systex | 383f70a187f6b9221f53446d1c91301d93374833b4b7c383c6f97cce8a59f1ce

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260705-tk28lahv2k
SHA256 383f70a187f6b9221f53446d1c91301d93374833b4b7c383c6f97cce8a59f1ce
MD5 68ab1951f29d121ce4547f112013e3bb
SHA1 dfd88448682e9ad71e5353078c39413bf683904d
SHA512 4326a7f47ea3bcbc4ef16f6800857e3c5bb4804225608b648b918a1de272345f917b35d3dedb2833d0544ce774844c68a9128ebe100ee7dbc3e6aa73fa84ebe0
SSDEEP 6144:BflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:BflfAsiVGjSGecvX
TLSH
T179747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3276	czurmkecwupjhbzu.exe
2104	czurmkecwupjhbzu.sys
1344	CreateProcess.exe
4588	czurpjhzwu.exe
5788	CreateProcess.exe
5692	CreateProcess.exe
3924	i_czurpjhzwu.exe
4224	trmjecwuom.sys
4888	CreateProcess.exe
4892	jgezwuomge.exe
1152	CreateProcess.exe
3928	CreateProcess.exe
5808	i_jgezwuomge.exe
1508	rljetolgey.sys
4596	CreateProcess.exe
2728	bwtoljdbwt.exe
3740	CreateProcess.exe
2420	CreateProcess.exe
5324	i_bwtoljdbwt.exe
3512	bytrlgeyvt.sys
3224	CreateProcess.exe
5088	lgeywqoigb.exe
4200	CreateProcess.exe
1492	CreateProcess.exe
3924	i_lgeywqoigb.exe
1780	vtqljdbvtn.sys
1356	CreateProcess.exe
2964	qlidavtqli.exe
2640	CreateProcess.exe
2052	CreateProcess.exe
944	i_qlidavtqli.exe
428	gaysqnifdx.sys
2516	CreateProcess.exe
6088	davtnkicay.exe
4808	CreateProcess.exe
5384	CreateProcess.exe
5460	i_davtnkicay.exe
2124	sqkifdxvpn.sys
5276	CreateProcess.exe
5236	spnhfaxvsn.exe
3788	CreateProcess.exe
5024	CreateProcess.exe
1988	i_spnhfaxvsn.exe
1060	khfaxsqkic.sys
5820	CreateProcess.exe
4932	caxspkhczu.exe
2072	CreateProcess.exe
5112	CreateProcess.exe
2924	i_caxspkhczu.exe
1708	nhfzxrpjhf.sys
5808	CreateProcess.exe
2596	hczxrpmkec.exe
5644	CreateProcess.exe
772	CreateProcess.exe
2976	i_hczxrpmkec.exe
3820	xrpjhbzwrm.sys
4824	CreateProcess.exe
4960	pjhbztrpjh.exe
5656	CreateProcess.exe
1060	CreateProcess.exe
3128	i_pjhbztrpjh.exe
4244	eywtrmjdbz.sys
5984	CreateProcess.exe
1716	gebztromge.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_426677212\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_244927919\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_981836196\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_981836196\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_1897803611\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_426677212\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_244927919\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_981836196\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_981836196\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtnlgdbvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkifaxspnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgezwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gebztromge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhczxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurmkecwupjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czurpjhzwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbztrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdavqnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurpjhzwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlidavtqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqoigdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlidavtqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnhfaxvsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczxrpmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtnlgdbvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhezxrpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjebwuomj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgezwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtoljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnkicay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnkicay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caxspkhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczxrpmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqoigdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtoljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caxspkhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gebztromge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhczxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhezxrpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjebwuomj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnhfaxvsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdavqnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkifaxspnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbztrpjh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2556	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1812	ipconfig.exe
3368	ipconfig.exe
1120	ipconfig.exe
5896	ipconfig.exe
1300	ipconfig.exe
2700	ipconfig.exe
5892	ipconfig.exe
1548	ipconfig.exe
5680	ipconfig.exe
5460	ipconfig.exe
2956	ipconfig.exe
4456	ipconfig.exe
5916	ipconfig.exe
2880	ipconfig.exe
3500	ipconfig.exe
3964	ipconfig.exe
2956	ipconfig.exe
5308	ipconfig.exe
3208	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277412807493755"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{E2007ACE-0D2D-4347-AA76-41BC73BB8285}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3276	czurmkecwupjhbzu.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3276	czurmkecwupjhbzu.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3276	czurmkecwupjhbzu.exe
