systex | 16aaec14d583065deec61738fe907b6b1ec45819e3977bdc5942e2b5c5067c8c

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 04:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260715-fbvkhaby2q
SHA256 16aaec14d583065deec61738fe907b6b1ec45819e3977bdc5942e2b5c5067c8c
MD5 7fbfa13c5a1ccdddc2868b7cfa2ffc9f
SHA1 927bd2652ab543e3ca002141538dc2a630254fbb
SHA512 564455a31523d7133abdb633d410a826a06ba70727a033b4f4b92c1d4cbf1ac760308c1e1b1737d6e878a8482c2fc8ddd7c2e10221b09201a9f422a9fc76d079
SSDEEP 6144:eflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:eflfAsiVGjSGecvX
TLSH
T120747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3256	eywqojgbztrljdbw.exe
2904	eywqojgbztrljdbw.sys
2668	CreateProcess.exe
5456	geywqoigby.exe
5084	CreateProcess.exe
1624	CreateProcess.exe
1704	i_geywqoigby.exe
2640	bytqljdbvt.sys
3556	CreateProcess.exe
2072	qlidbvqlid.exe
6036	CreateProcess.exe
1108	CreateProcess.exe
4384	i_qlidbvqlid.exe
5784	tnlfdyvpni.sys
2480	CreateProcess.exe
828	igaysqkida.exe
3660	CreateProcess.exe
4888	CreateProcess.exe
4872	i_igaysqkida.exe
2492	faxspkicau.sys
4356	CreateProcess.exe
5596	vsnkfdxvpn.exe
5616	CreateProcess.exe
5524	CreateProcess.exe
5320	i_vsnkfdxvpn.exe
1052	pnhfzxsnkf.sys
852	CreateProcess.exe
2600	usmkfcxupn.exe
1684	CreateProcess.exe
1772	CreateProcess.exe
6136	i_usmkfcxupn.exe
424	kecxupnhfz.sys
5080	CreateProcess.exe
1980	wupmhezxrp.exe
1672	CreateProcess.exe
4596	CreateProcess.exe
252	i_wupmhezxrp.exe
3872	ezwrpjhbzt.sys
2256	CreateProcess.exe
5216	urmjhbzurm.exe
3360	CreateProcess.exe
3028	CreateProcess.exe
5568	i_urmjhbzurm.exe
1820	gbztrojgby.sys
2136	CreateProcess.exe
1300	ywuomgeywu.exe
5288	CreateProcess.exe
5788	CreateProcess.exe
1704	i_ywuomgeywu.exe
5660	wtrljebwto.sys
5824	CreateProcess.exe
996	eywqoigbyt.exe
4084	CreateProcess.exe
3416	CreateProcess.exe
4316	i_eywqoigbyt.exe
1296	oljdbvtnlj.sys
2392	CreateProcess.exe
4472	bvtnlfdxvq.exe
944	CreateProcess.exe
4376	CreateProcess.exe
3796	i_bvtnlfdxvq.exe
4752	qnigaysqli.sys
1700	CreateProcess.exe
4948	gaysqkidav.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4152_376515704\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4152_376515704\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4152_1238233547\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4152_1238233547\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4152_211476353\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4152_1697140354\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4152_1697140354\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4152_1238233547\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4152_1238233547\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezxuomhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlidbvqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkfcxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxspnhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojebztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupmhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxspnhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcausmkhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtqoigdby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtqoigdby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqojgbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezxuomhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlidbvqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojebztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wupmhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywuomgeywu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcausmkhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkfcxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywuomgeywu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdxvqni.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3124	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6032	ipconfig.exe
2832	ipconfig.exe
2848	ipconfig.exe
2904	ipconfig.exe
3160	ipconfig.exe
5860	ipconfig.exe
5572	ipconfig.exe
692	ipconfig.exe
2644	ipconfig.exe
5588	ipconfig.exe
1796	ipconfig.exe
1984	ipconfig.exe
5952	ipconfig.exe
5796	ipconfig.exe
4328	ipconfig.exe
4788	ipconfig.exe
2148	ipconfig.exe
3812	ipconfig.exe
4172	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285641544874221"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{12CD8B88-861F-4C34-922A-2EA348ECC3E4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3256	eywqojgbztrljdbw.exe
3256	eywqojgbztrljdbw.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3256	eywqojgbztrljdbw.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3256	eywqojgbztrljdbw.exe
