systex | 0887ba150bcf27f131afce083d2654d29956f25ea3153fd474ad171b1219cc0c

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260710-sljbfad12y
SHA256 0887ba150bcf27f131afce083d2654d29956f25ea3153fd474ad171b1219cc0c
MD5 94decb693e171dbc352a15514e501328
SHA1 8607ab42f5fe24a3e140c2f3828ad8a2c6843394
SHA512 b2634c44857b4c755731b84380e8dee279cf610aeabfb4a4a72cf88043388919c396e0f4447a3cb5da6690610061939c01d151ca5b27d6deec7bd48332912e88
SSDEEP 6144:ZflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:ZflfAsiVGjSGecvX
TLSH
T1CC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A93469F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4664	ecwuomkecwusmkhb.exe
5140	ecwuomkecwusmkhb.sys
5840	CreateProcess.exe
2596	ecxupmhecw.exe
4492	CreateProcess.exe
5160	CreateProcess.exe
2008	i_ecxupmhecw.exe
1716	wrpjgeztrm.sys
2136	CreateProcess.exe
2300	mjecwrpjhb.exe
2104	CreateProcess.exe
4480	CreateProcess.exe
6008	i_mjecwrpjhb.exe
616	mgbzwrojhb.sys
4804	CreateProcess.exe
4284	ztojeywtlj.exe
2108	CreateProcess.exe
5696	CreateProcess.exe
1784	i_ztojeywtlj.exe
4520	bytrljdbvt.sys
5660	CreateProcess.exe
2204	ljdytoigdy.exe
3060	CreateProcess.exe
5836	CreateProcess.exe
1152	i_ljdytoigdy.exe
2524	idaytqojga.sys
5180	CreateProcess.exe
1108	yvqlidaytq.exe
4032	CreateProcess.exe
4904	CreateProcess.exe
4308	i_yvqlidaytq.exe
1520	axsqnifaxv.sys
4856	CreateProcess.exe
5608	sqkidavtnl.exe
2732	CreateProcess.exe
4520	CreateProcess.exe
3448	i_sqkidavtnl.exe
3244	causpkicau.sys
4156	CreateProcess.exe
200	vsnkfdxvpn.exe
4656	CreateProcess.exe
4872	CreateProcess.exe
5952	i_vsnkfdxvpn.exe
5768	snkfdxvpfz.sys
3168	CreateProcess.exe
5912	wupmhfzxsp.exe
3396	CreateProcess.exe
3044	CreateProcess.exe
2680	i_wupmhfzxsp.exe
5260	nhezxrpjhc.sys
3428	CreateProcess.exe
5920	uomhecwurm.exe
996	CreateProcess.exe
4724	CreateProcess.exe
2348	i_uomhecwurm.exe
3408	romhezwrpj.sys
3848	CreateProcess.exe
1256	hezwrpjhbw.exe
4852	CreateProcess.exe
5048	CreateProcess.exe
1912	i_hezwrpjhbw.exe
4752	oljeywuomg.sys
5876	CreateProcess.exe
2544	dbwtomgeyw.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4708_1956708888\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4708_518285004\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4708_1956708888\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4708_518285004\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4708_518285004\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4708_518285004\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4708_1451272493\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4708_1166315651\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4708_1166315651\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wupmhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomhecwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqlfda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjecwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwupmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywrojdbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecxupmhecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezwrpjhbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdytoigdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysqlfda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomkecwusmkhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdytoigdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezwrpjhbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbwtomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwupmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomhecwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfaxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjecwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbwtomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecxupmhecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztojeywtlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqlidaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqlidaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupmhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfaxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztojeywtlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkidavtnl.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1704	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1540	ipconfig.exe
2404	ipconfig.exe
3204	ipconfig.exe
860	ipconfig.exe
5628	ipconfig.exe
828	ipconfig.exe
2576	ipconfig.exe
3204	ipconfig.exe
4772	ipconfig.exe
2728	ipconfig.exe
4388	ipconfig.exe
5244	ipconfig.exe
2000	ipconfig.exe
4216	ipconfig.exe
3568	ipconfig.exe
5528	ipconfig.exe
4296	ipconfig.exe
2668	ipconfig.exe
4700	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281699759454428"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{85C048D1-90CB-479B-BAE8-4BF792A0D4F6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	ecwuomkecwusmkhb.exe