3276	czurmkecwupjhbzu.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3276	czurmkecwupjhbzu.exe
3276	czurmkecwupjhbzu.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3276	czurmkecwupjhbzu.exe
3276	czurmkecwupjhbzu.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3276	czurmkecwupjhbzu.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3276	czurmkecwupjhbzu.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3276	czurmkecwupjhbzu.exe
2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3276	czurmkecwupjhbzu.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3924	i_czurpjhzwu.exe
Token: SeDebugPrivilege	5808	i_jgezwuomge.exe
Token: SeDebugPrivilege	5324	i_bwtoljdbwt.exe
Token: SeDebugPrivilege	3924	i_lgeywqoigb.exe
Token: SeDebugPrivilege	944	i_qlidavtqli.exe
Token: SeDebugPrivilege	5460	i_davtnkicay.exe
Token: SeDebugPrivilege	1988	i_spnhfaxvsn.exe
Token: SeDebugPrivilege	2924	i_caxspkhczu.exe
Token: SeDebugPrivilege	2976	i_hczxrpmkec.exe
Token: SeDebugPrivilege	3128	i_pjhbztrpjh.exe
Token: SeDebugPrivilege	5240	i_gebztromge.exe
Token: SeDebugPrivilege	5296	i_tqoigdywqo.exe
Token: SeDebugPrivilege	5660	i_yvtnlgdbvq.exe
Token: SeDebugPrivilege	1516	i_tnlfdavqnl.exe
Token: SeDebugPrivilege	1992	i_nkifaxspnh.exe
Token: SeDebugPrivilege	1980	i_nhfzxupnhf.exe
Token: SeDebugPrivilege	3428	i_xrpjhczxrp.exe
Token: SeDebugPrivilege	5648	i_pmhezxrpmh.exe
Token: SeDebugPrivilege	4108	i_omjebwuomj.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4904	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 3276	2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 2668 wrote to memory of 912	2668	2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 912 wrote to memory of 4904	912	iexplore.exe	90
PID 4904 wrote to memory of 4828	4904	msedge.exe	91
PID 4904 wrote to memory of 3960	4904	msedge.exe	92
PID 4904 wrote to memory of 2556	4904	msedge.exe	93
PID 4904 wrote to memory of 3960	4904	msedge.exe	92
PID 4904 wrote to memory of 3960	4904	msedge.exe	92
PID 4904 wrote to memory of 2436	4904	msedge.exe	94
PID 4904 wrote to memory of 2436	4904	msedge.exe	94
PID 4904 wrote to memory of 5360	4904	msedge.exe	96
PID 4904 wrote to memory of 5360	4904	msedge.exe	96
PID 4904 wrote to memory of 5360	4904	msedge.exe	96
PID 4904 wrote to memory of 2360	4904	msedge.exe	97
PID 4904 wrote to memory of 2360	4904	msedge.exe	97
PID 4904 wrote to memory of 2360	4904	msedge.exe	97
PID 4904 wrote to memory of 2460	4904	msedge.exe	98
PID 4904 wrote to memory of 2460	4904	msedge.exe	98
PID 4904 wrote to memory of 2460	4904	msedge.exe	98
PID 4904 wrote to memory of 5644	4904	msedge.exe	99
PID 4904 wrote to memory of 5644	4904	msedge.exe	99
PID 4904 wrote to memory of 5644	4904	msedge.exe	99
PID 4904 wrote to memory of 5404	4904	msedge.exe	100
PID 4904 wrote to memory of 5404	4904	msedge.exe	100
PID 4904 wrote to memory of 5404	4904	msedge.exe	100
PID 4904 wrote to memory of 3796	4904	msedge.exe	102
PID 4904 wrote to memory of 3796	4904	msedge.exe	102
PID 4904 wrote to memory of 1100	4904	msedge.exe	105
PID 4904 wrote to memory of 1100	4904	msedge.exe	105
PID 4904 wrote to memory of 1100	4904	msedge.exe	105
PID 3276 wrote to memory of 1344	3276	czurmkecwupjhbzu.exe	106
PID 4904 wrote to memory of 1000	4904	msedge.exe	108
PID 4904 wrote to memory of 5796	4904	msedge.exe	109
PID 4904 wrote to memory of 1000	4904	msedge.exe	108
PID 4904 wrote to memory of 5796	4904	msedge.exe	109
PID 4588 wrote to memory of 5788	4588	czurpjhzwu.exe	112
PID 4904 wrote to memory of 1516	4904	msedge.exe	113
PID 4904 wrote to memory of 4804	4904	msedge.exe	116
PID 4904 wrote to memory of 4804	4904	msedge.exe	116
PID 4904 wrote to memory of 5832	4904	msedge.exe	119
PID 4904 wrote to memory of 5832	4904	msedge.exe	119
PID 3276 wrote to memory of 5692	3276	czurmkecwupjhbzu.exe	120
PID 3276 wrote to memory of 4888	3276	czurmkecwupjhbzu.exe	124
PID 4892 wrote to memory of 1152	4892	jgezwuomge.exe	126
PID 3276 wrote to memory of 3928	3276	czurmkecwupjhbzu.exe	129
PID 3276 wrote to memory of 4596	3276	czurmkecwupjhbzu.exe	133
PID 2728 wrote to memory of 3740	2728	bwtoljdbwt.exe	135
PID 3276 wrote to memory of 2420	3276	czurmkecwupjhbzu.exe	138
PID 4904 wrote to memory of 1504	4904	msedge.exe	140
PID 4904 wrote to memory of 1504	4904	msedge.exe	140
PID 4904 wrote to memory of 1504	4904	msedge.exe	140
PID 3276 wrote to memory of 3224	3276	czurmkecwupjhbzu.exe	144
PID 5088 wrote to memory of 4200	5088	lgeywqoigb.exe	146
PID 3276 wrote to memory of 1492	3276	czurmkecwupjhbzu.exe	149
PID 4904 wrote to memory of 2812	4904	msedge.exe	151
PID 4904 wrote to memory of 1148	4904	msedge.exe	152
PID 4904 wrote to memory of 3308	4904	msedge.exe	153
PID 3276 wrote to memory of 1356	3276	czurmkecwupjhbzu.exe	156
PID 2964 wrote to memory of 2640	2964	qlidavtqli.exe	158
PID 3276 wrote to memory of 2052	3276	czurmkecwupjhbzu.exe	161
PID 3276 wrote to memory of 2516	3276	czurmkecwupjhbzu.exe	165
PID 6088 wrote to memory of 4808	6088	davtnkicay.exe	167
PID 3276 wrote to memory of 5384	3276	czurmkecwupjhbzu.exe	170
PID 3276 wrote to memory of 5276	3276	czurmkecwupjhbzu.exe	174