3256	eywqojgbztrljdbw.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3256	eywqojgbztrljdbw.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3256	eywqojgbztrljdbw.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3256	eywqojgbztrljdbw.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1704	i_geywqoigby.exe
Token: SeDebugPrivilege	4384	i_qlidbvqlid.exe
Token: SeDebugPrivilege	4872	i_igaysqkida.exe
Token: SeDebugPrivilege	5320	i_vsnkfdxvpn.exe
Token: SeDebugPrivilege	6136	i_usmkfcxupn.exe
Token: SeDebugPrivilege	252	i_wupmhezxrp.exe
Token: SeDebugPrivilege	5568	i_urmjhbzurm.exe
Token: SeDebugPrivilege	1704	i_ywuomgeywu.exe
Token: SeDebugPrivilege	4316	i_eywqoigbyt.exe
Token: SeDebugPrivilege	3796	i_bvtnlfdxvq.exe
Token: SeDebugPrivilege	2656	i_gaysqkidav.exe
Token: SeDebugPrivilege	4384	i_faxspnhfax.exe
Token: SeDebugPrivilege	2332	i_fcausmkhfz.exe
Token: SeDebugPrivilege	4812	i_pmhfzxrpjh.exe
Token: SeDebugPrivilege	1528	i_ezxuomhezx.exe
Token: SeDebugPrivilege	4684	i_ojebztrlje.exe
Token: SeDebugPrivilege	4284	i_geywqoigby.exe
Token: SeDebugPrivilege	5920	i_bvtqoigdby.exe
Token: SeDebugPrivilege	6136	i_tnlfdxvqni.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4152	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 3256	5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 5004 wrote to memory of 2536	5004	2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 2536 wrote to memory of 4152	2536	iexplore.exe	89
PID 4152 wrote to memory of 5440	4152	msedge.exe	90
PID 4152 wrote to memory of 3124	4152	msedge.exe	91
PID 4152 wrote to memory of 1412	4152	msedge.exe	92
PID 4152 wrote to memory of 1412	4152	msedge.exe	92
PID 4152 wrote to memory of 2792	4152	msedge.exe	93
PID 4152 wrote to memory of 2792	4152	msedge.exe	93
PID 4152 wrote to memory of 2792	4152	msedge.exe	93
PID 4152 wrote to memory of 5968	4152	msedge.exe	95
PID 4152 wrote to memory of 5968	4152	msedge.exe	95
PID 4152 wrote to memory of 5968	4152	msedge.exe	95
PID 4152 wrote to memory of 2108	4152	msedge.exe	96
PID 4152 wrote to memory of 2108	4152	msedge.exe	96
PID 4152 wrote to memory of 2108	4152	msedge.exe	96
PID 4152 wrote to memory of 4864	4152	msedge.exe	97
PID 4152 wrote to memory of 4864	4152	msedge.exe	97
PID 4152 wrote to memory of 4864	4152	msedge.exe	97
PID 4152 wrote to memory of 4748	4152	msedge.exe	98
PID 4152 wrote to memory of 4748	4152	msedge.exe	98
PID 4152 wrote to memory of 4748	4152	msedge.exe	98
PID 4152 wrote to memory of 2068	4152	msedge.exe	99
PID 4152 wrote to memory of 2068	4152	msedge.exe	99
PID 3256 wrote to memory of 2668	3256	eywqojgbztrljdbw.exe	103
PID 5456 wrote to memory of 5084	5456	geywqoigby.exe	106
PID 4152 wrote to memory of 2548	4152	msedge.exe	107
PID 4152 wrote to memory of 5920	4152	msedge.exe	108
PID 4152 wrote to memory of 2548	4152	msedge.exe	107
PID 4152 wrote to memory of 5920	4152	msedge.exe	108
PID 4152 wrote to memory of 996	4152	msedge.exe	112
PID 4152 wrote to memory of 5216	4152	msedge.exe	113
PID 4152 wrote to memory of 5216	4152	msedge.exe	113
PID 4152 wrote to memory of 1416	4152	msedge.exe	116
PID 4152 wrote to memory of 1416	4152	msedge.exe	116
PID 3256 wrote to memory of 1624	3256	eywqojgbztrljdbw.exe	117
PID 3256 wrote to memory of 3556	3256	eywqojgbztrljdbw.exe	121
PID 2072 wrote to memory of 6036	2072	qlidbvqlid.exe	123
PID 3256 wrote to memory of 1108	3256	eywqojgbztrljdbw.exe	126
PID 3256 wrote to memory of 2480	3256	eywqojgbztrljdbw.exe	130
PID 828 wrote to memory of 3660	828	igaysqkida.exe	132
PID 3256 wrote to memory of 4888	3256	eywqojgbztrljdbw.exe	135
PID 3256 wrote to memory of 4356	3256	eywqojgbztrljdbw.exe	140
PID 5596 wrote to memory of 5616	5596	vsnkfdxvpn.exe	142
PID 3256 wrote to memory of 5524	3256	eywqojgbztrljdbw.exe	145
PID 4152 wrote to memory of 2912	4152	msedge.exe	147
PID 4152 wrote to memory of 5496	4152	msedge.exe	148
PID 4152 wrote to memory of 2640	4152	msedge.exe	149
PID 3256 wrote to memory of 852	3256	eywqojgbztrljdbw.exe	152
PID 2600 wrote to memory of 1684	2600	usmkfcxupn.exe	154
PID 3256 wrote to memory of 1772	3256	eywqojgbztrljdbw.exe	157
PID 3256 wrote to memory of 5080	3256	eywqojgbztrljdbw.exe	161
PID 1980 wrote to memory of 1672	1980	wupmhezxrp.exe	163
PID 3256 wrote to memory of 4596	3256	eywqojgbztrljdbw.exe	166
PID 3256 wrote to memory of 2256	3256	eywqojgbztrljdbw.exe	170
PID 5216 wrote to memory of 3360	5216	urmjhbzurm.exe	172
PID 3256 wrote to memory of 3028	3256	eywqojgbztrljdbw.exe	175
PID 3256 wrote to memory of 2136	3256	eywqojgbztrljdbw.exe	179
PID 1300 wrote to memory of 5288	1300	ywuomgeywu.exe	181
PID 4152 wrote to memory of 5604	4152	msedge.exe	184
PID 4152 wrote to memory of 5604	4152	msedge.exe	184
PID 3256 wrote to memory of 5788	3256	eywqojgbztrljdbw.exe	186
PID 3256 wrote to memory of 5824	3256	eywqojgbztrljdbw.exe	192
PID 996 wrote to memory of 4084	996	eywqoigbyt.exe	194