4664	ecwuomkecwusmkhb.exe
4664	ecwuomkecwusmkhb.exe
4664	ecwuomkecwusmkhb.exe
4664	ecwuomkecwusmkhb.exe
4664	ecwuomkecwusmkhb.exe
4664	ecwuomkecwusmkhb.exe
4664	ecwuomkecwusmkhb.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	2008	i_ecxupmhecw.exe
Token: SeDebugPrivilege	6008	i_mjecwrpjhb.exe
Token: SeDebugPrivilege	1784	i_ztojeywtlj.exe
Token: SeDebugPrivilege	1152	i_ljdytoigdy.exe
Token: SeDebugPrivilege	4308	i_yvqlidaytq.exe
Token: SeDebugPrivilege	3448	i_sqkidavtnl.exe
Token: SeDebugPrivilege	5952	i_vsnkfdxvpn.exe
Token: SeDebugPrivilege	2680	i_wupmhfzxsp.exe
Token: SeDebugPrivilege	2348	i_uomhecwurm.exe
Token: SeDebugPrivilege	1912	i_hezwrpjhbw.exe
Token: SeDebugPrivilege	3840	i_dbwtomgeyw.exe
Token: SeDebugPrivilege	580	i_qoigaywqoi.exe
Token: SeDebugPrivilege	2268	i_igaysqlfda.exe
Token: SeDebugPrivilege	3184	i_tnlfdxvpni.exe
Token: SeDebugPrivilege	580	i_pnhfaxspki.exe
Token: SeDebugPrivilege	6116	i_hfzxrpkhca.exe
Token: SeDebugPrivilege	4572	i_ecwupmhfzx.exe
Token: SeDebugPrivilege	6012	i_wrpjhbztrl.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4708	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 4664	824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 824 wrote to memory of 3316	824	2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 3316 wrote to memory of 4708	3316	iexplore.exe	89
PID 4708 wrote to memory of 4128	4708	msedge.exe	90
PID 4708 wrote to memory of 1704	4708	msedge.exe	91
PID 4708 wrote to memory of 3212	4708	msedge.exe	92
PID 4708 wrote to memory of 3212	4708	msedge.exe	92
PID 4708 wrote to memory of 3212	4708	msedge.exe	92
PID 4708 wrote to memory of 5420	4708	msedge.exe	93
PID 4708 wrote to memory of 5420	4708	msedge.exe	93
PID 4708 wrote to memory of 3224	4708	msedge.exe	95
PID 4708 wrote to memory of 3044	4708	msedge.exe	96
PID 4708 wrote to memory of 3224	4708	msedge.exe	95
PID 4708 wrote to memory of 3224	4708	msedge.exe	95
PID 4708 wrote to memory of 3044	4708	msedge.exe	96
PID 4708 wrote to memory of 3044	4708	msedge.exe	96
PID 4708 wrote to memory of 236	4708	msedge.exe	97
PID 4708 wrote to memory of 236	4708	msedge.exe	97
PID 4708 wrote to memory of 236	4708	msedge.exe	97
PID 4708 wrote to memory of 3048	4708	msedge.exe	98
PID 4708 wrote to memory of 3048	4708	msedge.exe	98
PID 4708 wrote to memory of 3048	4708	msedge.exe	98
PID 4708 wrote to memory of 2764	4708	msedge.exe	100
PID 4708 wrote to memory of 2764	4708	msedge.exe	100
PID 4664 wrote to memory of 5840	4664	ecwuomkecwusmkhb.exe	103
PID 2596 wrote to memory of 4492	2596	ecxupmhecw.exe	106
PID 4708 wrote to memory of 3884	4708	msedge.exe	109
PID 4708 wrote to memory of 3884	4708	msedge.exe	109
PID 4708 wrote to memory of 2244	4708	msedge.exe	110
PID 4708 wrote to memory of 2244	4708	msedge.exe	110
PID 4708 wrote to memory of 1108	4708	msedge.exe	112
PID 4708 wrote to memory of 2516	4708	msedge.exe	113
PID 4708 wrote to memory of 2516	4708	msedge.exe	113
PID 4708 wrote to memory of 5452	4708	msedge.exe	116
PID 4708 wrote to memory of 5452	4708	msedge.exe	116
PID 4664 wrote to memory of 5160	4664	ecwuomkecwusmkhb.exe	117
PID 4664 wrote to memory of 2136	4664	ecwuomkecwusmkhb.exe	121
PID 2300 wrote to memory of 2104	2300	mjecwrpjhb.exe	123
PID 4664 wrote to memory of 4480	4664	ecwuomkecwusmkhb.exe	126
PID 4664 wrote to memory of 4804	4664	ecwuomkecwusmkhb.exe	130
PID 4284 wrote to memory of 2108	4284	ztojeywtlj.exe	132
PID 4664 wrote to memory of 5696	4664	ecwuomkecwusmkhb.exe	135
PID 4664 wrote to memory of 5660	4664	ecwuomkecwusmkhb.exe	140
PID 2204 wrote to memory of 3060	2204	ljdytoigdy.exe	142
PID 4708 wrote to memory of 4432	4708	msedge.exe	145
PID 4708 wrote to memory of 3204	4708	msedge.exe	146
PID 4708 wrote to memory of 4732	4708	msedge.exe	147
PID 4664 wrote to memory of 5836	4664	ecwuomkecwusmkhb.exe	148
PID 4664 wrote to memory of 5180	4664	ecwuomkecwusmkhb.exe	152
PID 1108 wrote to memory of 4032	1108	yvqlidaytq.exe	154
PID 4664 wrote to memory of 4904	4664	ecwuomkecwusmkhb.exe	157
PID 4664 wrote to memory of 4856	4664	ecwuomkecwusmkhb.exe	161
PID 5608 wrote to memory of 2732	5608	sqkidavtnl.exe	163
PID 4664 wrote to memory of 4520	4664	ecwuomkecwusmkhb.exe	166
PID 4664 wrote to memory of 4156	4664	ecwuomkecwusmkhb.exe	170
PID 200 wrote to memory of 4656	200	vsnkfdxvpn.exe	172
PID 4664 wrote to memory of 4872	4664	ecwuomkecwusmkhb.exe	175
PID 4664 wrote to memory of 3168	4664	ecwuomkecwusmkhb.exe	179
PID 5912 wrote to memory of 3396	5912	wupmhfzxsp.exe	181
PID 4708 wrote to memory of 2512	4708	msedge.exe	184
PID 4708 wrote to memory of 2512	4708	msedge.exe	184
PID 4664 wrote to memory of 3044	4664	ecwuomkecwusmkhb.exe	188
PID 4664 wrote to memory of 3428	4664	ecwuomkecwusmkhb.exe	192
PID 5920 wrote to memory of 996	5920	uomhecwurm.exe	194

