systex | d917dd08ce19cbfac8bf5c00ed84c9fb1ad6ad83eaef40686eb501ec678b3bfe

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 19:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260702-x91b3sh13p
SHA256 d917dd08ce19cbfac8bf5c00ed84c9fb1ad6ad83eaef40686eb501ec678b3bfe
MD5 c519fbeb89dadd88b1c50fee3e729186
SHA1 bc80733773560ec8fae9579f78aa1edd3356eb72
SHA512 c30443671429a84e3350546dc9803bca2b03387f73cc929588352173a03fb92cc51fd7dc27f2b32e60536696e5c2a44464eece6543650ece8ab9508a163cac0f
SSDEEP 6144:MflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:MflfAsiVGjSGecvX
TLSH
T15E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4504	khcausmkecxupnhf.exe
4744	khcausmkecxupnhf.sys
3884	CreateProcess.exe
360	mkhcaxspnh.exe
5636	CreateProcess.exe
1332	CreateProcess.exe
2312	i_mkhcaxspnh.exe
3424	omhecwupjh.sys
2592	CreateProcess.exe
1320	jhczxrpjhc.exe
6072	CreateProcess.exe
1208	CreateProcess.exe
3216	i_jhczxrpjhc.exe
1892	zwrpjhbzur.sys
2024	CreateProcess.exe
5192	urmjecztro.exe
4660	CreateProcess.exe
4596	CreateProcess.exe
976	i_urmjecztro.exe
2888	qomgebztqo.sys
5460	CreateProcess.exe
2440	wtrmjgbytr.exe
5612	CreateProcess.exe
5160	CreateProcess.exe
5580	i_wtrmjgbytr.exe
5976	dbytrljdbw.sys
3588	CreateProcess.exe
3268	tnlgdytqli.exe
4432	CreateProcess.exe
1104	CreateProcess.exe
5456	i_tnlgdytqli.exe
5872	yvqoigaysq.sys
3472	CreateProcess.exe
2392	qoligayvtn.exe
3820	CreateProcess.exe
6100	CreateProcess.exe
4748	i_qoligayvtn.exe
1260	vsnkigaysq.sys
976	CreateProcess.exe
2556	sqnigavtqk.exe
2888	CreateProcess.exe
5884	CreateProcess.exe
4644	i_sqnigavtqk.exe
5608	aqkicaysqk.sys
5252	CreateProcess.exe
1864	spnifaxsqk.exe
5312	CreateProcess.exe
5588	CreateProcess.exe
4480	i_spnifaxsqk.exe
3124	caxvpnhfcx.sys
616	CreateProcess.exe
1584	dxupfzxupn.exe
1724	CreateProcess.exe
5456	CreateProcess.exe
3968	i_dxupfzxupn.exe
296	ecwupmhfzx.sys
2372	CreateProcess.exe
2784	wupmkecwup.exe
3816	CreateProcess.exe
1728	CreateProcess.exe
3760	i_wupmkecwup.exe
4788	xupmhezxrp.sys
5944	CreateProcess.exe
2000	trpmhbwuom.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxupfzxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlfdyvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicaxvsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifaxvsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrmjgbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlgdytqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtomgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqnigavtqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicaxvsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnifaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnifaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxupfzxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trpmhbwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtomgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtomgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlfdyvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlgdytqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtomgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dayvtoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhcaxspnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhczxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmjecztro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwurmjhezt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhcaxspnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhczxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrmjgbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoligayvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqnigavtqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wupmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dayvtoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmjecztro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoligayvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trpmhbwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifaxvsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwurmjhezt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khcausmkecxupnhf.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4560	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1796	ipconfig.exe
6016	ipconfig.exe
3164	ipconfig.exe
716	ipconfig.exe
4336	ipconfig.exe
4840	ipconfig.exe
1472	ipconfig.exe
5572	ipconfig.exe
4656	ipconfig.exe
4892	ipconfig.exe
6056	ipconfig.exe
5248	ipconfig.exe
2892	ipconfig.exe
4320	ipconfig.exe
4460	ipconfig.exe
6124	ipconfig.exe
5796	ipconfig.exe
1988	ipconfig.exe
4736	ipconfig.exe
4384	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274944457512430"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1797646245-3139070211-3019596475-1000\{B92F37BF-1541-4C00-B331-4EF22588E4E9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4504	khcausmkecxupnhf.exe
