44e383d0
SSDEEP 6144:AflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:AflfAsiVGjSGecvX
TLSH
T105747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nifaxsqkid.exe

Path C:\Temp\i_nifaxsqkid.exe
Size 361KB
SHA256 377dc95929489bbfa72039268163ad540d6f45f66007f92e1a70b7ab80e35fb6
MD5 3086419340f6ae1a01f164250e748a95
SHA1 e2932588a86e4db2faaf0cab1f0711dda2d689d6
SHA512 d32a5218ac9ca9f6fd6d649478c7155299621875136d4612ddbea468d4757664241547fa9f2f60d6fdb8f3adc5ee8a86df579889df17ba83e18540b040a77365
SSDEEP 6144:/flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:/flfAsiVGjSGecvX
TLSH
T125747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoigdytnla.exe

Path C:\Temp\i_qoigdytnla.exe
Size 361KB
SHA256 0b78fabb63486cf78ef64037279eba27a8d4c63c2fef586aba4c672606523743
MD5 f5a74df81ad5dbced9c2e72a3f875326
SHA1 14a949a5007a69d51e46dd9d9ff8481546b82c41
SHA512 14f6932d0d3acc02eb1ad5474ae266002558a8c060b7c136f92e87f9c58ed71220b32e280a40414375c73f6f23e8094435fc2320cacd03db5c89de3605c1f416
SSDEEP 6144:AflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:AflfAsiVGjSGecvX
TLSH
T166747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpmgecztjg.exe

Path C:\Temp\i_rpmgecztjg.exe
Size 361KB
SHA256 1187115c0ce8f98ba16fb61035325363304f1d3a7db0c35ed65161605a2b62f0
MD5 0548536bbd66db684b1bb7db00df385e
SHA1 4482eab20143926a06adb176c6fb8e4679a9382f
SHA512 4b107b14392b40944ab1d8849c73e29600da0ba8e9f5de88fef8fb3e9a5ab87c70aeabae5da78846115ccca5d067a30a7b8b94536460f192d72f56eedbfb9cb8
SSDEEP 6144:hflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:hflfAsiVGjSGecvX
TLSH
T1B4747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keczusmker.sys

Path C:\Temp\keczusmker.sys
Size 293KB
SHA256 6df3d63304eaf792de7c3eb02056b375e9c707f9ffd18421fa9c1470d442baf6
MD5 338573aa4aaaebfbb9349fa624e936a8
SHA1 2dec2d8e42444b447abf1f1e3f28f7590894dff6
SHA512 eaf45022e5ba9ff688cc1a169b6d397e31eafa0552f6c3f153586656ecd258a70f8382cbbb5c8c3a1c353429e35770efca24e18ce6b31cc43f55aa892d6749fb
SSDEEP 3072:QtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:QIJjiJcbI03GBc3ucY5DCSj
TLSH
T16C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcxupmhfc.sys

Path C:\Temp\kfcxupmhfc.sys
Size 293KB
SHA256 c038dab2595fab97686ed8ce887b2379b6c18a2233557d2864486ed0e9b18c12
MD5 a6a26bdaadba8912b3f35c9431df38a0
SHA1 5462687a79d5e0718a265fcb5e317ac3a1c409c4
SHA512 d1a8ef66beb67fef66b372f780b587be4d5b91ca0accb302e2aaac24fcb43e80cabdd4eee42ca91bcd5b0f1cb30aec74f0e169651c36fca3b5be157d8eefc115
SSDEEP 3072:+tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:+IJjiJcbI03GBc3ucY5DCSj
TLSH
T1E7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khczxupmke.exe

Path C:\Temp\khczxupmke.exe
Size 361KB
SHA256 9ca2317c19c86046f67b3e3199bb6c8e2a152aa8dadb494e96b5ee9e6fefd572
MD5 db52e509e8c521ed3ca40cbc24eebb47
SHA1 7a385f81c76c3a328d7edd8184c93f980548ed39
SHA512 248cf47d5c717173205de74f9d33c5487cbb3795464d725fbef8b4266d1de0a7c6bb563c828508ba116d41e9be671ca841d3ec8bb11e4265c672e101d05bf064
SSDEEP 6144:gflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:gflfAsiVGjSGecvX
TLSH
T1BB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifaxsqkid.exe

Path C:\Temp\nifaxsqkid.exe
Size 361KB
SHA256 ae441a5e81c039e24d6dcd1f0e3bd15f79dc9127d4e5f5c10e3723ddfbe241a6
MD5 d26f653f19d48299b1dc1529f6985786
SHA1 9e8c90b9fd4ac57200c25061ce67dc406e1061a0
SHA512 0ee36af9648e92d5ef1e283b38b4437fa52d8ae2f651364b94c89ce2443e70f575ec49010ecff067ab9f2e58db9ddf1a905ccaed19d61547754d073e05533724
SSDEEP 6144:8flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:8flfAsiVGjSGecvX
TLSH
T1DD747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qljdbvtnlgdyvqni.exe