C:\Users\Admin\AppData\Local\Temp\2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_7fbfa13c5a1ccdddc2868b7cfa2ffc9f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Temp\eywqojgbztrljdbw.exe
  C:\Temp\eywqojgbztrljdbw.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywqoigby.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2668
  - - C:\Temp\geywqoigby.exe
      C:\Temp\geywqoigby.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5456
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5084
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywqoigby.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1624
  - - C:\Temp\i_geywqoigby.exe
      C:\Temp\i_geywqoigby.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qlidbvqlid.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3556
  - - C:\Temp\qlidbvqlid.exe
      C:\Temp\qlidbvqlid.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2072
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6036
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qlidbvqlid.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1108
  - - C:\Temp\i_qlidbvqlid.exe
      C:\Temp\i_qlidbvqlid.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igaysqkida.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2480
  - - C:\Temp\igaysqkida.exe
      C:\Temp\igaysqkida.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:828
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3660
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igaysqkida.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4888
  - - C:\Temp\i_igaysqkida.exe
      C:\Temp\i_igaysqkida.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsnkfdxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4356
  - - C:\Temp\vsnkfdxvpn.exe
      C:\Temp\vsnkfdxvpn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5596
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5616
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsnkfdxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5524
  - - C:\Temp\i_vsnkfdxvpn.exe
      C:\Temp\i_vsnkfdxvpn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkfcxupn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:852
  - - C:\Temp\usmkfcxupn.exe
      C:\Temp\usmkfcxupn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2600
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkfcxupn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1772
  - - C:\Temp\i_usmkfcxupn.exe
      C:\Temp\i_usmkfcxupn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wupmhezxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5080
  - - C:\Temp\wupmhezxrp.exe
      C:\Temp\wupmhezxrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1980
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1672
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wupmhezxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4596
  - - C:\Temp\i_wupmhezxrp.exe
      C:\Temp\i_wupmhezxrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmjhbzurm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2256
  - - C:\Temp\urmjhbzurm.exe
      C:\Temp\urmjhbzurm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5216
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3360
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmjhbzurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3028
  - - C:\Temp\i_urmjhbzurm.exe
      C:\Temp\i_urmjhbzurm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywuomgeywu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2136
  - - C:\Temp\ywuomgeywu.exe
      C:\Temp\ywuomgeywu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1300
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5288
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywuomgeywu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5788
  - - C:\Temp\i_ywuomgeywu.exe
      C:\Temp\i_ywuomgeywu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywqoigbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5824
  - - C:\Temp\eywqoigbyt.exe
      C:\Temp\eywqoigbyt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:996
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4084
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywqoigbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3416
  - - C:\Temp\i_eywqoigbyt.exe
      C:\Temp\i_eywqoigbyt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtnlfdxvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2392
  - - C:\Temp\bvtnlfdxvq.exe
      C:\Temp\bvtnlfdxvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4472
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:944
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtnlfdxvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4376
  - - C:\Temp\i_bvtnlfdxvq.exe
      C:\Temp\i_bvtnlfdxvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaysqkidav.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1700
  - - C:\Temp\gaysqkidav.exe
      C:\Temp\gaysqkidav.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4948
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3472
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaysqkidav.exe ups_ins
    3⤵
    PID:4776
  - - C:\Temp\i_gaysqkidav.exe
      C:\Temp\i_gaysqkidav.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faxspnhfax.exe ups_run
    3⤵
    PID:2780
  - - C:\Temp\faxspnhfax.exe
      C:\Temp\faxspnhfax.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5880
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5640
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faxspnhfax.exe ups_ins
    3⤵
    PID:4400
  - - C:\Temp\i_faxspnhfax.exe
      C:\Temp\i_faxspnhfax.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcausmkhfz.exe ups_run
    3⤵
    PID:2148
  - - C:\Temp\fcausmkhfz.exe
      C:\Temp\fcausmkhfz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1452
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4552
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcausmkhfz.exe ups_ins
    3⤵
    PID:4668
  - - C:\Temp\i_fcausmkhfz.exe
      C:\Temp\i_fcausmkhfz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmhfzxrpjh.exe ups_run
    3⤵
    PID:1872
  - - C:\Temp\pmhfzxrpjh.exe
      C:\Temp\pmhfzxrpjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2652
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2252
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmhfzxrpjh.exe ups_ins
    3⤵
    PID:5148
  - - C:\Temp\i_pmhfzxrpjh.exe
      C:\Temp\i_pmhfzxrpjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezxuomhezx.exe ups_run
    3⤵
    PID:4660
  - - C:\Temp\ezxuomhezx.exe
      C:\Temp\ezxuomhezx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2416
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5660
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezxuomhezx.exe ups_ins
    3⤵
    PID:2288
  - - C:\Temp\i_ezxuomhezx.exe
      C:\Temp\i_ezxuomhezx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ojebztrlje.exe ups_run
    3⤵
    PID:4852
  - - C:\Temp\ojebztrlje.exe
      C:\Temp\ojebztrlje.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5944
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ojebztrlje.exe ups_ins
    3⤵
    PID:5188
  - - C:\Temp\i_ojebztrlje.exe
      C:\Temp\i_ojebztrlje.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywqoigby.exe ups_run
    3⤵
    PID:3268
  - - C:\Temp\geywqoigby.exe