C:\Users\Admin\AppData\Local\Temp\2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_68ab1951f29d121ce4547f112013e3bb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Temp\czurmkecwupjhbzu.exe
  C:\Temp\czurmkecwupjhbzu.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czurpjhzwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1344
  - - C:\Temp\czurpjhzwu.exe
      C:\Temp\czurpjhzwu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4588
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5788
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czurpjhzwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5692
  - - C:\Temp\i_czurpjhzwu.exe
      C:\Temp\i_czurpjhzwu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgezwuomge.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4888
  - - C:\Temp\jgezwuomge.exe
      C:\Temp\jgezwuomge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4892
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1152
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgezwuomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3928
  - - C:\Temp\i_jgezwuomge.exe
      C:\Temp\i_jgezwuomge.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtoljdbwt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4596
  - - C:\Temp\bwtoljdbwt.exe
      C:\Temp\bwtoljdbwt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2728
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3740
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwtoljdbwt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2420
  - - C:\Temp\i_bwtoljdbwt.exe
      C:\Temp\i_bwtoljdbwt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgeywqoigb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3224
  - - C:\Temp\lgeywqoigb.exe
      C:\Temp\lgeywqoigb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5088
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgeywqoigb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1492
  - - C:\Temp\i_lgeywqoigb.exe
      C:\Temp\i_lgeywqoigb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qlidavtqli.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1356
  - - C:\Temp\qlidavtqli.exe
      C:\Temp\qlidavtqli.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2964
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2640
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qlidavtqli.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2052
  - - C:\Temp\i_qlidavtqli.exe
      C:\Temp\i_qlidavtqli.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\davtnkicay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2516
  - - C:\Temp\davtnkicay.exe
      C:\Temp\davtnkicay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6088
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4808
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_davtnkicay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5384
  - - C:\Temp\i_davtnkicay.exe
      C:\Temp\i_davtnkicay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spnhfaxvsn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5276
  - - C:\Temp\spnhfaxvsn.exe
      C:\Temp\spnhfaxvsn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5236
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3788
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spnhfaxvsn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5024
  - - C:\Temp\i_spnhfaxvsn.exe
      C:\Temp\i_spnhfaxvsn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\caxspkhczu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5820
  - - C:\Temp\caxspkhczu.exe
      C:\Temp\caxspkhczu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4932
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2072
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_caxspkhczu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5112
  - - C:\Temp\i_caxspkhczu.exe
      C:\Temp\i_caxspkhczu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczxrpmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5808
  - - C:\Temp\hczxrpmkec.exe
      C:\Temp\hczxrpmkec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2596
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5644
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczxrpmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:772
  - - C:\Temp\i_hczxrpmkec.exe
      C:\Temp\i_hczxrpmkec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhbztrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4824
  - - C:\Temp\pjhbztrpjh.exe
      C:\Temp\pjhbztrpjh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5656
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhbztrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1060
  - - C:\Temp\i_pjhbztrpjh.exe
      C:\Temp\i_pjhbztrpjh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gebztromge.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5984
  - - C:\Temp\gebztromge.exe
      C:\Temp\gebztromge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1716
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6080
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gebztromge.exe ups_ins
    3⤵
    PID:1860
  - - C:\Temp\i_gebztromge.exe
      C:\Temp\i_gebztromge.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqoigdywqo.exe ups_run
    3⤵
    PID:5776
  - - C:\Temp\tqoigdywqo.exe
      C:\Temp\tqoigdywqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3032
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5548
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqoigdywqo.exe ups_ins
    3⤵
    PID:4168
  - - C:\Temp\i_tqoigdywqo.exe
      C:\Temp\i_tqoigdywqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvtnlgdbvq.exe ups_run
    3⤵
    PID:5128
  - - C:\Temp\yvtnlgdbvq.exe
      C:\Temp\yvtnlgdbvq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5840
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3544
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvtnlgdbvq.exe ups_ins
    3⤵
    PID:1804
  - - C:\Temp\i_yvtnlgdbvq.exe
      C:\Temp\i_yvtnlgdbvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnlfdavqnl.exe ups_run
    3⤵
    PID:696
  - - C:\Temp\tnlfdavqnl.exe
      C:\Temp\tnlfdavqnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1844
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5976
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnlfdavqnl.exe ups_ins
    3⤵
    PID:612
  - - C:\Temp\i_tnlfdavqnl.exe
      C:\Temp\i_tnlfdavqnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkifaxspnh.exe ups_run
    3⤵
    PID:4208
  - - C:\Temp\nkifaxspnh.exe
      C:\Temp\nkifaxspnh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2196
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1740
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkifaxspnh.exe ups_ins
    3⤵
    PID:3936
  - - C:\Temp\i_nkifaxspnh.exe
      C:\Temp\i_nkifaxspnh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfzxupnhf.exe ups_run
    3⤵
    PID:4856
  - - C:\Temp\nhfzxupnhf.exe
      C:\Temp\nhfzxupnhf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5764
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4404
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfzxupnhf.exe ups_ins
    3⤵
    PID:3436
  - - C:\Temp\i_nhfzxupnhf.exe
      C:\Temp\i_nhfzxupnhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpjhczxrp.exe ups_run
    3⤵
    PID:1300
  - - C:\Temp\xrpjhczxrp.exe
      C:\Temp\xrpjhczxrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2752
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6028
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpjhczxrp.exe ups_ins
    3⤵
    PID:5000
  - - C:\Temp\i_xrpjhczxrp.exe
      C:\Temp\i_xrpjhczxrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmhezxrpmh.exe ups_run
    3⤵
    PID:4276
  - - C:\Temp\pmhezxrpmh.exe
      C:\Temp\pmhezxrpmh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5240
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1516
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmhezxrpmh.exe ups_ins
    3⤵
    PID:3724
  - - C:\Temp\i_pmhezxrpmh.exe
      C:\Temp\i_pmhezxrpmh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omjebwuomj.exe ups_run
    3⤵
    PID:1704
  - - C:\Temp\omjebwuomj.exe
      C:\Temp\omjebwuomj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4504
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5316
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omjebwuomj.exe ups_ins
    3⤵
    PID:3512
  - - C:\Temp\i_omjebwuomj.exe
      C:\Temp\i_omjebwuomj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4108
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd7131c188,0x7ffd7131c194,0x7ffd7131c1a0
      4⤵
      PID:4828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,9468532601960719319,8207230841581389875,262144 --field-trial-handle=2608,i,5302780977485219971,9598038038618959986,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:2
      4⤵
      PID:3960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,5018906900815582112,1664613261598989317,524288 --field-trial-handle=2608,i,5302780977485219971,9598038038618959986,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:11
      4⤵
      System Time Discovery
      PID:2556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,3917844083758758786,1324737638828104419,524288 --field-trial-handle=2608,i,5302780977485219971,9598038038618959986,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:13
      4⤵
      PID:2436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,18309701492711751217,13903156532310883918,2097152 --field-trial-handle=2608,i,5302780977485219971,9598038038618959986,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:5360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,6804250922801041049,7938676884067722967,2097152 --field-trial-handle=2608,i,5302780977485219971,9598038038618959986,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:2360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,16189190814193989859,3030995228867505044,2097152 --field-trial-handle=2608,i,5302780977485219971,9598038038618959986,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:1
      4⤵
      PID:2460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,17407641676412793148,5405369919225571325,2097152 --field-trial-handle=2608,i,5302780977485219971,9598038038618959986,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:9
      4⤵
      PID:5644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5268,i,5050683890369332335,8932402499430571422,2097152 --field-trial-handle=2608,i,5302780977485219971,9598038038618959986,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
      4⤵
      PID:5404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,12630598671010888680,4177693318947762425,524288 --field-trial-handle=2608,i,5302780977485219971,9598038038618959986,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
      4⤵
      PID:3796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3792,i,10936740662428928244,13284694501690598895,2097152 --field-trial-handle=2608,i,5302780977485219971,9598038038618959986,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
      4⤵
      PID:1100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,10531558793357343988,10130978701832847625,524288 --field-trial-handle=2608,i,5302780977485219971,9598038038618959986,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14
      4⤵
      PID:1000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3868,i,6682520400314510174,9520370445565714188,524288 --field-trial-handle=2608,i,5302780977485219971,9598038038618959986,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
      4⤵
      PID:5796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,4016312190864471797,6742299273195926010,524288 --field-trial-handle=2608,i,5302780977485219971,9598038038618959986,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,4016312190864471797,6742299273195926010,524288 --field-trial-handle=2608,i,5302780977485219971,9598038038618959986,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:1516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,1954890161148979050,4589797297119699547,524288 --field-trial-handle=2608,i,5302780977485219971,9598038038618959986,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
      4⤵
      PID:4804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,15280990223513416460,2841649611743687535,524288 --field-trial-handle=2608,i,5302780977485219971,9598038038618959986,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
      4⤵
      PID:5832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5384,i,4319283086307884527,3566510692672145334,2097152 --field-trial-handle=2608,i,5302780977485219971,9598038038618959986,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
      4⤵
      PID:1504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,6993092503210210851,12106312563217270948,524288 --field-trial-handle=2608,i,5302780977485219971,9598038038618959986,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
      4⤵
      PID:2812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,12290179176488342958,4864813629832102406,524288 --field-trial-handle=2608,i,5302780977485219971,9598038038618959986,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
      4⤵
      PID:1148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,12383293442090540842,16485887371250015278,524288 --field-trial-handle=2608,i,5302780977485219971,9598038038618959986,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
      4⤵
      PID:3308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,2012117303403378064,15391890043296399685,524288 --field-trial-handle=2608,i,5302780977485219971,9598038038618959986,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:14
      4⤵
      PID:884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5480,i,11298197124564189706,5241009352794847064,2097152 --field-trial-handle=2608,i,5302780977485219971,9598038038618959986,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:1
      4⤵
      PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,14805747381091563601,13606900939300633955,524288 --field-trial-handle=2608,i,5302780977485219971,9598038038618959986,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:14
      4⤵
      PID:2536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,50699475822897301,17434886713550558063,524288 --field-trial-handle=2608,i,5302780977485219971,9598038038618959986,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
      4⤵
      PID:4408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,18147099112190990507,13558560878580809154,524288 --field-trial-handle=2608,i,5302780977485219971,9598038038618959986,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
      4⤵
      PID:1192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6808,i,7691613668290130928,6106952874318773901,262144 --field-trial-handle=2608,i,5302780977485219971,9598038038618959986,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:10
      4⤵
      PID:3000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,12035761866982386758,13731052114537776939,524288 --field-trial-handle=2608,i,5302780977485219971,9598038038618959986,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:14
      4⤵
      PID:1472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5668,i,7915432632379097252,11829220265974470994,2097152 --field-trial-handle=2608,i,5302780977485219971,9598038038618959986,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
      4⤵
      PID:820