4504	khcausmkecxupnhf.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4504	khcausmkecxupnhf.exe
4504	khcausmkecxupnhf.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4504	khcausmkecxupnhf.exe
4504	khcausmkecxupnhf.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4504	khcausmkecxupnhf.exe
4504	khcausmkecxupnhf.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2312	i_mkhcaxspnh.exe
Token: SeDebugPrivilege	3216	i_jhczxrpjhc.exe
Token: SeDebugPrivilege	976	i_urmjecztro.exe
Token: SeDebugPrivilege	5580	i_wtrmjgbytr.exe
Token: SeDebugPrivilege	5456	i_tnlgdytqli.exe
Token: SeDebugPrivilege	4748	i_qoligayvtn.exe
Token: SeDebugPrivilege	4644	i_sqnigavtqk.exe
Token: SeDebugPrivilege	4480	i_spnifaxsqk.exe
Token: SeDebugPrivilege	3968	i_dxupfzxupn.exe
Token: SeDebugPrivilege	3760	i_wupmkecwup.exe
Token: SeDebugPrivilege	2904	i_trpmhbwuom.exe
Token: SeDebugPrivilege	4656	i_wtomgeywqo.exe
Token: SeDebugPrivilege	3148	i_bwtomgeywr.exe
Token: SeDebugPrivilege	4608	i_dayvtoigby.exe
Token: SeDebugPrivilege	2308	i_qnlfdyvtnl.exe
Token: SeDebugPrivilege	3968	i_sqkicaxvsn.exe
Token: SeDebugPrivilege	5604	i_kifaxvsqki.exe
Token: SeDebugPrivilege	2876	i_xspkhcausm.exe
Token: SeDebugPrivilege	3444	i_xrpmhfzxrp.exe
Token: SeDebugPrivilege	3124	i_zwurmjhezt.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4956	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 4504	3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 3000 wrote to memory of 1452	3000	2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 1452 wrote to memory of 4956	1452	iexplore.exe	90
PID 4956 wrote to memory of 2716	4956	msedge.exe	91
PID 4956 wrote to memory of 2928	4956	msedge.exe	92
PID 4956 wrote to memory of 4560	4956	msedge.exe	93
PID 4956 wrote to memory of 2928	4956	msedge.exe	92
PID 4956 wrote to memory of 2928	4956	msedge.exe	92
PID 4956 wrote to memory of 3020	4956	msedge.exe	94
PID 4956 wrote to memory of 3020	4956	msedge.exe	94
PID 4956 wrote to memory of 1084	4956	msedge.exe	96
PID 4956 wrote to memory of 5232	4956	msedge.exe	97
PID 4956 wrote to memory of 1084	4956	msedge.exe	96
PID 4956 wrote to memory of 1084	4956	msedge.exe	96
PID 4956 wrote to memory of 5232	4956	msedge.exe	97
PID 4956 wrote to memory of 5232	4956	msedge.exe	97
PID 4956 wrote to memory of 4332	4956	msedge.exe	98
PID 4956 wrote to memory of 3472	4956	msedge.exe	99
PID 4956 wrote to memory of 4332	4956	msedge.exe	98
PID 4956 wrote to memory of 4332	4956	msedge.exe	98
PID 4956 wrote to memory of 3472	4956	msedge.exe	99
PID 4956 wrote to memory of 3472	4956	msedge.exe	99
PID 4956 wrote to memory of 1548	4956	msedge.exe	100
PID 4956 wrote to memory of 1548	4956	msedge.exe	100
PID 4956 wrote to memory of 3320	4956	msedge.exe	105
PID 4956 wrote to memory of 1972	4956	msedge.exe	104
PID 4956 wrote to memory of 3320	4956	msedge.exe	105
PID 4956 wrote to memory of 1972	4956	msedge.exe	104
PID 4956 wrote to memory of 5872	4956	msedge.exe	107
PID 4504 wrote to memory of 3884	4504	khcausmkecxupnhf.exe	108
PID 4956 wrote to memory of 2556	4956	msedge.exe	110
PID 4956 wrote to memory of 2556	4956	msedge.exe	110
PID 360 wrote to memory of 5636	360	mkhcaxspnh.exe	112
PID 4956 wrote to memory of 5612	4956	msedge.exe	115
PID 4956 wrote to memory of 5612	4956	msedge.exe	115
PID 4504 wrote to memory of 1332	4504	khcausmkecxupnhf.exe	118
PID 4504 wrote to memory of 2592	4504	khcausmkecxupnhf.exe	122
PID 1320 wrote to memory of 6072	1320	jhczxrpjhc.exe	124
PID 4504 wrote to memory of 1208	4504	khcausmkecxupnhf.exe	127
PID 4504 wrote to memory of 2024	4504	khcausmkecxupnhf.exe	131
PID 5192 wrote to memory of 4660	5192	urmjecztro.exe	133
PID 4504 wrote to memory of 4596	4504	khcausmkecxupnhf.exe	136
PID 4504 wrote to memory of 5460	4504	khcausmkecxupnhf.exe	141
PID 2440 wrote to memory of 5612	2440	wtrmjgbytr.exe	143
PID 4504 wrote to memory of 5160	4504	khcausmkecxupnhf.exe	146
PID 4956 wrote to memory of 5704	4956	msedge.exe	148
PID 4956 wrote to memory of 5500	4956	msedge.exe	149
PID 4956 wrote to memory of 3952	4956	msedge.exe	150
PID 4504 wrote to memory of 3588	4504	khcausmkecxupnhf.exe	153
PID 3268 wrote to memory of 4432	3268	tnlgdytqli.exe	155
PID 4504 wrote to memory of 1104	4504	khcausmkecxupnhf.exe	158
PID 4504 wrote to memory of 3472	4504	khcausmkecxupnhf.exe	162
PID 2392 wrote to memory of 3820	2392	qoligayvtn.exe	164
PID 4504 wrote to memory of 6100	4504	khcausmkecxupnhf.exe	167
PID 4504 wrote to memory of 976	4504	khcausmkecxupnhf.exe	171
PID 2556 wrote to memory of 2888	2556	sqnigavtqk.exe	173
PID 4504 wrote to memory of 5884	4504	khcausmkecxupnhf.exe	176
PID 4504 wrote to memory of 5252	4504	khcausmkecxupnhf.exe	180
PID 1864 wrote to memory of 5312	1864	spnifaxsqk.exe	182
PID 4504 wrote to memory of 5588	4504	khcausmkecxupnhf.exe	185
PID 4956 wrote to memory of 2496	4956	msedge.exe	187
PID 4956 wrote to memory of 2496	4956	msedge.exe	187
PID 4504 wrote to memory of 616	4504	khcausmkecxupnhf.exe	192
PID 1584 wrote to memory of 1724	1584	dxupfzxupn.exe	194