      C:\Temp\geywqoigby.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:264
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3808
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywqoigby.exe ups_ins
    3⤵
    PID:2340
  - - C:\Temp\i_geywqoigby.exe
      C:\Temp\i_geywqoigby.exe ups_ins
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtqoigdby.exe ups_run
    3⤵
    PID:244
  - - C:\Temp\bvtqoigdby.exe
      C:\Temp\bvtqoigdby.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1776
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtqoigdby.exe ups_ins
    3⤵
    PID:4816
  - - C:\Temp\i_bvtqoigdby.exe
      C:\Temp\i_bvtqoigdby.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnlfdxvqni.exe ups_run
    3⤵
    PID:1632
  - - C:\Temp\tnlfdxvqni.exe
      C:\Temp\tnlfdxvqni.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4196
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1324
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnlfdxvqni.exe ups_ins
    3⤵
    PID:3792
  - - C:\Temp\i_tnlfdxvqni.exe
      C:\Temp\i_tnlfdxvqni.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6136
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2cc,0x2f4,0x2f8,0x2c8,0x304,0x7ffd5f15c188,0x7ffd5f15c194,0x7ffd5f15c1a0
      4⤵
      PID:5440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,5052938975801291191,14132934530072647316,524288 --field-trial-handle=2708,i,13602015452126927083,8504202095778217159,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:11
      4⤵
      System Time Discovery
      PID:3124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,8452527811730956378,9037445273305646211,524288 --field-trial-handle=2708,i,13602015452126927083,8504202095778217159,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:13
      4⤵
      PID:1412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,12552579395270865578,5258488118791631068,262144 --field-trial-handle=2708,i,13602015452126927083,8504202095778217159,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:2
      4⤵
      PID:2792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,7235155760356615158,907620270076392453,2097152 --field-trial-handle=2708,i,13602015452126927083,8504202095778217159,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:5968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,3716500657161838902,11986874531643623795,2097152 --field-trial-handle=2708,i,13602015452126927083,8504202095778217159,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
      4⤵
      PID:2108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,2571347708225891283,9595457803749614604,2097152 --field-trial-handle=2708,i,13602015452126927083,8504202095778217159,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:9
      4⤵
      PID:4864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,5296964589861369121,13995038956484856692,2097152 --field-trial-handle=2708,i,13602015452126927083,8504202095778217159,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
      4⤵
      PID:4748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,3908445395006180245,810515669222906107,524288 --field-trial-handle=2708,i,13602015452126927083,8504202095778217159,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:14
      4⤵
      PID:2068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,14795086164276972059,7747706576207857212,524288 --field-trial-handle=2708,i,13602015452126927083,8504202095778217159,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
      4⤵
      PID:2548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,6528697964589508048,17501827500467907039,524288 --field-trial-handle=2708,i,13602015452126927083,8504202095778217159,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
      4⤵
      PID:5920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,3839862977985454145,3043106737913088093,524288 --field-trial-handle=2708,i,13602015452126927083,8504202095778217159,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
      4⤵
      PID:424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,3839862977985454145,3043106737913088093,524288 --field-trial-handle=2708,i,13602015452126927083,8504202095778217159,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
      4⤵
      PID:996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,10850772456778281612,15233479844547337258,524288 --field-trial-handle=2708,i,13602015452126927083,8504202095778217159,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:5216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,9339477138866162962,3464074151396838090,524288 --field-trial-handle=2708,i,13602015452126927083,8504202095778217159,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
      4⤵
      PID:1416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,10700871542494809513,14428700106293999656,524288 --field-trial-handle=2708,i,13602015452126927083,8504202095778217159,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
      4⤵
      PID:2912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,2390567341263655902,7846652996654474164,524288 --field-trial-handle=2708,i,13602015452126927083,8504202095778217159,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
      4⤵
      PID:5496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,5539444930997591212,12545521820947882208,524288 --field-trial-handle=2708,i,13602015452126927083,8504202095778217159,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
      4⤵
      PID:2640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,8828789835426762986,16323916482665247598,524288 --field-trial-handle=2708,i,13602015452126927083,8504202095778217159,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
      4⤵
      PID:5604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,3074030465146810125,7087191803790913561,524288 --field-trial-handle=2708,i,13602015452126927083,8504202095778217159,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,12879507317502633250,17653507689772027849,524288 --field-trial-handle=2708,i,13602015452126927083,8504202095778217159,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
      4⤵
      PID:6076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6080,i,3196463105407237106,1476422970630441857,2097152 --field-trial-handle=2708,i,13602015452126927083,8504202095778217159,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
      4⤵
      PID:4504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6296,i,12240196692038821323,11193183923815713667,2097152 --field-trial-handle=2708,i,13602015452126927083,8504202095778217159,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,12602602859562916799,14326179741619038224,524288 --field-trial-handle=2708,i,13602015452126927083,8504202095778217159,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
      4⤵
      PID:5136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4980,i,9093385592352949304,10929308094555584389,262144 --field-trial-handle=2708,i,13602015452126927083,8504202095778217159,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:10
      4⤵
      PID:5372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,15717250841527018477,16107414741172538270,524288 --field-trial-handle=2708,i,13602015452126927083,8504202095778217159,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:14
      4⤵
      PID:6116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4984