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4284

C:\Temp\czurmkecwupjhbzu.sys
C:\Temp\czurmkecwupjhbzu.sys
1⤵
- Executes dropped EXE
PID:2104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2956

C:\Temp\trmjecwuom.sys
C:\Temp\trmjecwuom.sys
1⤵
- Executes dropped EXE
PID:4224

C:\Temp\rljetolgey.sys
C:\Temp\rljetolgey.sys
1⤵
- Executes dropped EXE
PID:1508

C:\Temp\bytrlgeyvt.sys
C:\Temp\bytrlgeyvt.sys
1⤵
- Executes dropped EXE
PID:3512

C:\Temp\vtqljdbvtn.sys
C:\Temp\vtqljdbvtn.sys
1⤵
- Executes dropped EXE
PID:1780

C:\Temp\gaysqnifdx.sys
C:\Temp\gaysqnifdx.sys
1⤵
- Executes dropped EXE
PID:428

C:\Temp\sqkifdxvpn.sys
C:\Temp\sqkifdxvpn.sys
1⤵
- Executes dropped EXE
PID:2124

C:\Temp\khfaxsqkic.sys
C:\Temp\khfaxsqkic.sys
1⤵
- Executes dropped EXE
PID:1060

C:\Temp\nhfzxrpjhf.sys
C:\Temp\nhfzxrpjhf.sys
1⤵
- Executes dropped EXE
PID:1708

C:\Temp\xrpjhbzwrm.sys
C:\Temp\xrpjhbzwrm.sys
1⤵
- Executes dropped EXE
PID:3820

C:\Temp\eywtrmjdbz.sys
C:\Temp\eywtrmjdbz.sys
1⤵
- Executes dropped EXE
PID:4244

C:\Temp\ljhbytrljd.sys
C:\Temp\ljhbytrljd.sys
1⤵
PID:1520

C:\Temp\bytqligbyt.sys
C:\Temp\bytqligbyt.sys
1⤵
PID:1500

C:\Temp\vtnlfdxvtn.sys
C:\Temp\vtnlfdxvtn.sys
1⤵
PID:1476

C:\Temp\nifaxvsqki.sys
C:\Temp\nifaxvsqki.sys
1⤵
PID:3408

C:\Temp\qkifaxsqki.sys
C:\Temp\qkifaxsqki.sys
1⤵
PID:2132

C:\Temp\hcxusmkfcx.sys
C:\Temp\hcxusmkfcx.sys
1⤵
PID:2180

C:\Temp\omkecwupmk.sys
C:\Temp\omkecwupmk.sys
1⤵
PID:2564

C:\Temp\wuomgezwro.sys
C:\Temp\wuomgezwro.sys
1⤵
PID:3044

C:\Temp\trljdbwtom.sys
C:\Temp\trljdbwtom.sys
1⤵
PID:4748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bwtoljdbwt.exe