C:\Users\Admin\AppData\Local\Temp\2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_c519fbeb89dadd88b1c50fee3e729186_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Temp\khcausmkecxupnhf.exe
  C:\Temp\khcausmkecxupnhf.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkhcaxspnh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3884
  - - C:\Temp\mkhcaxspnh.exe
      C:\Temp\mkhcaxspnh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:360
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5636
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkhcaxspnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1332
  - - C:\Temp\i_mkhcaxspnh.exe
      C:\Temp\i_mkhcaxspnh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2312
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhczxrpjhc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2592
  - - C:\Temp\jhczxrpjhc.exe
      C:\Temp\jhczxrpjhc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1320
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6072
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhczxrpjhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1208
  - - C:\Temp\i_jhczxrpjhc.exe
      C:\Temp\i_jhczxrpjhc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmjecztro.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2024
  - - C:\Temp\urmjecztro.exe
      C:\Temp\urmjecztro.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5192
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4660
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmjecztro.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4596
  - - C:\Temp\i_urmjecztro.exe
      C:\Temp\i_urmjecztro.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtrmjgbytr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5460
  - - C:\Temp\wtrmjgbytr.exe
      C:\Temp\wtrmjgbytr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2440
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5612
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtrmjgbytr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5160
  - - C:\Temp\i_wtrmjgbytr.exe
      C:\Temp\i_wtrmjgbytr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnlgdytqli.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3588
  - - C:\Temp\tnlgdytqli.exe
      C:\Temp\tnlgdytqli.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3268
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4432
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnlgdytqli.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1104
  - - C:\Temp\i_tnlgdytqli.exe
      C:\Temp\i_tnlgdytqli.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoligayvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3472
  - - C:\Temp\qoligayvtn.exe
      C:\Temp\qoligayvtn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2392
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3820
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoligayvtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6100
  - - C:\Temp\i_qoligayvtn.exe
      C:\Temp\i_qoligayvtn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqnigavtqk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:976
  - - C:\Temp\sqnigavtqk.exe
      C:\Temp\sqnigavtqk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2556
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqnigavtqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5884
  - - C:\Temp\i_sqnigavtqk.exe
      C:\Temp\i_sqnigavtqk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spnifaxsqk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5252
  - - C:\Temp\spnifaxsqk.exe
      C:\Temp\spnifaxsqk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spnifaxsqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5588
  - - C:\Temp\i_spnifaxsqk.exe
      C:\Temp\i_spnifaxsqk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxupfzxupn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:616
  - - C:\Temp\dxupfzxupn.exe
      C:\Temp\dxupfzxupn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1584
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1724
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxupfzxupn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5456
  - - C:\Temp\i_dxupfzxupn.exe
      C:\Temp\i_dxupfzxupn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wupmkecwup.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2372
  - - C:\Temp\wupmkecwup.exe
      C:\Temp\wupmkecwup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2784
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3816
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wupmkecwup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1728
  - - C:\Temp\i_wupmkecwup.exe
      C:\Temp\i_wupmkecwup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trpmhbwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5944
  - - C:\Temp\trpmhbwuom.exe
      C:\Temp\trpmhbwuom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2000
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2948
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trpmhbwuom.exe ups_ins
    3⤵
    PID:2580
  - - C:\Temp\i_trpmhbwuom.exe
      C:\Temp\i_trpmhbwuom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtomgeywqo.exe ups_run
    3⤵
    PID:2700
  - - C:\Temp\wtomgeywqo.exe
      C:\Temp\wtomgeywqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2488
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4444
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtomgeywqo.exe ups_ins
    3⤵
    PID:5700
  - - C:\Temp\i_wtomgeywqo.exe
      C:\Temp\i_wtomgeywqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtomgeywr.exe ups_run
    3⤵
    PID:2616
  - - C:\Temp\bwtomgeywr.exe
      C:\Temp\bwtomgeywr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3068
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5592
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwtomgeywr.exe ups_ins
    3⤵
    PID:4552
  - - C:\Temp\i_bwtomgeywr.exe
      C:\Temp\i_bwtomgeywr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dayvtoigby.exe ups_run
    3⤵
    PID:3896
  - - C:\Temp\dayvtoigby.exe
      C:\Temp\dayvtoigby.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4180
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6084
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dayvtoigby.exe ups_ins
    3⤵
    PID:4516
  - - C:\Temp\i_dayvtoigby.exe
      C:\Temp\i_dayvtoigby.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnlfdyvtnl.exe ups_run
    3⤵
    PID:5572
  - - C:\Temp\qnlfdyvtnl.exe
      C:\Temp\qnlfdyvtnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1188
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnlfdyvtnl.exe ups_ins
    3⤵
    PID:696
  - - C:\Temp\i_qnlfdyvtnl.exe
      C:\Temp\i_qnlfdyvtnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkicaxvsn.exe ups_run
    3⤵
    PID:2288
  - - C:\Temp\sqkicaxvsn.exe
      C:\Temp\sqkicaxvsn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4300
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5748
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkicaxvsn.exe ups_ins
    3⤵
    PID:1856
  - - C:\Temp\i_sqkicaxvsn.exe
      C:\Temp\i_sqkicaxvsn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kifaxvsqki.exe ups_run
    3⤵
    PID:1036
  - - C:\Temp\kifaxvsqki.exe
      C:\Temp\kifaxvsqki.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5240
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3380
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kifaxvsqki.exe ups_ins
    3⤵
    PID:2080
  - - C:\Temp\i_kifaxvsqki.exe
      C:\Temp\i_kifaxvsqki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xspkhcausm.exe ups_run
    3⤵
    PID:4636
  - - C:\Temp\xspkhcausm.exe
      C:\Temp\xspkhcausm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4340
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3712
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xspkhcausm.exe ups_ins
    3⤵
    PID:3860
  - - C:\Temp\i_xspkhcausm.exe
      C:\Temp\i_xspkhcausm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpmhfzxrp.exe ups_run
    3⤵
    PID:5488
  - - C:\Temp\xrpmhfzxrp.exe
      C:\Temp\xrpmhfzxrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5860
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3004
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpmhfzxrp.exe ups_ins
    3⤵
    PID:4256
  - - C:\Temp\i_xrpmhfzxrp.exe
      C:\Temp\i_xrpmhfzxrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwurmjhezt.exe ups_run
    3⤵
    PID:5808
  - - C:\Temp\zwurmjhezt.exe
      C:\Temp\zwurmjhezt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4620
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwurmjhezt.exe ups_ins
    3⤵
    PID:5088
  - - C:\Temp\i_zwurmjhezt.exe
      C:\Temp\i_zwurmjhezt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3124
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff961a5c188,0x7ff961a5c194,0x7ff961a5c1a0
      4⤵
      PID:2716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,17490109504131112165,4584768132023827473,262144 --field-trial-handle=2736,i,643252707149527012,13977712230678885570,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:2
      4⤵
      PID:2928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,15098286393474402624,17494888698904059258,524288 --field-trial-handle=2736,i,643252707149527012,13977712230678885570,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:11
      4⤵
      System Time Discovery
      PID:4560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,15707935268621636782,7554317772939401813,524288 --field-trial-handle=2736,i,643252707149527012,13977712230678885570,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:13
      4⤵
      PID:3020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3644,i,12968069053521127757,12628730318947311629,2097152 --field-trial-handle=2736,i,643252707149527012,13977712230678885570,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
      4⤵
      PID:1084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3648,i,10581233033606596312,3204398670223794465,2097152 --field-trial-handle=2736,i,643252707149527012,13977712230678885570,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      PID:5232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,15083382937318945403,2288432671767169559,2097152 --field-trial-handle=2736,i,643252707149527012,13977712230678885570,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
      4⤵
      PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,16216832669419872695,16281696589343380737,2097152 --field-trial-handle=2736,i,643252707149527012,13977712230678885570,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:9
      4⤵
      PID:3472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,4107885495984767797,14204106989559695966,524288 --field-trial-handle=2736,i,643252707149527012,13977712230678885570,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
      4⤵
      PID:1548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,6611124893611676609,2733256928308601373,524288 --field-trial-handle=2736,i,643252707149527012,13977712230678885570,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:14
      4⤵
      PID:1972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,16426123169062540917,757896330661306517,524288 --field-trial-handle=2736,i,643252707149527012,13977712230678885570,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:14
      4⤵
      PID:3320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,11923694811509727007,10129086723978559090,524288 --field-trial-handle=2736,i,643252707149527012,13977712230678885570,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:5744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,11923694811509727007,10129086723978559090,524288 --field-trial-handle=2736,i,643252707149527012,13977712230678885570,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:5872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,3171640906486778777,3614233743769738921,524288 --field-trial-handle=2736,i,643252707149527012,13977712230678885570,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
      4⤵
      PID:2556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,9964346043176474476,16903691311337004788,524288 --field-trial-handle=2736,i,643252707149527012,13977712230678885570,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
      4⤵
      PID:5612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,3369838003602479726,17299518503692892670,524288 --field-trial-handle=2736,i,643252707149527012,13977712230678885570,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
      4⤵
      PID:5704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3848,i,12352091594337423570,11176288964075493648,524288 --field-trial-handle=2736,i,643252707149527012,13977712230678885570,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
      4⤵
      PID:5500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,8716239067008037574,8310589652795190261,524288 --field-trial-handle=2736,i,643252707149527012,13977712230678885570,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
      4⤵
      PID:3952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,1363073641717474497,12499517711421443432,524288 --field-trial-handle=2736,i,643252707149527012,13977712230678885570,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
      4⤵
      PID:2496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,816462607771457780,17627235313676332246,524288 --field-trial-handle=2736,i,643252707149527012,13977712230678885570,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:14
      4⤵
      PID:6108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4484,i,17270123340960701794,17700521987328943381,262144 --field-trial-handle=2736,i,643252707149527012,13977712230678885570,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:10
      4⤵
      PID:1176