C:\Temp\eywqojgbztrljdbw.sys
C:\Temp\eywqojgbztrljdbw.sys
1⤵
- Executes dropped EXE
PID:2904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:244

C:\Temp\bytqljdbvt.sys
C:\Temp\bytqljdbvt.sys
1⤵
- Executes dropped EXE
PID:2640

C:\Temp\tnlfdyvpni.sys
C:\Temp\tnlfdyvpni.sys
1⤵
- Executes dropped EXE
PID:5784

C:\Temp\faxspkicau.sys
C:\Temp\faxspkicau.sys
1⤵
- Executes dropped EXE
PID:2492

C:\Temp\pnhfzxsnkf.sys
C:\Temp\pnhfzxsnkf.sys
1⤵
- Executes dropped EXE
PID:1052

C:\Temp\kecxupnhfz.sys
C:\Temp\kecxupnhfz.sys
1⤵
- Executes dropped EXE
PID:424

C:\Temp\ezwrpjhbzt.sys
C:\Temp\ezwrpjhbzt.sys
1⤵
- Executes dropped EXE
PID:3872

C:\Temp\gbztrojgby.sys
C:\Temp\gbztrojgby.sys
1⤵
- Executes dropped EXE
PID:1820

C:\Temp\wtrljebwto.sys
C:\Temp\wtrljebwto.sys
1⤵
- Executes dropped EXE
PID:5660

C:\Temp\oljdbvtnlj.sys
C:\Temp\oljdbvtnlj.sys
1⤵
- Executes dropped EXE
PID:1296

C:\Temp\qnigaysqli.sys
C:\Temp\qnigaysqli.sys
1⤵
- Executes dropped EXE
PID:4752

C:\Temp\nkicavsnkf.sys
C:\Temp\nkicavsnkf.sys
1⤵
PID:1332

C:\Temp\upnhfzxspk.sys
C:\Temp\upnhfzxspk.sys
1⤵
PID:3168

C:\Temp\ecausmkfcx.sys
C:\Temp\ecausmkfcx.sys
1⤵
PID:4736

C:\Temp\pjhbzurmke.sys
C:\Temp\pjhbzurmke.sys
1⤵
PID:2688

C:\Temp\wrojhbztrm.sys
C:\Temp\wrojhbztrm.sys
1⤵
PID:4196

C:\Temp\gdbztrljdb.sys
C:\Temp\gdbztrljdb.sys
1⤵
PID:5952

C:\Temp\lgdbvtrljg.sys
C:\Temp\lgdbvtrljg.sys
1⤵
PID:964

C:\Temp\oigdbvtnli.sys
C:\Temp\oigdbvtnli.sys
1⤵
PID:556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bytqljdbvt.sys

Path C:\Temp\bytqljdbvt.sys
Size 293KB
SHA256 52554169ad7da658429dbbb1446fb7c173cf96ebbb293a9ad94693ff418bcc09
MD5 7a3aa5845924d6aee238eb5f9969bb8c
SHA1 903517b1b9bf34ec5660e0f22bafd8af7176a85f
SHA512 ebc82ee6d2f21d42adc1d93c5dfa6212175a29d512db7ae678ec7aef8153acaa40d959c8883b39b727bfb4aa0f3f20bd043260648b72e5bcc9f487a4636f57ce
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T18D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywqojgbztrljdbw.exe

Path C:\Temp\eywqojgbztrljdbw.exe
Size 361KB
SHA256 2311a4ad5c25b5cc5fd10d8e3dada3823e5df09364d456f6d4bc6681bef4eb29
MD5 b327ddc68b5f58fde34b4797e9d35779
SHA1 d7315ec770c6afb491707b27976d6cd07cdd495c
SHA512 65ddd60c18053277bd13b379b0aa14876551dd52ad10eed326375b150cf0064d59ddb5e47730101e772b23aedb10b0a2baaa3ecaad6ae6b2bd7dc4765292b4c5
SSDEEP 6144:sflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:sflfAsiVGjSGecvX
TLSH
T18D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywqojgbztrljdbw.sys

Path C:\Temp\eywqojgbztrljdbw.sys
Size 293KB
SHA256 b9867068c17a100923bb31ca1319351513249161dc5a2ed1e8b99393d226e4e6
MD5 b20d38c0dcedf0378048abde23964f0a
SHA1 a0f7a94d66afe9ee0d26fde4a1676de60f69e3ae
SHA512 d837f094f51be432e5ce1bb929fa6021cbc9f2cba042521bbe28440c47a67691883e312074fa6c30d56197b441e11cb221dde420eccd8b812054371882aebd09
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T19C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxspkicau.sys

Path C:\Temp\faxspkicau.sys
Size 293KB
SHA256 6d011ffe8bb3d17c3f855644103a0463fcde76d933aebb0019077ab9e1d2d3ee
MD5 0ce5e93aa46a5d5998c075e19f53205e
SHA1 785a51781458c14fd0e89ffb6f5a1c314b276a49
SHA512 e7b5d9bcf0e5c7cb1259ecfcd5867167c8a2336c8b87f725936778e1a9d328c30e860b71b14968520d54c8b48d9b32cba8f382210c6b0b1ac3913c3ec2ec17c0
SSDEEP 3072:7tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:7IJjiJcbI03GBc3ucY5DCSj
TLSH
T157545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqoigby.exe

Path C:\Temp\geywqoigby.exe
Size 361KB
SHA256 937aa659fce7b3f429074878168457a3909dc8a6b77284f092897b86007463e1
MD5 924e6119bb5f336c26d9b441a43f56fc
SHA1 e19a5b7ded84da9e9cb6c51a5ac7632ea988e272
SHA512 7abc753a0a8dde1431b67724b02ac33bbeb4ec20c6258c6962c1635daffd756f4e20b518d5b7244850692b85e7ee2e237110d6daba442645f6c87e74b5956c79
SSDEEP 6144:tflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:tflfAsiVGjSGecvX
TLSH
T1E0747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geywqoigby.exe

Path C:\Temp\i_geywqoigby.exe
Size 361KB
SHA256 3438330403b83451f19bb2bb59fc6a098fdaf11e47cc2eed64a8a4b082a88434
MD5 37ce7d1b189cbae6f648df153db00b3d
SHA1 a89f2675126eef2a08acf0d8673560fb4070db6a
SHA512 5cad7ba290c49d43acdf35d39d31e2f3ff3cc70b2161db5ecc2940cf52f6a4fcd285ae8155f702b036394b26f5d9cd526f4b79e632ad85348be999db70a26b8b
SSDEEP 6144:0flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:0flfAsiVGjSGecvX
TLSH
T137747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igaysqkida.exe