C:\Users\Admin\AppData\Local\Temp\2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_94decb693e171dbc352a15514e501328_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:824
- C:\Temp\ecwuomkecwusmkhb.exe
  C:\Temp\ecwuomkecwusmkhb.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecxupmhecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5840
  - - C:\Temp\ecxupmhecw.exe
      C:\Temp\ecxupmhecw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2596
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4492
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecxupmhecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5160
  - - C:\Temp\i_ecxupmhecw.exe
      C:\Temp\i_ecxupmhecw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2008
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjecwrpjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2136
  - - C:\Temp\mjecwrpjhb.exe
      C:\Temp\mjecwrpjhb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2300
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2104
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjecwrpjhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4480
  - - C:\Temp\i_mjecwrpjhb.exe
      C:\Temp\i_mjecwrpjhb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6008
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztojeywtlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4804
  - - C:\Temp\ztojeywtlj.exe
      C:\Temp\ztojeywtlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4284
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2108
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztojeywtlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5696
  - - C:\Temp\i_ztojeywtlj.exe
      C:\Temp\i_ztojeywtlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdytoigdy.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5660
  - - C:\Temp\ljdytoigdy.exe
      C:\Temp\ljdytoigdy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2204
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3060
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdytoigdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5836
  - - C:\Temp\i_ljdytoigdy.exe
      C:\Temp\i_ljdytoigdy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvqlidaytq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5180
  - - C:\Temp\yvqlidaytq.exe
      C:\Temp\yvqlidaytq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4032
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvqlidaytq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4904
  - - C:\Temp\i_yvqlidaytq.exe
      C:\Temp\i_yvqlidaytq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkidavtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4856
  - - C:\Temp\sqkidavtnl.exe
      C:\Temp\sqkidavtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5608
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2732
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkidavtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4520
  - - C:\Temp\i_sqkidavtnl.exe
      C:\Temp\i_sqkidavtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsnkfdxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4156
  - - C:\Temp\vsnkfdxvpn.exe
      C:\Temp\vsnkfdxvpn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:200
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4656
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsnkfdxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4872
  - - C:\Temp\i_vsnkfdxvpn.exe
      C:\Temp\i_vsnkfdxvpn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wupmhfzxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3168
  - - C:\Temp\wupmhfzxsp.exe
      C:\Temp\wupmhfzxsp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5912
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3396
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wupmhfzxsp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3044
  - - C:\Temp\i_wupmhfzxsp.exe
      C:\Temp\i_wupmhfzxsp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomhecwurm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3428
  - - C:\Temp\uomhecwurm.exe
      C:\Temp\uomhecwurm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5920
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:996
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4388
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomhecwurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4724
  - - C:\Temp\i_uomhecwurm.exe
      C:\Temp\i_uomhecwurm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2348
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hezwrpjhbw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3848
  - - C:\Temp\hezwrpjhbw.exe
      C:\Temp\hezwrpjhbw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1256
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4852
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hezwrpjhbw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5048
  - - C:\Temp\i_hezwrpjhbw.exe
      C:\Temp\i_hezwrpjhbw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbwtomgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5876
  - - C:\Temp\dbwtomgeyw.exe
      C:\Temp\dbwtomgeyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2544
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5008
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbwtomgeyw.exe ups_ins
    3⤵
    PID:4688
  - - C:\Temp\i_dbwtomgeyw.exe
      C:\Temp\i_dbwtomgeyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigaywqoi.exe ups_run
    3⤵
    PID:3480
  - - C:\Temp\qoigaywqoi.exe
      C:\Temp\qoigaywqoi.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3884
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5796
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigaywqoi.exe ups_ins
    3⤵
    PID:4988
  - - C:\Temp\i_qoigaywqoi.exe
      C:\Temp\i_qoigaywqoi.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igaysqlfda.exe ups_run
    3⤵
    PID:4112
  - - C:\Temp\igaysqlfda.exe
      C:\Temp\igaysqlfda.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4660
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2044
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igaysqlfda.exe ups_ins
    3⤵
    PID:5852
  - - C:\Temp\i_igaysqlfda.exe
      C:\Temp\i_igaysqlfda.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnlfdxvpni.exe ups_run
    3⤵
    PID:2548
  - - C:\Temp\tnlfdxvpni.exe
      C:\Temp\tnlfdxvpni.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2400
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5260
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnlfdxvpni.exe ups_ins
    3⤵
    PID:3088
  - - C:\Temp\i_tnlfdxvpni.exe
      C:\Temp\i_tnlfdxvpni.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfaxspki.exe ups_run
    3⤵
    PID:5004
  - - C:\Temp\pnhfaxspki.exe
      C:\Temp\pnhfaxspki.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2444
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6060
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfaxspki.exe ups_ins
    3⤵
    PID:5460
  - - C:\Temp\i_pnhfaxspki.exe
      C:\Temp\i_pnhfaxspki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzxrpkhca.exe ups_run
    3⤵
    PID:2296
  - - C:\Temp\hfzxrpkhca.exe
      C:\Temp\hfzxrpkhca.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5012
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5792
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfzxrpkhca.exe ups_ins
    3⤵
    PID:1788
  - - C:\Temp\i_hfzxrpkhca.exe
      C:\Temp\i_hfzxrpkhca.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwupmhfzx.exe ups_run
    3⤵
    PID:4592
  - - C:\Temp\ecwupmhfzx.exe
      C:\Temp\ecwupmhfzx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5560
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4084
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwupmhfzx.exe ups_ins
    3⤵
    PID:4560
  - - C:\Temp\i_ecwupmhfzx.exe
      C:\Temp\i_ecwupmhfzx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrpjhbztrl.exe ups_run
    3⤵
    PID:2888
  - - C:\Temp\wrpjhbztrl.exe
      C:\Temp\wrpjhbztrl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1132
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrpjhbztrl.exe ups_ins
    3⤵
    PID:2988
  - - C:\Temp\i_wrpjhbztrl.exe
      C:\Temp\i_wrpjhbztrl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6012
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywrojdbzt.exe ups_run
    3⤵
    PID:2668
  - - C:\Temp\bywrojdbzt.exe
      C:\Temp\bywrojdbzt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3436
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5768
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:860
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff865eec188,0x7ff865eec194,0x7ff865eec1a0
      4⤵
      PID:4128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,2728248554193201959,6625120880818675652,524288 --field-trial-handle=2244,i,15699483945650657344,9397134527602450223,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:11
      4⤵
      System Time Discovery
      PID:1704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,18101727275642031448,11249117787275094094,262144 --field-trial-handle=2244,i,15699483945650657344,9397134527602450223,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
      4⤵
      PID:3212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,118431531013810175,12234643461472656436,524288 --field-trial-handle=2244,i,15699483945650657344,9397134527602450223,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:13
      4⤵
      PID:5420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,83657564476234023,14533813777474925947,2097152 --field-trial-handle=2244,i,15699483945650657344,9397134527602450223,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:3224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,3382839450126519937,6438386159678984953,2097152 --field-trial-handle=2244,i,15699483945650657344,9397134527602450223,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      PID:3044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4344,i,14461396820671045222,1468246038742560781,2097152 --field-trial-handle=2244,i,15699483945650657344,9397134527602450223,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
      4⤵
      PID:236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,3904567507638236591,8124998809565383657,2097152 --field-trial-handle=2244,i,15699483945650657344,9397134527602450223,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:9
      4⤵
      PID:3048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,7094185724383789607,12239648857585358727,524288 --field-trial-handle=2244,i,15699483945650657344,9397134527602450223,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
      4⤵
      PID:2764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,1835498766417297700,1681620851543977063,524288 --field-trial-handle=2244,i,15699483945650657344,9397134527602450223,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:3884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,13001086086559077483,1653993347624432386,524288 --field-trial-handle=2244,i,15699483945650657344,9397134527602450223,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:14
      4⤵
      PID:2244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,11631606304443378014,14483409262653935558,524288 --field-trial-handle=2244,i,15699483945650657344,9397134527602450223,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
      4⤵
      PID:5852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,11631606304443378014,14483409262653935558,524288 --field-trial-handle=2244,i,15699483945650657344,9397134527602450223,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
      4⤵
      PID:1108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,4474689863975997575,2582732170124028956,524288 --field-trial-handle=2244,i,15699483945650657344,9397134527602450223,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:2516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,16234736435601564299,15222612293457159617,524288 --field-trial-handle=2244,i,15699483945650657344,9397134527602450223,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
      4⤵
      PID:5452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,3729864853222950153,8147248990885931235,524288 --field-trial-handle=2244,i,15699483945650657344,9397134527602450223,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:14
      4⤵
      PID:4432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,15995585765321585193,17987629523058106177,524288 --field-trial-handle=2244,i,15699483945650657344,9397134527602450223,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:14
      4⤵
      PID:3204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,757276675102793990,1918136904557989564,524288 --field-trial-handle=2244,i,15699483945650657344,9397134527602450223,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
      4⤵
      PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,10714553806847094832,11315673980299256653,524288 --field-trial-handle=2244,i,15699483945650657344,9397134527602450223,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:14
      4⤵
      PID:2512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,9604322390610879755,16486191682956629993,524288 --field-trial-handle=2244,i,15699483945650657344,9397134527602450223,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
      4⤵
      PID:2668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2972,i,926750957230084031,8684228802952482213,524288 --field-trial-handle=2244,i,15699483945650657344,9397134527602450223,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
      4⤵
      PID:2228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,2866483376413184929,8372917917028092822,524288 --field-trial-handle=2244,i,15699483945650657344,9397134527602450223,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
      4⤵
      PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6176,i,5416778799854399745,5848475160486147695,262144 --field-trial-handle=2244,i,15699483945650657344,9397134527602450223,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:10
      4⤵
      PID:1800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5444,i,628334241510662124,2318202131530717407,2097152 --field-trial-handle=2244,i,15699483945650657344,9397134527602450223,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
      4⤵
      PID:2792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=3612,i,7114040402615796002,11568902060590241899,2097152 --field-trial-handle=2244,i,15699483945650657344,9397134527602450223,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
      4⤵
      PID:2144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4016,i,5837041238854989271,4897006868142378193,524288 --field-trial-handle=2244,i,15699483945650657344,9397134527602450223,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
      4⤵
      PID:5780