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2496

C:\Temp\khcausmkecxupnhf.sys
C:\Temp\khcausmkecxupnhf.sys
1⤵
- Executes dropped EXE
PID:4744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5248

C:\Temp\omhecwupjh.sys
C:\Temp\omhecwupjh.sys
1⤵
- Executes dropped EXE
PID:3424

C:\Temp\zwrpjhbzur.sys
C:\Temp\zwrpjhbzur.sys
1⤵
- Executes dropped EXE
PID:1892

C:\Temp\qomgebztqo.sys
C:\Temp\qomgebztqo.sys
1⤵
- Executes dropped EXE
PID:2888

C:\Temp\dbytrljdbw.sys
C:\Temp\dbytrljdbw.sys
1⤵
- Executes dropped EXE
PID:5976

C:\Temp\yvqoigaysq.sys
C:\Temp\yvqoigaysq.sys
1⤵
- Executes dropped EXE
PID:5872

C:\Temp\vsnkigaysq.sys
C:\Temp\vsnkigaysq.sys
1⤵
- Executes dropped EXE
PID:1260

C:\Temp\aqkicaysqk.sys
C:\Temp\aqkicaysqk.sys
1⤵
- Executes dropped EXE
PID:5608

C:\Temp\caxvpnhfcx.sys
C:\Temp\caxvpnhfcx.sys
1⤵
- Executes dropped EXE
PID:3124

C:\Temp\ecwupmhfzx.sys
C:\Temp\ecwupmhfzx.sys
1⤵
- Executes dropped EXE
PID:296

C:\Temp\xupmhezxrp.sys
C:\Temp\xupmhezxrp.sys
1⤵
- Executes dropped EXE
PID:4788

C:\Temp\ecwuomhezw.sys
C:\Temp\ecwuomhezw.sys
1⤵
PID:4248

C:\Temp\bwuomgeywt.sys
C:\Temp\bwuomgeywt.sys
1⤵
PID:3360

C:\Temp\bytqolgdby.sys
C:\Temp\bytqolgdby.sys
1⤵
PID:3216

C:\Temp\qlidbvtnlf.sys
C:\Temp\qlidbvtnlf.sys
1⤵
PID:4716

C:\Temp\dxvqnlfdxv.sys
C:\Temp\dxvqnlfdxv.sys
1⤵
PID:3576

C:\Temp\fayspnkica.sys
C:\Temp\fayspnkica.sys
1⤵
PID:440

C:\Temp\xspnhfzxsp.sys
C:\Temp\xspnhfzxsp.sys
1⤵
PID:2320

C:\Temp\wuomhecwup.sys
C:\Temp\wuomhecwup.sys
1⤵
PID:3496

C:\Temp\hezxrpmgec.sys
C:\Temp\hezxrpmgec.sys
1⤵
PID:1776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dbytrljdbw.sys