Path C:\Temp\qljdbvtnlgdyvqni.exe
Size 361KB
SHA256 8f9a228ebc6facdf83fb87af695edce32852d6bcf8d0dcb1c21a974af774e507
MD5 cea83dce084d4ced3087e6590e29b3e0
SHA1 646e643f3050802c4d14ccf730988e0e8bbaf114
SHA512 773a7ddc0a301d4c052ccb3ff3a64a7c611ac92324906959d5f62f70343f7ebff4ef502e142df6fb4c1a989c6d3ae886417e79ca6d0a38b2a88415b21f79d22b
SSDEEP 6144:NflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:NflfAsiVGjSGecvX
TLSH
T116747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qljdbvtnlgdyvqni.sys

Path C:\Temp\qljdbvtnlgdyvqni.sys
Size 293KB
SHA256 a7d9a3db0bf2024c2439609b95f790a11e91a9c44dc6cdedd7e22f4370b6987a
MD5 6cb0e4b5de27a2634989581c23204038
SHA1 c55a133b8e7d733739a5467cf1cf82a6724e2817
SHA512 63bdef800b48865ab23726def021e51a6e09a7add07a401b1ff7ed8c4980ffef38a03fb1800cb017648b7cc72f43eb3f55e6f25c7805c31691b010f2c8ba7cae
SSDEEP 3072:atKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:aIJjiJcbI03GBc3ucY5DCSj
TLSH
T159545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigdytnla.exe

Path C:\Temp\qoigdytnla.exe
Size 361KB
SHA256 8b1378481ba72c21014a7d5123ef536b4d1586b49e072eeeb4d97e3ef279feeb
MD5 aba4a6e04883f0e70c049a00dbb62bbe
SHA1 0fa468bc4ab0137713ae018c4bc662acfb413a01
SHA512 1305e989b4a61b4af13267289ade93c2ce6168bd9517f822c5dee16c7be1cf1c79ea546ecc3147bbd737b335332c502e209e09e97ab9e67c2767b56b7980b072
SSDEEP 6144:HflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:HflfAsiVGjSGecvX
TLSH
T1D1747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpmgecztjg.exe

Path C:\Temp\rpmgecztjg.exe
Size 361KB
SHA256 cd5d3d0e25edb62adabc401cf465985d304ae254c8878a858c5a33e7707ac374
MD5 48fc90be64b59c83a3f6e2d6b1dd2999
SHA1 3a08bd82413311463891d18a705c303e535ae335
SHA512 7e0ddd39fdb372844b570a3cc7c9eb3a1232581d0e1b09eb9d31d82b6177bab9d655f5ae45d10c865af2d23403ae2273c8787f27aee5f7ec7669cc6ad35f3a5e
SSDEEP 6144:gflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:gflfAsiVGjSGecvX
TLSH
T18B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trmgeczxro.sys

Path C:\Temp\trmgeczxro.sys
Size 293KB
SHA256 587085b32725dc29b7cb253a5e3a817979588488d2a09910ea690369ff6a2dd3
MD5 61bd5a4c057d0875e3cd2d5a81b807b8
SHA1 e2867be4477a7f75c02a7cb5f05b01a6ca2c0ba8
SHA512 0ceb026c8bf27d3ad79190ca6833d385ad49d2cd2b9cfc04a02c575149a11c24383d78501324a1fb06764242c5a56277265154e1fc1ecfe8b69f1ca9ac80ef74
SSDEEP 3072:DtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:DIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnkidaysq.sys