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3604

C:\Temp\ecwuomkecwusmkhb.sys
C:\Temp\ecwuomkecwusmkhb.sys
1⤵
- Executes dropped EXE
PID:5140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1352

C:\Temp\wrpjgeztrm.sys
C:\Temp\wrpjgeztrm.sys
1⤵
- Executes dropped EXE
PID:1716

C:\Temp\mgbzwrojhb.sys
C:\Temp\mgbzwrojhb.sys
1⤵
- Executes dropped EXE
PID:616

C:\Temp\bytrljdbvt.sys
C:\Temp\bytrljdbvt.sys
1⤵
- Executes dropped EXE
PID:4520

C:\Temp\idaytqojga.sys
C:\Temp\idaytqojga.sys
1⤵
- Executes dropped EXE
PID:2524

C:\Temp\axsqnifaxv.sys
C:\Temp\axsqnifaxv.sys
1⤵
- Executes dropped EXE
PID:1520

C:\Temp\causpkicau.sys
C:\Temp\causpkicau.sys
1⤵
- Executes dropped EXE
PID:3244

C:\Temp\snkfdxvpfz.sys
C:\Temp\snkfdxvpfz.sys
1⤵
- Executes dropped EXE
PID:5768

C:\Temp\nhezxrpjhc.sys
C:\Temp\nhezxrpjhc.sys
1⤵
- Executes dropped EXE
PID:5260

C:\Temp\romhezwrpj.sys
C:\Temp\romhezwrpj.sys
1⤵
- Executes dropped EXE
PID:3408

C:\Temp\oljeywuomg.sys
C:\Temp\oljeywuomg.sys
1⤵
- Executes dropped EXE
PID:4752

C:\Temp\bvtrlgdyvt.sys
C:\Temp\bvtrlgdyvt.sys
1⤵
PID:4332

C:\Temp\yvtnlgdywq.sys
C:\Temp\yvtnlgdywq.sys
1⤵
PID:5140

C:\Temp\dyvtnifdyv.sys
C:\Temp\dyvtnifdyv.sys
1⤵
PID:4468

C:\Temp\axsqkifays.sys
C:\Temp\axsqkifays.sys
1⤵
PID:2176

C:\Temp\rpnhfaxrpk.sys
C:\Temp\rpnhfaxrpk.sys
1⤵
PID:3268

C:\Temp\xuhczxrpje.sys
C:\Temp\xuhczxrpje.sys
1⤵
PID:3416

C:\Temp\pmhezwrpjh.sys
C:\Temp\pmhezwrpjh.sys
1⤵
PID:1636

C:\Temp\mjhbztrmje.sys
C:\Temp\mjhbztrmje.sys
1⤵
PID:580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