Path C:\Temp\dbytrljdbw.sys
Size 293KB
SHA256 c8669a8fbb931f09fd97a40c8a3a807cad48e5db4bb6e0f734cc4b1112255f7c
MD5 d03a0c0993cb707b9a13e299a0cd18d3
SHA1 d667411f4c4d59c7be1302b98e50cf73497ca3e5
SHA512 fef5b3129a9cb5991fddaf19d84971b9cbebf0932f0721b821f5c9ee5091ec6584fd0c00c8baaf47314ada5fd7ca9cee820beb33d4091dddba7661d818f08701
SSDEEP 3072:itKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:iIJjiJcbI03GBc3ucY5DCSj
TLSH
T10A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhczxrpjhc.exe

Path C:\Temp\i_jhczxrpjhc.exe
Size 361KB
SHA256 544cd0897ea0a256039e21a49a96b407880d7d0cd1947cdac6dd50ba1690d330
MD5 d32306850a3dd81b9ae6755277007cf7
SHA1 783ba60d32ebb9691e17b54ea12412419557c75e
SHA512 cf05f4ae98693303e7db43bb8adaa756ccd7f0056d2135906298eb4ef8740e95630c7d9d16f5bf89475c0779c1f2e8b9d493e7050479ddbe05e0fa15e46d0988
SSDEEP 6144:8flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:8flfAsiVGjSGecvX
TLSH
T16E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkhcaxspnh.exe

Path C:\Temp\i_mkhcaxspnh.exe
Size 361KB
SHA256 0474310a9197d56b2d5a7801fc7f00ab5caf5eb1ea8a6875af46153a1b4dac1e
MD5 57e1a2d40f3069a1ddc2ffbde1d5ada8
SHA1 c0811edec9713a4e5ffe3feb187f4ba2c09abb51
SHA512 415c389047b80a3da0d53c5d2a9921d6a77749ecce3e74dc9fcf66150dce2d9b06c5c1ad0de8e04208b25700004b95e6ef6a729a8790bf529152e0df984b36e9
SSDEEP 6144:jflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:jflfAsiVGjSGecvX
TLSH
T1BE747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoligayvtn.exe

Path C:\Temp\i_qoligayvtn.exe
Size 361KB
SHA256 bd041cbdada159a9ab68f8fbd52dc97dc7eece9588a3ec4e5b9235a0943d1651
MD5 cbb6da3babdb9785ae62e6a25567e9ea
SHA1 ce960c22faec7e8e16cbb6ea8c464c84476ead0a
SHA512 b02e515f04588786c7c73d788397d29365a95fe946aed90fdc95286960126327060f2b7b5cc10f04d8c1414415fd0c06c91892f4d4eac262ff9ff34eb87aeb33
SSDEEP 6144:KflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:KflfAsiVGjSGecvX
TLSH
T1E4747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnlgdytqli.exe

Path C:\Temp\i_tnlgdytqli.exe
Size 361KB
SHA256 66b140c9828c2ff268640a1f27e95497083178c32aa9014a31cbf0d052bed539
MD5 d6752161717ce98acfe29d53c875808a
SHA1 cfff4f0b28497bd0642a90923ec446f42e521d12
SHA512 353026d013dd67d55811293f0fa296ff9dcc81710ce83337948557b011db2ab4bb70e9ddf0f5029ff8499a6978f76bd731f0b7b74bee365a6bd16106fec39ed1
SSDEEP 6144:8flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:8flfAsiVGjSGecvX
TLSH
T167747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urmjecztro.exe

Path C:\Temp\i_urmjecztro.exe
Size 361KB
SHA256 85b8f373e72efe140dfbf32d7e0441fcd7e8a11d2b10c8cbd426e5434a383596
MD5 161c692da0c5676b2c65eeb92bd729d8
SHA1 414ebd4ffc26f017f8ce24483daf3bc02258ac32
SHA512 6e7b10f52f0382a93751d414d3a2127528ab6dfece828e4cdb585c84c28b69738a20335afe6ee8250943045a1477602aa45b47366d9f53ff18f3e313508314db
SSDEEP 6144:VflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:VflfAsiVGjSGecvX
TLSH
T1A5747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wtrmjgbytr.exe

Path C:\Temp\i_wtrmjgbytr.exe
Size 361KB
SHA256 488a0e35a386db5b46ec3afe692ece340eb3e3e250893579a181bf6c99dcec9f
MD5 800d93b0909ee4d4d452d0ff2ef54e66
SHA1 cb95535ca1e2068eee833e5fb0f09c0b8e1a0a8b
SHA512 056c26c1c78c5c87804164995547f665a4dd17ff216b8e7e30e64b19f9886a09199bd302cee1bad7d8e60c50ed70fce6a7125b3b6c1cd66cc0f751f667c313bd
SSDEEP 6144:zflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:zflfAsiVGjSGecvX
TLSH
T1FB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhczxrpjhc.exe

Path C:\Temp\jhczxrpjhc.exe
Size 361KB
SHA256 cab59db2b7eb95f5fc1246374e2d9eda0d187842a41716a7e036da32e68d51fb
MD5 bb33d8c0a669e94fc25f6a2395c3cae2
SHA1 c122535433ee324bd8e583950fe35f9cfd0620f5
SHA512 9874f7e54b4b5ef855d487398dc399737f8e7944eef568b0f3647d27a1c27151b85933449900f340d8f987b57f007af2bad287f3d137ca239726c3b75efc3086
SSDEEP 6144:KflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:KflfAsiVGjSGecvX
TLSH
T151747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khcausmkecxupnhf.exe