Path C:\Temp\bwtoljdbwt.exe
Size 361KB
SHA256 a78138bf218a113dbb31fa3f84b376a2685d685f813d0d2aafdb95b0c79ad47c
MD5 3105af29290df8cd178bc1aedfef332c
SHA1 ed7344ae6cc4955941d8d065678f78a201067d3f
SHA512 e99c3cf18daae6cff8c7fee09d9077ebbb80572e071cd2ebc83969a994d825db24c528df7829427fb150e45667892a75f02e59c0724722aca0668d27bf8bf7fc
SSDEEP 6144:iflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:iflfAsiVGjSGecvX
TLSH
T1F2747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytrlgeyvt.sys

Path C:\Temp\bytrlgeyvt.sys
Size 293KB
SHA256 6a7555f76e9e833837abb5d6a43398b41a2dd5debfedd5c7ff9dfd9fdd862ed5
MD5 ff8347d8e80e245b46ba541541cb3c3f
SHA1 710ae258baf7b14c2e86fb247bd1110c5b055f5c
SHA512 ddb6af95061f9bc54984b5c08b5ef6df7439ca1a1f6ad7b9cfb5bc3a941120785a6cd691b0032e9381806d42422f87c914f7b3c181da64c47c4140cad9c90b59
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T105545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czurmkecwupjhbzu.exe

Path C:\Temp\czurmkecwupjhbzu.exe
Size 361KB
SHA256 83c2a7c4e4000a7c6efe1fccdee7e6e01f8f18ddd1cfa36b57a27be8aa51c4a4
MD5 e010190453cbf2b04c50378af4098c70
SHA1 e82da4ab4544813295bcb702bf5bd394d5347a11
SHA512 b8377dd898bc59a2744df89d103ab70a40d04ac93d027f225f7b1c6ae0dff98c8eba778e50b1127d581d25610590fdb286f1e15b8ba6c75c2899caed0312658f
SSDEEP 6144:IflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:IflfAsiVGjSGecvX
TLSH
T13B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czurmkecwupjhbzu.sys

Path C:\Temp\czurmkecwupjhbzu.sys
Size 293KB
SHA256 c4df11c00af198c5e2769efcc3bcb91e728fc9b6a449e0275263700e1e79d8d7
MD5 8161b10a2182185def050c8eacaaca74
SHA1 2899e049aa1feb1a57b479f6089da4f22feb9b2b
SHA512 26d681780fbbc61502efb2946a2671722523a122df4f6f73dc69b4aa251ef54e1abd09909f60b541dee1ebcb520ffb1fd6280bdea98c1ba9038a71897e39912c
SSDEEP 3072:RtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:RIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czurpjhzwu.exe

Path C:\Temp\czurpjhzwu.exe
Size 361KB
SHA256 3b75731f8aa8177e726fdb5251618e3e18108425cc00c1b080f0516c15c38ddd
MD5 1a81d29558552e22eea3bd2a8dff67aa
SHA1 df06da9ff54f840aff62cd4dec578a0e7fd42c64
SHA512 cf7d39a5e80ab0597910eb80a85eb3132ad68b5bb46a0c2f0ecf62d7951a5b47a7a93e9454508d9bac8528d81fe17725fbbb0d361b9a4560a3deceeaa3cec2dd
SSDEEP 6144:uflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:uflfAsiVGjSGecvX
TLSH
T1BD747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

davtnkicay.exe

Path C:\Temp\davtnkicay.exe
Size 361KB
SHA256 09e8b10f2cae4cfc099d33db9bf4622915eb1a6e54d1f7da624f1f7393d6fc7e
MD5 f6d1b2023b17486d63cc2dc0c77a6c26
SHA1 786d21f29b7a02ad7f4a0f1de71154147c4032d5
SHA512 8ca41b33969960b962c1f7b0d2ddf9b4b3e1badb21d38d378baa9d2c633ea4cd9c080ad589be76559c752fadc5d0557bad43310bd6e30008ca7710d45830294e
SSDEEP 6144:fflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:fflfAsiVGjSGecvX
TLSH
T1C9747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaysqnifdx.sys

Path C:\Temp\gaysqnifdx.sys
Size 293KB
SHA256 5306f340f8aaeb7cecc4d1ca90baa019993a675614f2212f31f15edfc3874abf
MD5 d1af6dd39e39ae7b1560c439bfca3fba
SHA1 e2e81ea9f9c6ca14c0d66e31102aec0843294a4e
SHA512 011147f361878a96959f46062861870e19baad23178ed0275b735d4521e8ba2b0a566ce96e08ea1ef83d39a9b1c48e9fb5eae4047419b1514187a95eea8ff85a
SSDEEP 3072:4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:4IJjiJcbI03GBc3ucY5DCSj
TLSH
T12D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bwtoljdbwt.exe

Path C:\Temp\i_bwtoljdbwt.exe
Size 361KB
SHA256 a293db8782361bd2b573d80d62150f7c14fa18733d5760fa5916ae8f1df967c8
MD5 10ccfd48ac6722182e2dbed3998e7851
SHA1 88db3456571965adb4eb3ed3cd6e43e268089d36
SHA512 e238a4e3535b6631213be20abba53d7c68350621dda7ab16d7fc4a1f8f54c219bb1492bd4ede0d6455040f698747e834dc7a8d5331fd2b43ffb6d520292743f5
SSDEEP 6144:zflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:zflfAsiVGjSGecvX
TLSH
T120747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_czurpjhzwu.exe