axsqnifaxv.sys

Path C:\Temp\axsqnifaxv.sys
Size 293KB
SHA256 9518c70b4a80d64df965c785418af2f0d98077dd6da6c7f7e732c7bea8b117c6
MD5 8ed3974e6f6828f06dd0659552879565
SHA1 bd2fb17ef9a4de14c4693018a8839166c05c1c77
SHA512 592d398cd6faaa17c63c05854af0cdea882e783b78bb6117c6261517d475175dca9bb63e2b3f3e5c6bb0a4d585e8fa9e16cae7257411af89fcc45c5ba7363fb1
SSDEEP 3072:btKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:bIJjiJcbI03GBc3ucY5DCSj
TLSH
T179545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytrljdbvt.sys

Path C:\Temp\bytrljdbvt.sys
Size 293KB
SHA256 4af4195d3726726ab015c1c5502b231d27395b99a49c6d3ca0659e3f8e83a5e2
MD5 a8b385890a07b472b6621c24322c25ef
SHA1 46c5f1adf413875d8a1f51a36917abf3dd138221
SHA512 9f2f18321d47c83d0a3e37445731a7462d39163bc7cfea45b4e35c82fddbbd033361d8f63d54109c16f977068d5931ed0dd21050eaebfc3414c287eaccd48e2c
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C0545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomkecwusmkhb.exe

Path C:\Temp\ecwuomkecwusmkhb.exe
Size 361KB
SHA256 ad59c0f1e11fb4b809729626636a4851c2ea5b05d22af6e30824a8430301aad6
MD5 556fb99f63ce7ca490f08317d92f0de6
SHA1 55a633167bab069326062d350fb1677464f6ba26
SHA512 fd9078830ae2e0b88abba88a4cc7014adebd491c6a32a07e5e1989727c37b1a2c65395619976e4a8b516c700017834b4f1006c720c1629faa2e1a6a9885f1b53
SSDEEP 6144:sflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:sflfAsiVGjSGecvX
TLSH
T12C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomkecwusmkhb.sys

Path C:\Temp\ecwuomkecwusmkhb.sys
Size 293KB
SHA256 e153f44849f92c3df6a41816823da58465e62a70c002715e540fa3b9632374cd
MD5 29886ab3151a5d164fa1a3019ba5700d
SHA1 276b956883d5e19404fd738484875b7254fe5699
SHA512 683ad21c652b3219e9de03ebd55cfab3de3109b5fddd981b17195ccb37196a91f82f4d742ce32c5eb6db6a4e17eed15ae62ddd71a8077f0e3d1bbf2ba5e765df
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C0545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecxupmhecw.exe

Path C:\Temp\ecxupmhecw.exe
Size 361KB
SHA256 24387a6e7b5f263684375f3c56c2c3d0e6f9b58672c04b74bec81657ed80dfa3
MD5 ffabe25f115582a0414c7a6e1382827d
SHA1 345ba77a79aeb9c3a4a6dd652d2a75bc91e69348
SHA512 ebe8923e29acbb1c7bbc85c7a23d99b5457d31ffd025d79175ba09542a7d5bd4cd1edaccbc931fc33d8a5de928bc28f434070395a579588d97379311fe4aa60b
SSDEEP 6144:cflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:cflfAsiVGjSGecvX
TLSH
T11E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecxupmhecw.exe

Path C:\Temp\i_ecxupmhecw.exe
Size 361KB
SHA256 1681ba8148fcfc9a6686925e72a8b80c5966828806927193a0c1a88373e2df4d
MD5 f85a3967c8d9cc2a30f97333d5df185d
SHA1 d8499d96111855fdc48b76c2e8f600c6b590ee6d
SHA512 31daff865724f182d4193fda9652bf97635ce1eae6cd4ac095ccf24c0f729130fd2f12ce73b1c6bcc1dc96ffabdc44577e00725c4b0c392fc4ba9f60676debd3
SSDEEP 6144:+flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:+flfAsiVGjSGecvX
TLSH
T133747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljdytoigdy.exe

Path C:\Temp\i_ljdytoigdy.exe
Size 361KB
SHA256 1ea630558c85ec6666bfadb2293fd6d00a6dc1de145542d4a7bd0974671b2f1e
MD5 59128725d6a2e1bbf88fb3031835b4c1
SHA1 dd1797376eddab36f2dd0ea4212405db22c883f2
SHA512 35e11fa861ffd953058cce2f1b3d5ed90b047b6eb5037b0a5987ee0df0771f00d9bcab8531d1948cd48d28d77af6451c13329a9fbb18d45904e8c88889f01af6
SSDEEP 6144:CflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:CflfAsiVGjSGecvX
TLSH
T1D4747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mjecwrpjhb.exe

Path C:\Temp\i_mjecwrpjhb.exe
Size 361KB
SHA256 e45dc6c27e6f327ea00f277c086d2b4d857d09b24da7cb958a0a02ee2762abc1
MD5 611db5b7d6eeaaf293ca68d69f40cd21
SHA1 40d6b5c12ee3d665f4c9dbc10c1f5976db956791
SHA512 43e323e65d54183972b38f9ad6edc0762b3ec5486b5819c7332c25be7fc78403b06e24b8f2382c2a2fdf8fbe1c229e1e28d8a892ec383d72cd2e8f6373c069bc
SSDEEP 6144:MflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:MflfAsiVGjSGecvX
TLSH
T183747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvqlidaytq.exe