Path C:\Temp\khcausmkecxupnhf.exe
Size 361KB
SHA256 3769062695f130f74b0f5833c53d5e932791752f98816aca7f523cfd9ecdcbc2
MD5 857b87c930de36fed1dd71742975d572
SHA1 9fe5864a6512cfc75ba16eec67493641fa8d61d6
SHA512 8da63fbf9a2f742171f732dc654fa435a5d14b88e1e2243c0a3ee4700a431f86c422fabb5aae41fe029d31989adbfc8742be737ac4742342102629c60a2ddbd6
SSDEEP 6144:JflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:JflfAsiVGjSGecvX
TLSH
T17F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khcausmkecxupnhf.sys

Path C:\Temp\khcausmkecxupnhf.sys
Size 293KB
SHA256 5bd9b33787385fc8daa583fde6740e9823e105e30f2e6d879db7c5b433919b87
MD5 8a27e095c09643e9b64a0e706d3868ec
SHA1 d051d312e1fa28a2819237309f641e9b0bcf1b20
SHA512 347f8733f0a2294c9b68947d18873acf63462c611917198883189986b4f17f09cedc42e7bb0cf58b56a02a96b97b5765d18be61a9bbf12598d4ba3bd8aa37f1a
SSDEEP 3072:VtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:VIJjiJcbI03GBc3ucY5DCSj
TLSH
T181545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkhcaxspnh.exe

Path C:\Temp\mkhcaxspnh.exe
Size 361KB
SHA256 de87ee0b49aa6fc3f744b12dadebe46effe9c8054e3f511706525b9c0641e7f7
MD5 86c62db67ff5581de73c01fc9c5d3513
SHA1 9ec3adb5c05d31267ee193ef1ca2a3703452608f
SHA512 ebd7091165fb38d40baba8e4a44827347269fb9608176ed8b64310ca547f345f2b6553a57584aca44561acd175bf59b817c410a23434a5a9c6ad633640cffaf2
SSDEEP 6144:QflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:QflfAsiVGjSGecvX
TLSH
T16F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omhecwupjh.sys

Path C:\Temp\omhecwupjh.sys
Size 293KB
SHA256 d512a37d37ca3ffd468643af7f7e5c21a8296dd00f8f05350eb8e3b8beb44b5c
MD5 5416c567f14cde672fb291ba27642d96
SHA1 369909edc7ef55a1e69412a6b719799a95f48893
SHA512 eb99b589cfed16d341cc27b155da3a53900101f3d9bfbbe315beb3356ca238335f9d08e55402302b7f240c82661ad507bf950a3408a93def395a170ff2c708c5
SSDEEP 3072:GtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:GIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoligayvtn.exe

Path C:\Temp\qoligayvtn.exe
Size 361KB
SHA256 a56c480ffdf0a0fd6e866a8295fb84444141523006989f43bf8e2849ebe8f049
MD5 6342dab1444b5517d6f737c779b6b58d
SHA1 7f033d8101c756bac8eae521b653bea22e17151d
SHA512 7d308f8f1846fd1388726aabb40a2a1584e4021ee577de8dfb72cde9f88c81b913dc7f08a2a211f37332efd1502dbc53a3264e41ecb6ba8d3ef27dbfa5464425
SSDEEP 6144:QflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:QflfAsiVGjSGecvX
TLSH
T156747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qomgebztqo.sys

Path C:\Temp\qomgebztqo.sys
Size 293KB
SHA256 7e20fe4fca577d3f820cce54299d0877d12547d11339d2c35ffccae8c97cd406
MD5 131cc86af8c45f6133aba8be9048b0c1
SHA1 1a3712c3db2652fd5004a364585eab74e46db7b6
SHA512 dd281ce8beecf2e8b94f0b08d83ac68017acb031d0b1137773e4320f2650ea2d4ab0ae92075ab8aa74c2c2d28b2f72489a27b1438b4016d51035e40e63573018
SSDEEP 3072:3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:3IJjiJcbI03GBc3ucY5DCSj
TLSH
T129545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlgdytqli.exe

Path C:\Temp\tnlgdytqli.exe
Size 361KB
SHA256 c714aac25f6c09e81d2126c9b8e776f7f87a48aeef3557cc92abb9c2a5728608
MD5 89fdfb1c0cfa4fcebed58952cd0f30ec
SHA1 c411433e2e91fd0f8e92aec1acfeaa12d87e7582
SHA512 1b74517431b50003495ba487353cf5c71d9c38aad82c395908432f7d308c62dc89ff57c932598c15ba21ce889b5df0e24507e8a46e6c7684478761ab4018cf76
SSDEEP 6144:GflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:GflfAsiVGjSGecvX
TLSH
T18C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmjecztro.exe

Path C:\Temp\urmjecztro.exe
Size 361KB
SHA256 aae9276ab5967e91e6401a38d5b45c5d6feffadbae581318079c8e70831f724a
MD5 7766218f2796913b6cb6a53ef11fc64e
SHA1 ae36932b0bd9394ba75aa382d0776117e9131463
SHA512 80b7190ac466155fc4a9e0278056a25e7b3e4bc2803c7fd6cc2647fcd6aa01f322e24087ddd57a600f508519b9974a8417b3ab8c191af5f331c53ce2a0ab30de
SSDEEP 6144:WflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:WflfAsiVGjSGecvX
TLSH
T1D7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtrmjgbytr.exe

Path C:\Temp\wtrmjgbytr.exe
Size 361KB
SHA256 ccff200a90c99919b8e9e860a403431539ccf38c5277d685ee371f4d0a8cb41e
MD5 e82585bcfc5fc215d87c80132c65b893
SHA1 08ebd3cd0e27be5df418e340a1d8dcb47c98ea3c
SHA512 e60554f32d7076f22848c2bd1f6def13ede6d40182342009a5b1a446b2224909660778ad3fb042bc27a04dbe65a87b8df3c480db984fe61e5b84a482acafdaab
SSDEEP 6144:fflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:fflfAsiVGjSGecvX
TLSH
T1C1747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqoigaysq.sys