Path C:\Temp\i_czurpjhzwu.exe
Size 361KB
SHA256 1bba44bfb5f10bde5ee79817e03716d60631a205709ad2d516e5995f99280010
MD5 f90caa09da6106895b9331d88df69417
SHA1 ae256d4f70a00a9349f9291c297eb3ace5e05029
SHA512 7bcca4a9fe93ac7670802f653e961757d0268e56ba02447f0a60af333f4ae5f71e41b5ebef72500e28dbf181c81a1b7c79a4ad76b7632aba54982ec7885bb011
SSDEEP 6144:lflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:lflfAsiVGjSGecvX
TLSH
T143747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgezwuomge.exe

Path C:\Temp\i_jgezwuomge.exe
Size 361KB
SHA256 934137530412e76123f69a05379be35cb7769a480fe649c4e009729b51a1ccdb
MD5 53c7872742f9e56a9d88fc07319bff27
SHA1 f746069e3fc0630853ff7e7ec00d1985e78de62f
SHA512 943360cf3696faa040bbddd104f35a291cc6b789fff962b9a1eb9cbb6ef83bf6f3e9cfdb9f9c1779ce33174aafd520dc40a9595b05896cd09f47cd23f1ee1267
SSDEEP 6144:YflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:YflfAsiVGjSGecvX
TLSH
T191747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgeywqoigb.exe

Path C:\Temp\i_lgeywqoigb.exe
Size 361KB
SHA256 82b8c2685cfdfeb163da45abc59ee61c7501d58c8d232d6b165c504902b09d05
MD5 1c5e0bc4bc33ac6fe619b4d41b0bbe8c
SHA1 5429f029f702e0dba356553483cf8936da56a88b
SHA512 7302602d69aab264f81e05936c7bb5fba3528a9d88b2cd6972cee4d4cbfb66c64cf80d25a70f12c2474e73173bd3fd62bafb38471a18f1c97ff456c5d992af2f
SSDEEP 6144:1flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:1flfAsiVGjSGecvX
TLSH
T1D3747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qlidavtqli.exe

Path C:\Temp\i_qlidavtqli.exe
Size 361KB
SHA256 4f137f5f91f4ae27331c4dd45ba82cf80ce2fc61dd92314dc1e97cc9f56cd852
MD5 0aa96396c238060be5b332ad3afdedc1
SHA1 55fed1b7b42b07c127a44e48e3b52012a325c34b
SHA512 cbd698383b2cf4c2a7fa1c6d8b14539d536de056826521f3448f1b281c1a5d75c9b56c310ac6153857eb8cf8db5b6e27dd183a1699b6df0e176ac300bc38053f
SSDEEP 6144:vflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:vflfAsiVGjSGecvX
TLSH
T1C7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgezwuomge.exe

Path C:\Temp\jgezwuomge.exe
Size 361KB
SHA256 ccf321b5dc9a1405cdbe32ea9af30ca58cb2b205f8b6bcfe4d2d54df52df5868
MD5 224505e41dc0ed6f791ef492ee9b643a
SHA1 2777801714db3ee4198de1e9bd9cabc79a229c6e
SHA512 9fe3b336faddcc0460dd57be814a375c913950868d3acfa6237b62b8c512fa2e0ac5504b05ab39fb58380da8fcbbec257d08e4cc062b025a0971248d1aaa1bc7
SSDEEP 6144:sflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:sflfAsiVGjSGecvX
TLSH
T165747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgeywqoigb.exe

Path C:\Temp\lgeywqoigb.exe
Size 361KB
SHA256 809e5e02d8e85b60eaf064165ea0ca4bac7d9d8e3f207fb8d8abde61d734b76d
MD5 a844c65f1db8c3bfa38b852d5fe6fda4
SHA1 06f8fb3a63e004432886d0e073c55e2cdecca88b
SHA512 11f1acd014f56c7008e84f09a9cf2ae88dba600af5da4f2e3295748f094633442fead7ad588b717b95b2b9325956afdbca0236b6bca9aac3b4fec8fe2d938430
SSDEEP 6144:1flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:1flfAsiVGjSGecvX
TLSH
T155747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qlidavtqli.exe

Path C:\Temp\qlidavtqli.exe
Size 361KB
SHA256 d861c639880c11b2b127a2c9641736468d5b39ae2f5803e37e8153a38d7b18ef
MD5 fdbdf140e1d5f001e2f681ca1059c63f
SHA1 bc260eda52cb964bef14190cdc1368121437ec33
SHA512 1f1a69fb573833adafe39dd7bd361ffa7ea93ce9c4be523e5005112f9ac72132cee897ee26ef6322e9867e5e2e8828e550e8fa9ca16b01d2c76dfb0c1d57fcc4
SSDEEP 6144:TflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:TflfAsiVGjSGecvX
TLSH
T1AC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljetolgey.sys

Path C:\Temp\rljetolgey.sys
Size 293KB
SHA256 21dc848af002af6565bebc5d31156015f2ee470ee8a94427b4978455b7bd08e3
MD5 e9534329052d977fa14a612bcb7161c1
SHA1 3d5aeb4b81f0a9f266b05709c75ed345588e3bf6
SHA512 28378e3f50fd8135ab55dba448cde0106436062c7fd462b601c94688080a388a691220583de29ef2d29ea81cbf544e45a26ae3597e307ff7246264084b581733
SSDEEP 3072:1tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:1IJjiJcbI03GBc3ucY5DCSj
TLSH
T118545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trmjecwuom.sys

Path C:\Temp\trmjecwuom.sys
Size 293KB
SHA256 633983b916feff928c03b0a18970fff80569e76ef410f2b990cd07edaf26dd53
MD5 edda6a67301caa52eee0041fff631261
SHA1 c87b9eae74bfb5675b204791e3a7e9f94095d931
SHA512 367c8a4c6d5ec41db54600b6576636d7ab5ad5826d69ddb3208c37e53b374073beefc5c8f6e5d092489a8288048a64caf6eb0a01cc8de29d9e9ef06e6c2d7083
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T19F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtqljdbvtn.sys