Path C:\Temp\i_igaysqkida.exe
Size 361KB
SHA256 85c754cef3ae888310d0524b0d5e6becd20aacbb924e8725665336dbcbd7bc61
MD5 233b2801fab246ad323fc7b7c4bcbdba
SHA1 dd688b11bb1e729706529cff5e526ade830293db
SHA512 7ca9176f873695e9e41f56124d82d91cde9f0c4a0d68c36a4bcf613bb02c750b9c9f09b5d0da53672f6674fe7837bd75db765be620d4a03eb32f8ec7572319ad
SSDEEP 6144:oflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:oflfAsiVGjSGecvX
TLSH
T179747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qlidbvqlid.exe

Path C:\Temp\i_qlidbvqlid.exe
Size 361KB
SHA256 8ea7e710c519c3c53a04c5a6e8a2f7d97ff1b7e36e4cf2dd31d3b2bce2701fae
MD5 864163cd661bde0c5628533cb4b56a2e
SHA1 7cf4119005eab0e34c41d6cf2101efc1a416b975
SHA512 3c8d3a8103fdf3e0035f44b6c531aac762c48f32a32ddd50bca795caa18e4919eb8adf8daecebba72aafed9c8c88009892102b505ed4dd0b517044adeb1ab958
SSDEEP 6144:BflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:BflfAsiVGjSGecvX
TLSH
T195747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usmkfcxupn.exe

Path C:\Temp\i_usmkfcxupn.exe
Size 361KB
SHA256 b2ada102275b869ded24f6c2af9e8dc96ccb225ef63065aba95efb0c6e45f031
MD5 e6dd5b4f4ac4a20a041d821f60f49954
SHA1 08215d33337de41717c796fc18ab132cf675c66b
SHA512 4d048692f2be50d5b8a3ac6d67d49337c68a0e34b4525413ee20499715c532dd55ee4c487f923177604cac4852c4cdc0f56f63f167c3a928501728c7186d3689
SSDEEP 6144:6flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:6flfAsiVGjSGecvX
TLSH
T1F0747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsnkfdxvpn.exe

Path C:\Temp\i_vsnkfdxvpn.exe
Size 361KB
SHA256 c6d726702aff3f4dbeddfb88a2942c774899e6585c40f3dff63b5f8683344e63
MD5 7c8152bced962a094d788ee1950933e8
SHA1 3e34d70ce8583c336b54ed0e16e5765495aa6997
SHA512 e8ee3ab0ea39c6932371ad83f26162b44f86185e7c03af2ca137dcb4ba5aabffaf625611e082e22780b5b05814821ad6cc42c6dd8da2e57364ed40acacc2b2d7
SSDEEP 6144:fflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:fflfAsiVGjSGecvX
TLSH
T147747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaysqkida.exe

Path C:\Temp\igaysqkida.exe
Size 361KB
SHA256 613829e7f3195f1b022dad656686e5c0a21a541d355f7580898336c1527027e7
MD5 5e36d277d70eee54199c8265961f79ea
SHA1 162f9999cca66965172f2edb299dea942c5ef2c1
SHA512 d7c121b4e86f2d52c0f7655ee37a1d854ed206ee4f0cb561d57db039c0c8cf5a8e8b77ca81a304d8e706f2edfa70d3f98150a1f237cc3b7bfcb38a7228ccbf7f
SSDEEP 6144:8flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:8flfAsiVGjSGecvX
TLSH
T170747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecxupnhfz.sys

Path C:\Temp\kecxupnhfz.sys
Size 293KB
SHA256 5c43e36edce87b7ee4d58e7c981b919a10641c268e42553ae3a1f19ca1a10eeb
MD5 011037ec4e71af34587c30f1ec2c9948
SHA1 d49c5769f5e3a1bc02081b9f1a3fc38cc9fcf583
SHA512 3ab7398601411a239b3996031d46dfd4479f62ad125ea51052af4014864fff6d822a008b0d440f452cd5ad0cada157f33add72c4bf4dc4c152e0e8dbd8f81e01
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfzxsnkf.sys

Path C:\Temp\pnhfzxsnkf.sys
Size 293KB
SHA256 9561f510c0b2d9dd22c0de72b0bc213a4dd018c6de45177fe48a408c679a4d39
MD5 64ae170da414ef79bc40676713178c8e
SHA1 abfdaa2472dbdfb51ac1c5d33c51a5d203b8a3ca
SHA512 39feb5950d8dd7d985fd7ef082813f597f634269f4b0ae5828a1f3340bc9b08aa8c163ba49b9180e127a65f467d52d9cd2bf8b6ecf90f7fbbe0665368a93a3c0
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T123545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qlidbvqlid.exe

Path C:\Temp\qlidbvqlid.exe
Size 361KB
SHA256 9b6a8659ea8599a03587a105778e9489cb6a1e50ea0fd63d4afd5b5ddeb06b94
MD5 2b1c6029b402a1d2c7c3601c007395ff
SHA1 0bfb76d39048692708cb81ffcb167e302068f44c
SHA512 bce2d8f1d7ec0ad40f153254d4505b6638cc3ec9e5878cacdd8bd8d348cfc23a76e8a83cb4037d6274993db1f23ba3091d9d2e0339bf39c7848e797d0068b2a0
SSDEEP 6144:HflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:HflfAsiVGjSGecvX
TLSH
T1FD747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdyvpni.sys

Path C:\Temp\tnlfdyvpni.sys
Size 293KB
SHA256 fc50b6c3ec6d45e56f9d4d15da6160fb145323c8391031c0116589e15b913617
MD5 db0c83631d7ed99ee61b3f4b6fa1370c
SHA1 d6567f486f134418c9e34e3e5ec4e73f2bbc66ba
SHA512 27c1f3e49401944f0f77205e50adf57a075a4dd63571bc76c7455c25fdc853a54e2543e8186bc1b61bee7e8aa9dc355e36cceb435b241246a4f461ee0262d2ed
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T100545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkfcxupn.exe