Path C:\Temp\i_yvqlidaytq.exe
Size 361KB
SHA256 dc9e0c0e3eb5f4ce8d063ba2f4886f877dedffcb9385794ea55854103eed8101
MD5 728f307e22582e31317de2aba1eb6511
SHA1 e2ded6483a5c1d7ab826f563ab3a66ac066e2869
SHA512 df70b19257bbbc9954648efeba4f77235a57136f1f76a2db4bed360fbdaf424f943fcf3100a02aeaa96a723a1be278fee2bf6fb18c8634f15b03bac2ae404b14
SSDEEP 6144:1flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:1flfAsiVGjSGecvX
TLSH
T123747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztojeywtlj.exe

Path C:\Temp\i_ztojeywtlj.exe
Size 361KB
SHA256 2ee49c330a533509e778c8f55df36da1fa4258933edcef5628a2743b58e6e109
MD5 47d879c3b59ee64bc0701f38a4397f93
SHA1 07e94b40271ee81af335f6a272152b8b5d8d9cf2
SHA512 c5682174f99ec76139b5e2782b05095f7f0e7f01685e0d246ecf31eccbd25e2576b3043fedfa5ddae58574de037c0ed0b9a64adfed9477daeba163afb615ef5c
SSDEEP 6144:EflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:EflfAsiVGjSGecvX
TLSH
T134747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idaytqojga.sys

Path C:\Temp\idaytqojga.sys
Size 293KB
SHA256 049165f6066d63d76a2e5fd509cac1680ffc9f7f73554cecdaa4c19559118fe8
MD5 0dd92a0ad6070d44a86542552158c198
SHA1 e374e7f03814e869df0ac4a3ec6b1affd4872bf0
SHA512 e37f9a7fde089c789f4e8a632e77bdab4a080bda9f8cdc4365145f30a10bbab6faf77dd97da1cf0033e337e429b372b433bdc8baa62202a1287d010c787ee9cc
SSDEEP 3072:FtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:FIJjiJcbI03GBc3ucY5DCSj
TLSH
T136545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdytoigdy.exe

Path C:\Temp\ljdytoigdy.exe
Size 361KB
SHA256 17288fc18d32e3e9a3d7a5c2ca14db4f78e70b7ddefe94641cb82607c5d95ac9
MD5 a532858da5117b65540d89ee343ffde9
SHA1 6fa7715d0b76c52de04721b78c71ce832cc401b8
SHA512 9c410826d40532580ef894e23442f250598a491bd94498c2dd7f2f13f5e92853178f3dc13a80af7bde2eef0129071a0c9f0402630b2e108f3b3a309ffc08ba63
SSDEEP 6144:EflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:EflfAsiVGjSGecvX
TLSH
T19B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgbzwrojhb.sys

Path C:\Temp\mgbzwrojhb.sys
Size 293KB
SHA256 54f7d1efb795edbd04cdcd0985fa07590ce05b250dca400fc3412fedc5e44078
MD5 fd9548b5edbb9d18b25e44608071be38
SHA1 a277bcdebce42482914dfedca6bc81fb6c1affa4
SHA512 7f76e3a61151cd0e85aede162c7997e41a2f77885bca7c10aa2045a7c18608befee5d51dab6e90ca3044c4b078caf3d0a5069558f06ba9e15e009e02ec8034ce
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T177545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjecwrpjhb.exe

Path C:\Temp\mjecwrpjhb.exe
Size 361KB
SHA256 a5cc7b4e592bcfef9bf4084d8afe89b9fe21bd60c45a24a8b33c34599c381b14
MD5 b56dde61a8f1a96cd8a297289f00e6a2
SHA1 3edbe44b5bfe0995da1e1a17f177915b11ffc61d
SHA512 1ac01589508a67b065e0fd54c4028417023e21deb8d9df26baaec79f2c5248b61a49983a3593db9187867ec2b57aca607c88b3c28489014b46bdde1d606375cc
SSDEEP 6144:xflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:xflfAsiVGjSGecvX
TLSH
T196747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkidavtnl.exe

Path C:\Temp\sqkidavtnl.exe
Size 361KB
SHA256 7a8e5333d62b0b7802b3c41568671ea0a29095a38f00b43484e291c8d15d2675
MD5 e632f583a9bc3e2f3463cf35a328e3a0
SHA1 3fda4a485aad0b7ac24f1131483fce400cb3cb8b
SHA512 e1d3657a84d02980b51ae4b4c323205e009334b57b5a0a72babd325db4415d310e5bfe103f3d4ae4a793e8a23383bdf629c20dd2bc3a2fc1a0b7d42467f4a7ee
SSDEEP 6144:QflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:QflfAsiVGjSGecvX
TLSH
T1AE747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrpjgeztrm.sys

Path C:\Temp\wrpjgeztrm.sys
Size 293KB
SHA256 62b3cba50a225cf161958b2d2e21231d59fb21c2388371e043507dcb801160c0
MD5 6499a0bc68573f554ce0543c64dcc992
SHA1 4862b9010635275562bcd9e29427de38fd8921e2
SHA512 acbe574419d54ce826a9215292dc4656500924741476bd751da8e80a7a7a308cd564cf92e98ae6e577b7710f9812283270e11a2455e1eff5295396fa1481cf3d
SSDEEP 3072:/tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:/IJjiJcbI03GBc3ucY5DCSj
TLSH
T1AF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqlidaytq.exe

Path C:\Temp\yvqlidaytq.exe
Size 361KB
SHA256 4908359c3c6fdd4d1480763d665f8ef34e068b8bfdf34f0a84060eb9babc6ea3
MD5 f591b9c4c99eed0a46aa3001e3664dc9
SHA1 23ed8d8e82d75965f57b88a267338fa444058e4e
SHA512 7d80b879a11268f3e563b3136e124226b66c6e5e60f74c64d6f4e30f8ba9b2eb1cd344a438edd2e108d386d5b01eef056c7884425116a8abd83e75356acd8534
SSDEEP 6144:8flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:8flfAsiVGjSGecvX
TLSH
T182747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztojeywtlj.exe