Path C:\Temp\vtqljdbvtn.sys
Size 293KB
SHA256 45a56cefd34e8c84245272c7b8728f9133c680e6c56c87e8e774c2f8973c9e28
MD5 310e90c666deb3eabcea399d68979059
SHA1 0eb467688f9ed4be709014724fe5004dd5e0bf5f
SHA512 e70142ba16f8dd8623e77993fc64ebb89f63df5c19e87373135c65cab48477ded4a5b1c0464792fa77252735fd77a8f82c81ef92f3878d786a2104380faf7a3c
SSDEEP 3072:EtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:EIJjiJcbI03GBc3ucY5DCSj
TLSH
T14E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a958178f477b8cf0f18d83e0835916167b3eaf95d859728b647bc0100a82efc
MD5 b2c496fb89251ff9b8ff1c46a5315932
SHA1 19626950ca3b280d084016871229a48eb3fa5ffc
SHA512 bbd974e4a08ca8f629f0b9a8892ba78ac7d4191c1640d1037e4fd018dadb4d8edd0a663e4a673a29497151c4defd9be09b6a4a4788adf24b182cbc36b18ccda7
TLSH
T1C5D08031774DFD08C18054757890D3517A104460245AC3186329E01DDDBC68513DF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 48b0127c48894e5c8e42b14bcc7f6b1f91ca5d97355f42d22391fb602568bb1d
MD5 df62623cabc43e309a7767f4081f29d9
SHA1 420f1a4b11b86944a73d3cbcd4aec4883dfdfd62
SHA512 02067a08d194a87842f985ff7d0bee13c7b7228146565bf19114ffaebc120cb3d2ba8b19c941bb0d2773043366f064246a55efd57127d4a0de5768f453b2730c
TLSH
T1FDD08035774DFD08C18054717890D3517A204460345AC3186329A01DDDBC68513DF0EF
MD5 SHA1 SHA512 TLSH