Path C:\Temp\usmkfcxupn.exe
Size 361KB
SHA256 b323e654d7e8ca1d9a2012e0e44be0d967eb07834d7174e2b7544d76d9c6b2d8
MD5 87b1bc5de4678ecbe09336dc1fceb659
SHA1 20ea61661b1cae2449e9f6c6a567ab5f89644c9f
SHA512 182e2e48f3b107a4768566e40a19e3a787edac050d8e65a5dcc559e118836aae202a213c35d19a9ca33675b37d59518878173494d1d6f55bc140582fddcf835c
SSDEEP 6144:bflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:bflfAsiVGjSGecvX
TLSH
T152747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnkfdxvpn.exe

Path C:\Temp\vsnkfdxvpn.exe
Size 361KB
SHA256 aca4fe30d68ff13e5f551cb26ea41dd56f0383c6852f1a8b6c0fe26a6cf6a7eb
MD5 c47116fa9431452c84cd3e27dd591271
SHA1 017d9de6277396c9a351edbc92859594f5fbe1a5
SHA512 51e514cd9dc2b176c1eb2278e0c7f340be2772c8cb7ac5ce9f36f18a7562e4b3f98ea132014439fd4a51a4cd2e1b26619e2f23db917139532741588b8f1686d2
SSDEEP 6144:UflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:UflfAsiVGjSGecvX
TLSH
T1F5747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wupmhezxrp.exe