Path C:\Temp\ztojeywtlj.exe
Size 361KB
SHA256 38fd85c258cb6473597b2cc7dc7a3a34b8babb1f89a6cac5b67bd3e230932474
MD5 ba6b97d54e8f99c57761b35e7202d13e
SHA1 ef05e400d1d5436a9b276172701b9392edcc77ff
SHA512 d1eca7fc5c0fb0c63644b0471076cfd054dc76d534d48ac2e722637100d848a5fe823305dba7729fbeb048009f0b7357f69f11605a1c13baef10f01c4e2d3bc3
SSDEEP 6144:HflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:HflfAsiVGjSGecvX
TLSH
T1EC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7d1497bd66d8fd0e349faeb1ee0d67310583a348cd7ad91abbcf84114528c66b
MD5 ef7b014ed3d602255e9a1632e6d92a07
SHA1 55ce04dbb49b3d373ab5f63432d8b64740943204
SHA512 045887982b4a42bf240a946a05a53d93e21fa6e9239edd4ce471cfef0aa96f199cf81449076fe6b881eb06f7e5560c35ed0b6c9c8144805327cff0db1c726320
TLSH
T1636139438FEA29A1DB27C8B19C9D725932F4A4B4C50B6E0720CC5EB48B02FCAE0D1473
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596b53.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596b53.TMP
Size 3KB
SHA256 4e2f66137b4e2ad8a10564cdc93ecbc0e1815e8ff9744d7e3f9361de14ba09e0
MD5 e482bf55dea81eda533b98eba9e3e44f
SHA1 f1820894c925957f7b2688bc845f5be631869f4e
SHA512 ceab47a7cdbb52e982e720e4193b0d5161781b4550ca528640908ab482dd9a904e0ff5b79480c6a96f2eb66f2e4c6ae308af3c6982cc2037e16374b741b8a9cf
TLSH
T1EC6139438FEA29A1DB27C8B19CAD725932F4A4B4C40B6E0720DC5E748B02FCAE0D1473
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8b664f3590dc1c7e663006925e3b4962be179a08a031082b7aaf46a92f3863f3
MD5 33fce1db6c76c83a8a3dc787a86d286f
SHA1 cf535cb32a81917d25c5cac0a4c194fe596d0b53
SHA512 ee3386dacb2a5aa96e9b22290c9f2a02abf0e7435b2c20cd505eef8e9dfd4ed47a06d4fb53752d96b3b2eda489b6cb46a266979bce674b65d57f9492259d197b
TLSH
T1A751CCF3C3E5866EC91196F0AA187E2FCE1D0915832C3D5AC9E4EE1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 78f7068c8c9f02bb067655c37d809073476daf50826c3a783c350da22edc879e
MD5 17672a4fc38067fb947752c6924620dd
SHA1 e7a2a42206b9d3e99b32b0c85673e87d214f58fb
SHA512 8dbd5e06b39d440f4043ad732a44b741b9f1b47da5b8f43fdfd0add4e041a22259af1b3c60266004a2e5d6048319971fdb27744dba907ba39538e4d146c5981c
SSDEEP 192:sxRwRayM/jK1Ml8wCv/fpsr1nQZSOPYMzoD8pi/g6+WNIYGP6ksGXIgtJ:sxRw48v/fpsRnOPQki/5IRf3
TLSH
T11452E915AA345977CCDBD20DFA55BF93D6F81433A2901E04AAFCCA0C44E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1254bd97ea99dc0bd5420e409c83ba3b660a2589d4e7e0744a1d2ca8155077f6
MD5 d2fb96d9de43555041760798d053f6b5
SHA1 aee66e08a15d922fe347bc270e4f7a0993285311
SHA512 99f51e63be0da0f70cc16e28f6665cd63b61ac27cde093d4fba5aa8066c964f03808aa70de9e3d29a31c0de6dce0a54263a78f0962e65a343918a719890124a3
SSDEEP 192:sxRTRayM/jK1Ml8wCv/fpsF1nQZSOPYMzoD8pi/g6+WNIYGP6ksGXIgDOJ:sxRT48v/fps/nOPQki/5IRf+
TLSH
T1DA62E916A9345977CCDBD20CFA557F93D6F81473A2901E44AAFC8A0C44E6AED621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b2555c58f2514eaa1e4bdc022b3243e4c5486e1448cb4bad7b68218a996bb0e3
MD5 6f450c20fccf2d957840bc2cd9574df5
SHA1 50ad99dab3f8bd9cf4c0fa8662c1ea3d33942965
SHA512 de92be8047805d0b0a3ffa59cf27beda3bc6be640577ca7cbcd176f9d1014b7ac0e61ba7731fd6cfb9f4839bcb35ed99b68e641642920cb61beec46156017f78
SSDEEP 192:sxRTRayM/jK1Ml8UQECv/fpsF19QZSOPUMzoD8prL/g6+WNIYGeksGXIgDAJ:sxRT4qTv/fps/9OP8kv/5IxfY
TLSH
T12B62E816A9245977DCDBD20DFA51BF93D6F81473A2901E44ABFCCA0C04E6ADD621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 dc612bf498df2eccd1882029765ad75881f4979f80cc0e88d1f76362594c1879
MD5 81ed032c895c20443e48e23736c47cae
SHA1 3b4e5fa9741bc9cfc7b0a540b563bdd9d202c907
SHA512 6b389a2aff4ac80c90c156f66037621954984bfa66a41c3fa3ac15e2b6ff3003e21ef21ce46beaf3dffb80db6e89a54da30c12b661c2d81dd87a8d6e46487ed4
SSDEEP 768:UtiiB37pLuL7ANWgv7fgJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVs8xpN0rroYts:UtiiBxE7ANWgv7fgJu1jaT8xf0YYs
TLSH
T19CE20C7B680CCB7E4F804A9CEC29BD9E6DE801CB56D8CD9447EA880C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 348f2356edd3e118cf6794bd470714096f6d4eabf0301dbf461a3c91cecdddcd
MD5 95eb61162fc0ba21555ea80f4e4d3fcf
SHA1 4c3d4b22277770f3d921a2e56c652078ebb4720d
SHA512 7d91e26049bbbb4313c8de59d66d67cd916f30ec949ad3435c5f2f8ecc8336d949d6142032ca4cb896f03f29c8bff3848cd0d066c9d3593496116d83faf88a0c
SSDEEP 96:KRm7KmgIIOW4tVgGOK47g0OcOGlkinOiU0kiWs5RgSiK4HgIicy6hAiLuBSKSwX2:Cm7KmgIIJ4tWGm7g09OGlkinOiU0kdsQ
TLSH
T16191ED45713A025538BD691D81BA992B92C2B0B33158E62B7BE911B70F36F078EFD4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a05dd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a05dd.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a05a021e4901933e84eed86ecc3b3a999ed1a25d47679d0f721c8a75046f0516