Path C:\Temp\vpnkidaysq.sys
Size 293KB
SHA256 9bd2b4c6a7083e9344bcb2b5982913f3430baf7886ec1e0c9d34db6c8183c3b6
MD5 2f091335760e05c2297d787849ac7027
SHA1 d6289be50fba1673e3b6a722a7c738d8d59ba0c7
SHA512 b25a575f968378b78700a38e211970e79f3ccea21460e7bbe95be131db4aeffe747f06c3966a250e189e8d379ef811cf398e49e7c2cc6318a1d14e22825cd423
SSDEEP 3072:0tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:0IJjiJcbI03GBc3ucY5DCSj
TLSH
T106545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c0895bb1e4b935c315d152264be6d1c418ef64459054e8bbd0d801b42387dbf1
MD5 345741143f13dcf0e0ede7d166ff4dce
SHA1 4968b371570ac200561e736e82485dcd000dcd19
SHA512 a82867659cf71d1dbd53cf5b495144d19f880aa3d063d57613d942f4a311f62a765c45b595e46211e75c512ca6bcdf34ad539dacd58764686f79cb9f12c2ca55
TLSH
T15761724D0B9A5DC2D7AF89B39FD9E4583AFEC8D815072EA083F56E7844C6F2090D8197
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f0cf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f0cf.TMP
Size 3KB
SHA256 9cf7131bdce1e39ef8f0f0fc9bdf4fd2d052cfd2a93ea86ac0988bd116cfc062
MD5 e22e6606bf370f4a0280403c86bea8a1
SHA1 d09c007e38b17f503cb5f61143532424b527077c
SHA512 26af8784ed6e6204eedafc09a068af4436c666a1f4a657b7f9a74264d0886c00cfb318fe1f5683e74745776e1dcd1a22457772ff21bdb54a665d38f94091ba0e
TLSH
T10761734D0B595DC2D7AF89B39FD8D45839FEC8D815472DA083F56E7844C6F2090D8197
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8de2d9833a5252325e24b13fa8075c9106d559aa4c75ab18963764dd863d5735
MD5 8348d76aac42369d5d6fa7699cf8d2eb
SHA1 ee3b615ad7bbfb3c3fbf1ec4bbdb26d7740fdd19
SHA512 a4be51cc23a60c567708421bd1a3ba7582ec20bed6d2c4bc9874ef7bcae22d934172dd8c86f7f424afc0b023d424014ba20df39f509ed45e799069de4cd74839
TLSH
T19651EEF3C7E4866EC90196F0AA187F2BCE1D0915832C3C5AC9E4EF5B93E2471E141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 aa7a47b363abfee153471d12f0578541eea9f974778631bf719b24eb28c63678
MD5 dd7d36c4c001773579c180cb32ef8fbc
SHA1 4bcff8f6be4c9cf0b9604197d27e65955d03c52d
SHA512 3bcaf88c5cc692be103603a19625d01b23e62e7c3a6f2488e68b3d6ef640a726db20ebcce2ebee886cc50699166d6efeb9cfb78184a0e949340508b9580ba7d3
SSDEEP 192:sxRgRcyM/jK1Ml8wCS/fqsH0pPXYZWVM83izoA8pi/g6+WNIYEB32FGLVIgtJ:sxRgq8S/fqswPmWLi/5IJz3
TLSH
T1E952D8156A345D7BCCDBD309FA557F93D6F85473A2901E44AAFC8A0C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0ffcca9f33e5a546d56ec62cdb5c829e0cc441d3b08d9ad6bc0a7b2cab632dad
MD5 ec32febbe06b3153704e670064bc8955
SHA1 c6cdce68d77da71c558638410998561166e58df3
SHA512 b98a99ce6ed8f1e948229a18551d48fb1387693caf3a8cd2d050451ec0a973473d2fe3d10d38eadb985db2a7f181cf42dbe9e5d76737267d02a20fef45bbde4a
SSDEEP 192:sxRrRcyM/jK1Ml8wCS/fqsZ0pPXYZWVM832zoA8p9h/g6+WNCCq/YER32FGLVIgY:sxRrC8S/fqsCPmWHr/5O/BzY
TLSH
T1AD62DA056A345D7B8CDBD209FA557F93D2F85573A2905E44AAFC8B0C04E6BDD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b15d6cfdca6380fab4d780a46888f95402014525e28204508bb0ba8ee00939bc
MD5 90ea7f0f86360dbe3516554c5b0fdad4
SHA1 15f8ddd5b9319c1b3cc9c544c46cd9a9049e3107
SHA512 f84c2c858629f6567339bd1c27ee6a14efd209d77222492f123adfdc3250ff0df7f22fbacea79b7ce35f7eba080c01ab1504e731de8151250794e127a2f7edaa
SSDEEP 192:sxRrRcyM/jK1Ml8UQ1CS/fqsZ0pPXYZWVM832zoA8prh/g6+WNCCq/YEN32FGLVY:sxRrCqkS/fqsCPmWHt/5O/FzY
TLSH
T1E262E9066A345D7BCCDBD219FA557F93D2F85473A2901E44AAFC8B0C04E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 a12d67853d6ea96aeb4741965b448458b162cbd1da93367e00c063f915d48eae
MD5 66f27e06d10ad406aa814de66c57e40f
SHA1 49690597677a54a67534f1c8aadec674bc878e36
SHA512 916c09e05a3155733ae6111f7adb8750ef8a7c61c3bd28b3db8d4e157291d5891f82e88ad1ac6644815bd479d75bd22abac6fa3fea875cca9b75cdc71a7962ce
SSDEEP 768:40D76DrQD81F7pLuL7J0DbWgQ6DjfPQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVNB:40D76DrQD81TE7J0DbWgQ6DjfPQDFu1t
TLSH
T144E2EB3B680CCB7F4F404ADCAD29BDCA6DA801CF56D8899447EA890C03C67EF551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76ee217f-0ec9-40d4-a031-114cbf22c637.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\76ee217f-0ec9-40d4-a031-114cbf22c637.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 55d50a078539a39ec54b16df31a8a219d22f93cf1f0e52f2b7a89505366c705f