Path C:\Temp\wupmhezxrp.exe
Size 361KB
SHA256 08d37d89995f191ed291a9d40603b94117ea3fce3107e3b81acdb8e40885dde1
MD5 fbd242a4b2dcc1cdda064a2d6dbb744e
SHA1 cd6d5ff9a5e5e31ced02d74d06ae68f12d2db55e
SHA512 3728da29a2be12eff4a169fc21e86dd25ca8992afbc3128a2b8ec6af50194b0067798031692b53358eb40c6e3b13285ea69df8c206f66a80851e02f0613b8330
SSDEEP 6144:CflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:CflfAsiVGjSGecvX
TLSH
T17D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b6f244a6c5b5ee1ec98d1dc95bca46b21641a6fbbda73a785d96f688643e9de8
MD5 bf7b156672713234e4fc19e7350c7ac7
SHA1 5d94734b59e600c7e4451d25da89583868c62032
SHA512 b5162d7729bd02ef0a59142f3819108a5f2446ad3d5b6000ae7a0b301a07ac627134d21121e5d41e9041b7370e34b43a94b68365303866965e138cb0c1b9b8c9
TLSH
T17E51837553B64DD2DB29AA7AF0E9746B32F6806A43073E00E2852F345C05F745BE1113
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c2aa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c2aa.TMP
Size 3KB
SHA256 1502844c270b909b7ef7a3be9b784e27805f5ebb2bc1e4b1faf4b3443792f24b
MD5 9e3f4811a630b42ed0cc475be15c0f83
SHA1 e18878ff638240975e5cd28cc22639bd7d1c28d7
SHA512 cd40c106614eda42e3a544f30e7c4749697011840a6d67417974cad38a978997b6a53ec5ef101ffb6ea275028891157e1905a5d0435595abdc990c95c4b3904c
TLSH
T1F251847553B64DD2DB29AA7AF0E9746B32F6806A43073E00E2852F749C05F745BE1113
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 89f3c014d45dcfe9a4732be25176ad31d70be42fafd3243435a55278a37e60bd
MD5 cf4024dbf012b3d074d0050e7ce5a58c
SHA1 9a75e1a25af9201ef60e7b08feae9aee7c051391
SHA512 fc2350bb77a270894d446ded8e7d403f739290e6749fbf228157cd357f661ac81e33ff2f6278aebb0bd040e3855861cdf2f6e7d1a516b3128d2f0ca43413a05f
TLSH
T16751DEF383E5866DC91156F0AA147E2BCE1D0915832C3C6AC9E4EF1B93E2471E142A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ed226793ff7ef13d80202c31ca5c2bb45b7027dee7ce642e71df4c41f668e408
MD5 af76d42bbb5affb53f1c484f2dfcd568
SHA1 fe4211b18ae67c2b7df5971388e9e0e8c87e1044
SHA512 c1f451eed4c96b609913866185bd289c944c8c598b96bd824fce86ba66d4b99af5294eeb7e0378bdb016283603b819eecb6222efb2e866a0b7176dc2d9e7de58
SSDEEP 192:sxRA/yM/jK1Ml8wCw/fassPo5UZsxzoA8pi/g6+WNIYnY3hGGYrIgtJ:sxRA58w/fasCo5qssi/5I5RI3
TLSH
T18852D9166A249D7BCCCBD209FA557F93D6F91573E2901E44AAFCCA0C04E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b13745398d946797adf32df3a487fbfecfba0fea1354b96eb7fb8f87b7bc4ede
MD5 a994146c55101da582a109ddf5e28804
SHA1 34e66a1646417f0b280ac03b3929b79d5bce221f
SHA512 21c850fbd88868fb3433a69964aa41f6f0dcd0002e26c3c8bcf05d848a5587c9364aeaf837ef1b399a9cbf6740550abfcf4389443c871adf0d21ca0cbc901266
SSDEEP 192:sxRT/yM/jK1Ml8wCw/fasFPo5UZsxzoA8pi/g6+WNIYnY3hGGYrIgDmJ:sxRT58w/fas5o5qssi/5I5RI2
TLSH
T11452D916AA34997BCCCBD209FA557F93D6F91573E2901E44AAFC8A0C04E67DD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3c25a85fa6be0c9c01f75af7e53c969009380ad113ba3abf60b113005689f281
MD5 632dc49f4aabdad6b63d5fba19215f16
SHA1 4f0d983fa46efe1c236a6fad777b01cb0de4b2c4
SHA512 6bda1e13823035dd9b200d37f8252e8047b7771ec1ecc47309e0185364272381c8f2bd179878216d9801bdb21dc92bfba03b5e2ba22761c09d22444e49430292
SSDEEP 192:sxRT/yM/jK1Ml8UQ9Cw/fasFPoAUZsZzoA8prp/g6+WNCIO/Ynm6hGGYrIgDoJ:sxRT7q8w/fas5oAqsk1/5s/zYIA
TLSH
T10862C816AA249D7B9CDBD209FA51BF93D6F91473D2901E44AAFCCA0C04E67DD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 277838556cbc26f6f72f0b4a26efcfbc078732c0900a3e9d8c24c23938e59435
MD5 bddafc79f5a1c4db38a75046c40c6e95
SHA1 e60f2d829aa4fad9f2a120936966fa0ce820ea11
SHA512 e24c3c170290e4b5f07a3e33c430d152713b17e63557ebd4671337b6303bc08705e6f60a6546ea06a855c1760adb4dac9f6771a22c75bcc028478f2e56b0f932
SSDEEP 768:wGedPg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpeOu4YFroSN8KX:wGedPsE7X6WgoufDMu1jaeeOVY+MX
TLSH
T17BE2DB3B680CCB7E4F844ADCEC29BE9FADA801CB96D8895447EA840C03C57EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c3fb2350ee071532523e418a83c1de1c20b83798fdca01f878e182f70cf6f836
MD5 137508631f8f7a4a2e6159a278157341
SHA1 72da79795da04474d768867e6edee254fe4679cd
SHA512 42e4c19d54bbcbb1aa270e65f76929a37beebdc5a52e98cab89dce35c8eba842c902ad7765bb5afc0b9f591203db2128715a2d2d94419862b0c573d5a580713f
SSDEEP 768:6rv+4UNbds3EhDZIO0oGJNzc4ReyIsXqeVH1S5D:6bsbS3UGJtc44bsaEH1Y
TLSH
T1B003DF32A8688977ACF69786B50776537EF8A127C2D81E94C5DE1F0C4A8B5DC130F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 5eafbf9d63568f582af30c68e5a3e05bf600da555846e4f9c82e803919837808
MD5 bcc124de91ee706bef17646176fa1e5e
SHA1 8ef60174db4c5261f50f390faf6dd05321ff65d8
SHA512 799df77ff1c09227949c09aa96c206cdf717272e923913851c2578517c7258485372af73b9ddd2ea92bfde925c973e6dcb25fe750664ec964e6e5cfafa173386
SSDEEP 768:drv+4UNbdv3ZJbDZIO0oGEpNzc4ReyIsPMGeVH1S5F:dbsbN3bGOtc44bskGEH1W
TLSH
T16A13CF32A878DD77ACEAA246F50776937EF8206B81C80E94CAD95F0C0A471DD171F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0766b7f235ebf5cd17937953c58071650d7ae9923a6eb274e3fd240cc8918941
MD5 24a4433f9e6eddb5633a59fb22acf42c
SHA1 b3b0ce077b385df7e00d028129a5ef2c1c1dcaa8
SHA512 03b8c6c00f19b08a9793decacbf00201c8d0654d1b56ab64eb26e9abcea4fe68d2f658cfc0ebeece9e29ed6a01846de011f5d82a9e166fefa0f2324753d4a099
SSDEEP 768:LF1j+9Q3JwgocSZw5O0oGERNzc4ReyIsPMGMjG:K9Q3CGYtc44bskGN
TLSH
T1ED038C36EC65DE6BACE64786FB067696EEE011B3C1C85DC4DAD95E4C04832ED074BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f7a44482d16373d7c32d935a3d664307833ef1844e66b220073a20810c268ba0
MD5 b6aa9523be4a7295e0c6aa5b5c35b1a3
SHA1 7b630314998b9cc38270f275fe9b95521cf55613
SHA512 58f562316f6586d3ec22ca74c28b89bbedd2b3345fae5602c5d70900f38572111b4a7d15eade230de0a001d93cd13596f7c22cc504b5c11838f51ef5adf112f0
SSDEEP 768:9j+9Z36cbDZIO0oGEtNzc4ReyIsPMGMjG:49Z3ZGktc44bskGN
TLSH
T151F2BF72AC69DD67ACE95246FA073692BEF411B7C0C41E84CAED5F0C098339D075B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

671d428c-3114-4b10-af05-ff90be6b32de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\671d428c-3114-4b10-af05-ff90be6b32de.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4152_1926919165\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 3c01a0726652bcf2844d8f773c8363ff7ac8de9b1cd48a83c91bfa71acbc1b07
MD5 ca5613c42c7848dc687fedc2611aaa2a
SHA1 82c935602efd5c30e616c5af1f81ff0fd5b68ed6
SHA512 9279da743e08ac62adff78514e9b7d79a1ae694176581631a1db5c9722fc6dd79dad4114fbee66057d4f98b9f301786c656deb114b1658692678c45e6c2480af
TLSH
T12571C08357A9D6B3C1DA5BF102835644F6BB227C4B6370241BA5594AAA30A7A64B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/424-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/556-500-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/964-483-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1052-292-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1296-359-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1332-387-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1820-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2492-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2640-193-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2688-439-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2904-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3168-407-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3872-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4196-450-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4736-427-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4752-375-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5660-334-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5784-240-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5952-471-0x0000000000010000-0x00000000000AB000-memory.dmp

Download