Path C:\Temp\yvqoigaysq.sys
Size 293KB
SHA256 cc6ebcf4343717856d759b9eeb884c65ff3da6da240c4f279fa30511b9996255
MD5 fa548c36067a60883d4be87d2acaba67
SHA1 d8f4642e847f98e618420c30bf89302e7c12d7f4
SHA512 aac568147fe5d5dffa93e796fffd45b3787b91bd702fc619e2033699dd0bc5ea319c595ee012b79b218a5257fb4d99a58883d79c2ada414af2da80ed90071bd9
SSDEEP 3072:ctKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:cIJjiJcbI03GBc3ucY5DCSj
TLSH
T188545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwrpjhbzur.sys

Path C:\Temp\zwrpjhbzur.sys
Size 293KB
SHA256 a2d4b2a2a8fafac81d64537bd714f0a69622f43edf4f18825f3437e06c975b21
MD5 601ece23f63682625c9d1fe78f8309a8
SHA1 0a304ffb8fe7e9af0f21e5e1c749255dd460c0e1
SHA512 0194431c451b925d6865341f4fb3ead8281594b7af119c896f7bb450713224cf7017fd1fe2aec7f53b6f5172c9205e6bccbfe6fd9539d3cf0274ce40c2c27655
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9ee8b00c5eccab84404f41fa5a938e6b9e2129213bd97cde6c60973bfccf9540
MD5 0a273f57544ca9c385c90abd2fb2f8b8
SHA1 663d351037054236aaa58a924f66180602045244
SHA512 8a731bd22460fb3b026847be48aab957fe90f0ad7e2dcb291305580f3553409cfdff67355886d3d2f95cd8f8ff1d2726447bc2b96bce2cdcc51a8a15cbcb9d0c
TLSH
T1CFD0C010324DB00CC040203214210360F2309610602B47084020F02CCC78DA173466CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85900118c71217b605d5ac64fa104d9bdf3a2ae1825187ef3a6a9c3ea75946b8
MD5 b694af012c621426ee8e90a8ed586333
SHA1 e839cf90b93d2693f8046fc19ae1373628f0cf99
SHA512 b9142bc76c532d8974de0c5db727ec4870a44225dc222a9fdc138b1278d0f4cb8cef786ed6b936ee6b436177a50e31c07b489d69dd8d25de345ea17638a55e56
TLSH
T188D08055364DB40CC151253254615365F6749651B42B57185460B01CDC78DA173576DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 b32f2bb7a73d0bc4e8096601b654a654cfabb13956d1e91def00d74d50eb6871
MD5 c359c28328173688ce95c041cbbe551e
SHA1 3614754e8089313da277666f12837f767b89fcff
SHA512 0467e712a6685a60c4814008c68a5688a63d246764f14970327914b7c206211fa959dadec83391219097180dcba0b007b5566d7c71b0f465e90db0e30c4f506f
TLSH
T1E731FA580AA03551FBE447F610F17297FF3BA4E9490F7E141D1CB1B44B8AFA97366501
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 067f105d2f5c5c0ff7f3bee0c69678b1fe8c6ead700e1ebc0ddc6fdbe0bbfe4b
MD5 35b204ed82ab785110a90773d020c6a2
SHA1 b14f3920f89d7a2c852c17c468653d6878ea8624
SHA512 185c4709eae6473c02d341be20754509dd3eebd4473dd39d3542fbcd0b95e9ce40c0b656af8e816aebb2a624406e783b77fb51ddfd2778ab7cd0e3eac509bec9
TLSH
T1254190F3C3E8856E890156F4B6147E2BCE1D0915832C3D5AC9E4AF1BA3E34B1E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 85d9678dd5ee95f344a64816c4fcf92522ea567f0efc3cbdf20a30712b08f39f
MD5 45e337c7a04bff46be95c60019e61cfa
SHA1 aa627effa99dfe5d462eebd7178835e35a0f5f08
SHA512 c40e70c4476c2185a3733c72a94e539f5be3cc8a3cf3c5c5c90933e7b05a8fb34a37340cc9e4b33e56804440d8b01188c11827822fd047b6767bee19014fbed6
SSDEEP 192:sxRkRTyM/jK1Ml8wck/ftscQwlrZP2zoA8p93/g6+WNCDw/YHMHMXGuIgtJ:sxRkNCk/ftsc5FPrN/59/Ts3
TLSH
T1F762FA156A28997BCCDBD20DFA557F53D6F90563A2941E04AAFC8B0C01E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9cb48d72d6ad6d9a3132a6d1b4a92cc32b9b004f1a18784986d14d6e100b9f8f
MD5 f244dcea629371e7bdb5210247ef208b
SHA1 5f729d3d484e60c1cdf4ed93a716edaafc080511
SHA512 af8d5f09cc280f4ace107c2582d1a3b589f2e8a6d88fff6efa05b46db9b467cb53228cd63cd5cc5e0aa0b191471d668f4d20396f50fc6e2d059e44a54fbd7515
SSDEEP 192:sxR3RTyM/jK1Ml8wck/ftszQwlrZP2zoA8p93/g6+WNCDw/YHMHMXGuIgDMJ:sxR3NCk/ftsz5FPrN/59/Ts8
TLSH
T11F62FB16AA38997BCCDBD20DFA557F53D6F90563A2941E04A9FC8B0C01E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a968f51775fb1aa0111221ae9a4eefcb7581857452ef92b474f9c453b2de4942
MD5 edc5684a65ce7d905e9a37bc3b0bac07
SHA1 4cace2a236b8490e7c8b5d2fa4d48d80ce2904d5
SHA512 01b19919012bb2eaa988693a136eafcbab93d2430c542a0d183a7afaa38cee6ef505f4b9febc38fb392246516c8dde7ce5de7712f0e4504b52fd742804ea74a6
SSDEEP 192:sxR3RTyM/jK1Ml8UQrck/ftszQwerZP2zoA8pr3/g6+WNCDw/YH3iHMXGuIgDCJ:sxR3Nqwk/ftszSFPrz/59/Hsq
TLSH
T18C62FA16AA289977CCDBD20DFA517F53D6F8456392941E04AAFCCB0C01E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 acbe2b75f5af72dd977823bc86af5d6faa13855caa832b23e5aa30008f24456a
MD5 d3390c5423e6e61b97c58debadcd13ba
SHA1 0a643673455b2f516399b97989ed6958c63626de
SHA512 40c8b142c8d67ff8c0d323ed5a00ce000588f1e02fc1635babdb71a4ead3448ce77a45d1a37d5b8ec696de6a78c6b011641e5258959ddf1fb5a95609cb93bdc3
SSDEEP 768:JOVPHO7pLuL7E1WgesfvQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUK0PE+AMroXIh5:JOVPHOE7E1WgesfvQu1jaPK0c+Si++
TLSH