MD5 78822ed49da29bb1b635f98b6be1da88
SHA1 dbd8f414bd5a77c0d26601f3a5ad3a990c33d995
SHA512 a9d404378f6c234c73d0724cc7d79c5de8e58c7f60b5c15c48fffd943e823149dcd440af050558c76f1f36732df0d28277cc5e0df624e6a32f2cdc3ac2db7e8c
SSDEEP 768:RF1j+9n3TwgHqeznZ2yCwWeX6+qTko0u229a4vsTbb9Mof:w9n30sdfFvVTVKa4Wb+6
TLSH
T13D133AF598D38977C8AE8787633D2D869DBCD163B6881984BBC85D0CCC8617FC70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 385b73d94bbe0f7c3c7e46815be08b866448cb2ed3dda57eb70e63687934051a
MD5 007c7ee5b39747f840e14da70d5047db
SHA1 ce078723ff4471e2baf986bf8d7051b22b5c88eb
SHA512 9068d2cef67ca7d714dd3c186c71e86eba9c41071e3e0fdf3936d617276caf507f6fb421d46152ac6969b8c5531189acfd868525e3630cc31e70887047a9eb38
SSDEEP 768:prv+4UNbdG3WhCDTd+Z2yFeX6+qTko0u229a4vsDVeVH1SdW:pbsbU3GdkvVTVKa4EEH1h
TLSH
T19603CF32E8A589778DE7D784724B71472FB91173C7881B80D8ED6B4D028B5AC270BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 39a8d0a9ae16efed74de78c9c39293f5b7c1878b384467517df6b01a27f81fe0
MD5 e9d057abfea87c3d97415e6e8b3dc218
SHA1 a1b97a8109eee5316388784ae488bdee3d16abbf
SHA512 e33412f3cbfd44ee378e464d1c577038dcf07ce084f42c6d3cb46c17ba7fda839b206fc834762d3f0882584f16ac5e75fba78359e500a632d52dc975b0bee85f
SSDEEP 768:5rv+4UNbdp3aLecDTd+Z2yCwFeX6+qTko0u229a4vsTbb9MS:5bsbL3KudfkvVTVKa4Wb+S
TLSH
T17413CF31F8298DB389B7D285B15B35977EB421B38AC81B44E9DDAB4C054B46C2B0F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5585d205e45a5bf218af91e16aba64d59a2c78d6ccde8a786c7188b08f81b4d8
MD5 12c42f90a7c49d8d54c6bdbceb158d29
SHA1 54295b4106167b3473bea4b5d7e10aa43b81b5cc
SHA512 23ff49c093413629b1aead505ef9b38f4855c21a910e0007cc412ce97590472845abcd1bb5ed1b9db7d967558470a8efa7e1e7dab10a1545dd26d2fbb267c543
SSDEEP 768:Cj+9n3aXecDTd+Z2yCwWeX6+qTko0u229a4vsTbb9Mof:x9n3YudfFvVTVKa4Wb+6
TLSH
T16DF2B031F8668DB74CE7C389725B36D7AEB111B386C42E44E9DDAB0D054726C1B0B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

00b7b20a-82d8-433f-835f-08251bb3a126.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\00b7b20a-82d8-433f-835f-08251bb3a126.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6048_1392587573\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 fe205ece7a1ea707fb383dc78aa90dc5124e99c51fe2ec2e1dbb3a052dbb86ea
MD5 7bb6eb924dd98790d2ebbf1bdc643ce0
SHA1 26a3285315f451e5d6bcabd99158a29c6637299d
SHA512 b9afb6b96191bb1009ce004516c99a1076090b93519ac3742aa6b45aed8ff4e9bd1008cc49b554cce4db95f1a7a6b7b64adb9d274b0803b588c48f11c57b3318
TLSH
T18371C08356B9DAB2C69E5FF502839644F6BB223C076370204BA55586AB30A7A58B9F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/496-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1308-376-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1308-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1588-396-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1860-488-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2164-195-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2248-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2264-416-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2420-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2652-363-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3692-505-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3772-472-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5020-270-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5036-451-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5084-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5268-242-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5908-476-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5940-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6084-342-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6108-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download