MD5 3097cb764c9c6667cc59848a84845f2e
SHA1 0b5cd67a27325528d03349e1cefd9bc4a57601c6
SHA512 ee07c32cc69f6c11968d5c8175d226ef3a23a042035451123e19a398f0a66eb6f9d32db8a093a8f8d21180755e0d1c38e36740cf156820e838710d64c2223a68
SSDEEP 768:e6j+9C32RPlYyyb17Hucys6BRvi82oP4/z6himo6Lb9MLZk:e59C32J3imOz6Imo0b+LZk
TLSH
T155F2BF34E8568E72DCAB8299B58B3BE67FE01277458C1D84E9DDAF0D05C3B6D4317822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 039e32dff3b5d83044e4eacb9debe08e7e3ecd7d1d3bb63ff38f17ac47ba3dd9
MD5 8e70a21677b5c7f4bcaa54d59ef57b1f
SHA1 80dbbef330797ea1dd418777226aacfb278328e3
SHA512 2764f0f152bc4e8d495cb5f1467bf4766a582c4721fa858815f0f9c96e3fa224f13732e63af655d149dec4784535de4869a0ffdb7dc28926cf698debd3be2406
SSDEEP 768:xGrv+4UNbdS39GglYyyo7Hucys6BRvi82oP4/z6himo+F2bwn+h:xGbsbw39w3imOz6ImoK0w+
TLSH
T15903CF35F4048972EDE78288B1467B937FF4522345C91AC0E6DE6B0E029BA5E530BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 9f3bfcf57dee94473fc3b74001c2ec1f13622f70f9e058e6e580a365e9afed35
MD5 eb158763b56d1901cc9d2a452fe65562
SHA1 c309cb3eb73e23c6176a7bc8d9ca138c6d7d11a2
SHA512 ea6b84a9a75de3c66b8d3606c7b563ebf5763b658010aef29bbd86030e7244eb17bad3762689632267d6217ac4c853c899c19a30915d44284e4a39e70e9261a6
SSDEEP 768:6lj+9C3VsPlYyyC7Hucys6BRvi82oP4/z6himo6Lb9MLZk:6Q9C3Vn3imOz6Imo0b+LZk
TLSH
T14AF2BF34E8568E72DCAB8299B58B3BE67FE0127745CC1D84E9DDAF0D05C366D4317822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3379c58da35c226c641b27d236935e39ba0db323cf35465dedc56f1c682a0efc
MD5 ee453d6e93d363878ee12bd04bd2fcd8
SHA1 e503318ad8ce593f8ca88298d7e9d82e2cb2a6e3
SHA512 d31e2ec65b6b4c340951d6311fc95bb4df0c5d81d6f892d66c847485084076eaf6b3c7fb04160622fafb14861c232ab516c10d9386fdad594fd3599a5e397ea9
SSDEEP 768:W0FKj+9j3swgvR+yWqx7Hucys6BRvi82oP4/z6himo6Lb9MLZk:WU9j3gu3imOz6Imo0b+LZk
TLSH
T140038D35E855CE77EDE787D9B64A3B96AEE01273858C9DC4EAD95F4C00C36AD030AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8c39186e62f3a961d067d8b9b51994122506fbd6ec929ff415df691c9278f203
MD5 ca03223d64003344f7e3c204b14ceec7
SHA1 9feabdb097d050cc9350207ad04ab5ae85a5f99e
SHA512 a23173b068766b336df00c1a237a12b7a348ae5db7d8059627a7126c751ee1130a823763c29a11fa7e6ad18707cbd00341b6967f73d831eab6a032a7d8641cb7
SSDEEP 768:6Ej+9C3ZkPlYyyb+7Hucys6BRvi82oP4/z6himo6Lb9MLZk:6T9C3Zf3imOz6Imo0b+LZk
TLSH
T12BF2BF34E8558E72DCAB8299B58B3BD67FE0127745CC1D84E9DDAF0D05C3A6D4317822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

85b856e4-413a-48e7-8977-ef1a03cf79a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\85b856e4-413a-48e7-8977-ef1a03cf79a6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4708_2112642853\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 dfbc8e2ba231ed4248698419fd34e027d0afa3213e7626d6e8c2742027e421ab
MD5 2b8c8cf9f5814762783f2cc0506294b7
SHA1 5f5d5f6495a9799fe5930a6fa17d95cb5bde3f95
SHA512 156eb87ce995a0fd0d310190ba620d911f8b3f6144109c6b8144e57e296e09443a1255a60b049e5691a6d753203433ddc5ec0dd19eec0c04d86a29897cc66ac4
TLSH
T18A71238356B9C9F3C1DB5BF002835604F1FF22380B23302407959546AB30ABE28B9F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/580-499-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/616-240-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1520-312-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1636-482-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1716-193-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2176-438-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2524-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3244-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3268-449-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3408-365-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3416-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4332-393-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4468-434-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4520-268-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4752-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4752-381-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5140-414-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5140-65-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5260-340-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5768-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download