T10BE2FB3B680CCB7E4F804ADDE82D7D9E6DE802CB5AD8C95447EA880C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ac552d1d2ecf3e74f6f2bba0e1938b02992e730f7e2431fe16d8c990a8bd7ba4
MD5 c82cf20439d536c68bf816e1c1fab131
SHA1 ce7343969b4b402aa60243723be6df65042cd823
SHA512 188c30487cd62ab3f0a2c9dcfc08009d87b028f8115c4efa600464e6506320cafd972b43b690bcc3f79cc2f99a7f20ebadb6b9237ec48d32692ff2a2499d7e92
SSDEEP 96:Kc+4Kby22bKKkEwzc5t7xxNWlqggVNK4sg7NcD7SFR2HRu/bpM:2rZjzc5t7xxolqxVHsg7iD7SFR2HRu/u
TLSH
T17C917550B4BE17403C7D2A0592F9D41A42C370B635ADE47B3BA910AA6F6BF005DFCAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59f2a3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59f2a3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 04da3918207df760844b1d8dd21d84529526b500d7a7c9afebab0b7b58d70cb9
MD5 0cbfc2b8e56f1c22091c0a22156c1910
SHA1 d2b92859449fe8e6972dd803ac9a48bb9292377e
SHA512 15c7cf090aed182fe49857d5724c7e8e650387e90530795000822828f1f2eeab12669c414d5b6a7fd41c94599e2d75568413014d46afdeef762d0d64b5b293cf
SSDEEP 768:cj+913H/sFmR2BEY+PYyDPm6MGjzJUkDl8BvTPabw1:7913HhoCQyDnMixDl0Wbw1
TLSH
T1F2F2CF31AC915EB31CF2CA89B2477B97AFE461A395840E84DADD5F0D028775C234BC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e13ea8c941e34e4fad0beed136aa5556fed27137518ac421f27a116f316577c3
MD5 8392eb0bd4d44b77c7e506269be692cc
SHA1 535360bbfa95b79cd87a8f56740d064167d174a9
SHA512 b66a7c7113eb9d7b6d0341cc562d3440acb1c283de63f8b6be03d01b9de6cfeed2ba9b1e33b82e0776c24363042508df137741fc7081a8468180cba7429c0cd1
SSDEEP 768:Vrv+4UNbdl3FbR2BEePYyDPm6MGjzJ85+8rY0n:Vbsbn3voVQyDnMi8DrY6
TLSH
T19003C0329C946A736CF1CA85364B7A477FF4918396C40F8499DE2F4D429FA6D130B8A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f42f510a2fcc8e6b558a478893b712248e31d4ffde726ad70775851a686415f1
MD5 11c2e62d1c8447156125aa2b3b254a10
SHA1 a38788c3748d34ae951621bf50b21edfd39df8c5
SHA512 76af5a6cd812626a2df36e8d093985e72a18753b07ca038f018e392a408c148907ec2e34b22113da6b422e429acb4463ef5b0065ec69b5ec88e4a17f32a41cc5
SSDEEP 768:Jj+9132/5FmR2BEY+PYyDPm6MGjzJUkDl8BvTPabw1:U9132EoCQyDnMixDl0Wbw1
TLSH
T199F2BF31AC915EB31CB2CA89B2477B97AFE461A395840E84DADD5F0D028775C234BC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 881697d43a5d7365820a23615485669551c90562a8ecc11b678d8adabb2ce738
MD5 a701c8690b3d6adf4e31bb48e96019fe
SHA1 d86256073530543f90e3f8bbcd5c17ae1b3f59fc
SHA512 6a864e54d811ea1ed2458ea5c33e1fe6151ee5d8a2eedfd62801f88638e2853b0f25672d6341bf49d859ff09e8b5b1c00073d5f40c91fa6be45e1572bfe07dd4
SSDEEP 768:DF1j+9p3GwgC/1FORBEYOPYyDPm6MGjzJUkDl8BvTPabw1:S9p3lOSQyDnMixDl0Wbw1
TLSH
T1751328F198D38A77D8AE8B87633E6E469ABCD153B5840980B7C81E4CCC8727FC346855
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4956_1792785121\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 e27e90b9d7e450adaccbe4cb6f6e27f5cb0498be5b8916f0c3730db5a6754025
MD5 d5d381d56998606baac34aa64a51e7ec
SHA1 4781dd2c699779c0755d709b15396e0059498bbd
SHA512 6f93b30b60d35d3a04ff7bc80c8c4021d354ff6282544ef35cfa3e32a785243b59ccd7b7c7bc6ded90aa1c6627aa42aecc2dfe34505c9474f72a0edce8753240
TLSH
T16D71008356ADD5B2C1DA5FF102835644F1BB2238072320214B55594AAA34A7A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/296-349-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/440-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1260-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1776-444-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1892-246-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2320-428-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2888-271-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3124-336-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3216-412-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3360-408-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3424-199-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3496-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3576-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4248-394-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4716-416-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4744-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4788-396-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4788-374-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5608-330-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5872-299-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5976-284-0x0000000000010000-0x00000000000AB000-memory.dmp

Download