Submit Download

688e4d8a-940a-497e-96fc-e97cd49cc4cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\688e4d8a-940a-497e-96fc-e97cd49cc4cc.tmp
Size 14KB
SHA256 88049ebc994ea6ce6f6fbe6c303cbb2d79af1ccc98eb3909ad318cb325e7ea2e
MD5 ecaf11a93e46408ac6a75fdf21f42c97
SHA1 ed710c06cd37e104570c3864d9df25ad0b72ce11
SHA512 e407bcaabf60ef9fb189affdce987f57f84092cec6c4431f6ed0fc479fa33e350bbda60abab235842900d72fdc47ed47b1b6334a9a4582ffea33c32bca597372
SSDEEP 192:sxRcR5yM/jK1Ml8wck/f3s6h96ZLXzoA8p9h/g6+WNIY4SAe0LGnzIgtJ:sxRclCk/f3s6zsL+f/5IFe0+3
TLSH
T1C452D915AA289977CCDBD20DFA55BF53D6F81563A2900E44A9FCCB0C01E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 22cd4b45dddf860d86ec4ec96a3d5260f3a7eaab1ac5a4bdf2d2b9f2f8d84078
MD5 1fe2937939e0c5450f2b0d0344a9b5d5
SHA1 0a7b319cab6f2a942e3626ec9625e95e9c1d6326
SHA512 ca27d0d858eb42e2cc7913c7afb2d7f911b026260349a81ade2724f1f4aa04b807ea274ea52ed925698149d308f63f040844183d0f44ec22534910a53513e592
TLSH
T194510C39396A3C6DC72213F911D25A98FFB084460A3F6D21126AD03F980BF7D5E9E171
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e930ba47b02bc0a7d91a71f5fde12ee41651be7cda7ec64a6d2348d0537ac46d
MD5 4e128c8e8611e2a489817fa016266798
SHA1 c14b15c47b329e471cfccae704bfaf1b1004094b
SHA512 0082abe47c967ba160528ecc7690145924e0a98e6a89185f07a5ca5231ef5dbf7941f3502fd3bcf4fb1ddef9a9d6a6d67d1d4bac341e040fc468233a11abca69
TLSH
T178519DF3C3E8856DCA0195F4BA147E1BCE1D0914832C3D5AC9E4EE1BA3E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 de69dbb65cffc9d7e30e88795268f78dc15524fe0bb8c7f90d829fd77e22a580
MD5 58a06d1a5fe7fd7d9bd2231ecd4c04e4
SHA1 0e3e5b9ba154277994d4f4fdddc971898dad3d82
SHA512 eef19ac1b30a812e7b6641ca3ede1a43ae2589e9fbf85594e7652c92b1221a4d31d1b034c0ea1eda6b4553b8ad132272f9738288a328a18836be7d8ff76143d1
SSDEEP 192:sxRvR5yM/jK1Ml8wck/f3sEh96ZLXzoA8p9h/g6+WNIY4SAe0LGnzIgDgJ:sxRvlCk/f3sEzsL+f/5IFe0+Q
TLSH
T16562D916AA285977CCDBD20DFA55BF53D6F81573A2901E44A9FC8B0C01E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 90e44f7bc0083878427fdad47f9972d78c0beb93e7d3b2c97c77d85d11512280
MD5 c7e4a113d8c91cbbb5904a1f5c8597d7
SHA1 08c267f7dabb9a29558d66aeba634dcf42826a45
SHA512 94a9b8ac2733b4a10bbd2e646d96da7fa16f4c780956cb1e5eb9c64845c299fb6f91138c79806b984565976cace7effddb248651b6349d23a100908e79fd8359
SSDEEP 192:sxRvR5yM/jK1Ml8UQqck/f3sEhR6ZLXzoA8prh/g6+WNIY4AAe0LGnzIgDWJ:sxRvlqZk/f3sEXsL+V/5Ife0++
TLSH
T13862C816AA2899778CDBD21DFA55BF53D6F81563A1900E44A9FCCB0C01E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 6710bf0ea2ec648b77c937da46fbc668daf15bff24854de6a57b4379ddada14e
MD5 69108b8c6be9b6bb463c5dd91c9ab23e
SHA1 fb01347467f2afb700204790bb00290154a376e0
SHA512 c6abb6fdd35a18cbaa67ab138f6a1ba7bcc37235e96d989cd8535b651fa5b999a4ca193f51d5e25ce6dabecb325b22f357bf5270ddbe22d0eeef9c3c8bcd70e7
SSDEEP 768:Tqi0NR7pLuL7C3WgNxfez8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+9zXNGFroKTpXp:Tqi0NHE7C3WgNxfezu1jaR9z9G+U
TLSH
T130E2DC3B680CCB7E4F804E9CEC2A7E9A6DE801CF96D8C95447EA841C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 187fcca3bb37f537f999fb4d720e3febf73273ea4140008837a495c99031399d
MD5 ed199f4d2c937b4c912c10fa40a1870e
SHA1 bdc696a7c0c4a863b1540d6a59d506f308053b81
SHA512 a8345149e38b55b62518cac2a7d9102c9db535ffbd096fe685589f03c22d273a156642f89edc8e97123e1ec4513f4bee454a51f66304e550ff769990876a3532
SSDEEP 96:KsAgKdysqYoKZ+n4DSOowg2Ww19gO2K4TgM2cmut8unHuDSOoR:yZzu4DSOowgBw1OOeTgMlmut8unHuDSp
TLSH
T1F891A601717E1700387D364993A9C82F828130A6319DA93F3BA911D6AF2BE155FFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4e64a7e5c46823ac8cded82a32acf7f2a329081568a85eed1ffc49ad23c50b2c
MD5 452df39bb9bf458dab5663c5257dc2f5
SHA1 d1599edcd2d3d31f64b85db9bf966e2be7781667
SHA512 910d5ad60fcdd17dda1d5950f11d719e82947d2a6e4ce54cd46ff3f2df0efc8366491154a45846b02858d7d5304d283e27f697f5765259209802aa576b086000
SSDEEP 768:Arv+4UNbd23MPth0Y+AW+152MvSCa2k5+8rir9:Absbs3Qpx2px5DriR
TLSH
T1A003BF32E86DA9738DE686C4764B3613BFB0129385C10B94CDD96B4D029B6CE231BD77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1343eb20bba9454966abf41a48c3c030e515327e2c07636a3acdde76de4e9783
MD5 8f87631621cf987cce2af7690eaf313e
SHA1 b109ca9c85dccadf531ac6a9ebff8c9e17e52211
SHA512 c5e456487626e1a377ac724daa9621aaac210fca4f7bc6fab265b6c3cdc6b5544ff578f7bac26a00199375fed6dbb7965ca3d5b977696813c08d8105181aef0f
SSDEEP 768:3j+9a3mIk3Kth0hY+AW+152MvSCaiQb9MGq:69a3mQpx2pfb+T
TLSH
T14AF2BE31AC5ADD73CC969784B74B3763AFE016A784851E48CDD9AF0D02C328D274AD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 4ba92f17ccc6355b82d4634b75f4f88d60494ce80271d3ba60c4b94554764b68
MD5 87cf2da50d1da8574e547235d10a11c6
SHA1 375622da206f26248a35da3f272145735eb49880
SHA512 0414d16f44b6fb6e7badbcf93d0cc11df40f80c123c7b4b63ea08b94866080c3657efe4eb1502977882bbe5d8a6286f3b8b7fe64456d5a21b4c4bf78fa973d94
SSDEEP 768:xrv+4UNbdw31IkJKth0hY+AW+152MvSCaiQb9MGH:xbsbm31upx2pfb+q
TLSH
T15713CF32E85DED73CDA69284B24B3653BFB026A389850E54CDC5AF0D068758D274BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 31cd89d6b97f4601c565dbac42fe160fc053a8864386cd76f8de83f0f1876949
MD5 e47c1694f969ce7f41f5c16e125799a7
SHA1 9dbf64d801475b82153891c951c25214748e5c0b
SHA512 6a314a3dfcc5de64fa5becc563ec97aea1226868e9df277187fb6c1f12929618fc9f40d63f032d58a13f84b33b8e31c1b676dd0d473afb4957b22d1c4f188fc9
SSDEEP 768:qj+9a31Ik3Kth0hY+AW+152MvSCaiQb9MGq:J9a31Qpx2pfb+T
TLSH
T199F2BE31AC5ADD73CCA69784B74B3753AFE016A384851E48CDD9AF0D02C728D174AD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 425c4fd8b62584ed9867f4e8e735b692fb72a9e785648c94570f316f357ff912
MD5 1917276fc9d6a24099548ccb69a6b710
SHA1 3de8f5b58787835d1ed9a5b03a198443ee66e3c3
SHA512 3c82e8a443b4dc65d0a81b65e29718c0d3a080d552d5db8995c9cfc7bad27fbd1a8df84b17ea402a2c4b652e3ec5a3639f1074ef92ed8ef73833351806f02379
SSDEEP 768:Gj+9I3mIk3a6h0hj+AW+152MvSCaiQb9MGq:V9I3mWpx2pfb+T
TLSH
T1A1F29D35E86ADE678CE293C4B7463A57AEE016A385C80DC4CDD96F4D01C369E174AC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

703a6bbd-5615-46bb-bf40-8ead0531fa52.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\703a6bbd-5615-46bb-bf40-8ead0531fa52.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4904_1765811805\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 885552b941bee530d156e17351e02ac14b294d49ced945681204cb0596073a2c
MD5 16e4689e49e408b398ed4432013c3063
SHA1 7689f90d383a1b6efac210bc7134338f111ae854
SHA512 fd922fbf6daa9a983c1243c5e19a7c229c7b391550fccbeb12bc8d85d371b853ec9672b337d3091712eb4080bc2d318e2af0261549edbc922440396e3c752939
TLSH
T1E271238356B9C9B3C1DA5FF002836208F2FB2338072330208B55594AAB30A7A64B9F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/428-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1060-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1476-417-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1500-406-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1508-244-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1520-385-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1708-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1780-281-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2104-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2124-317-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2132-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2180-459-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2564-463-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3044-491-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3408-421-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3512-269-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3820-349-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4224-197-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4244-358-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4748-495-0x0000000000010000-0x00000000000AB000-memory.dmp

Download