systex | 05b0a09d51b9daa79ae96db0d89afebfbb1cae87d451cad3c8947537acac4163

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260706-2dpmxscx7z
SHA256 05b0a09d51b9daa79ae96db0d89afebfbb1cae87d451cad3c8947537acac4163
MD5 1d1b89e0dad77457a4002aedc347b131
SHA1 82f49a8483f47bcb6b183de0303b6e7aa1394a09
SHA512 4210b3f8ff631c5530142cc16688247f021c9c75d72738be6816063de8534d021ba0fc4aad86f8dbf169ba062cbead211332e0cb2380a4796592695ce092db55
SSDEEP 6144:rflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:rflfAsiVGjSGecvX
TLSH
T12B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2164	keczurmkhczurpmk.exe
5036	keczurmkhczurpmk.sys
5896	CreateProcess.exe
3320	rpmhezwuom.exe
2068	CreateProcess.exe
4484	CreateProcess.exe
1548	i_rpmhezwuom.exe
368	gezwrpjhbz.sys
3600	CreateProcess.exe
2540	ztrpjhbztr.exe
6096	CreateProcess.exe
3128	CreateProcess.exe
5360	i_ztrpjhbztr.exe
2844	jgeytrljgb.sys
1160	CreateProcess.exe
5404	jgbztrljdb.exe
5084	CreateProcess.exe
5272	CreateProcess.exe
3412	i_jgbztrljdb.exe
3920	bytqoljdby.sys
6112	CreateProcess.exe
5996	gayvtqliga.exe
624	CreateProcess.exe
2996	CreateProcess.exe
5672	i_gayvtqliga.exe
4128	qoigaytqlg.sys
2992	CreateProcess.exe
5812	aysqlidbvq.exe
5052	CreateProcess.exe
1880	CreateProcess.exe
5228	i_aysqlidbvq.exe
2408	faxvsqkica.sys
1944	CreateProcess.exe
3936	gaysqkidav.exe
6120	CreateProcess.exe
5472	CreateProcess.exe
5620	i_gaysqkidav.exe
2572	zxspkicaus.sys
4848	CreateProcess.exe
4408	usnkfdxvsn.exe
3348	CreateProcess.exe
3340	CreateProcess.exe
2912	i_usnkfdxvsn.exe
1404	pkhcausmkf.sys
628	CreateProcess.exe
1736	jhfzxrpkhc.exe
5196	CreateProcess.exe
1596	CreateProcess.exe
4620	i_jhfzxrpkhc.exe
264	smkhcausmk.sys
1716	CreateProcess.exe
4948	xuomhecwup.exe
3688	CreateProcess.exe
1340	CreateProcess.exe
3536	i_xuomhecwup.exe
6024	wuomhbztrm.sys
2292	CreateProcess.exe
3964	rmkecwuomh.exe
1216	CreateProcess.exe
880	CreateProcess.exe
992	i_rmkecwuomh.exe
4316	geywromgey.sys
4184	CreateProcess.exe
4620	geywuomgey.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_1618485940\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_135066766\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_852284997\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_1245684667\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_135066766\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_852284997\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_1245684667\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_1245684667\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_1245684667\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhfzxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xuomhecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcausmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzwurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmhezwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usnkfdxvsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzwurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqlidbvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhfzxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdbvsqolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcausmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igeytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlfdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecxuhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmhezwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usnkfdxvsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xuomhecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecxuhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqlidbvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljebwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igeytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdbvsqolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlfdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljebwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keczurmkhczurpmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gayvtqliga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gayvtqliga.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4312	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5412	ipconfig.exe
4812	ipconfig.exe
1268	ipconfig.exe
5736	ipconfig.exe
3764	ipconfig.exe
5768	ipconfig.exe
2568	ipconfig.exe
1728	ipconfig.exe
3936	ipconfig.exe
2256	ipconfig.exe
4864	ipconfig.exe
5888	ipconfig.exe
3708	ipconfig.exe
4468	ipconfig.exe
3488	ipconfig.exe
5888	ipconfig.exe
5636	ipconfig.exe
5104	ipconfig.exe
2352	ipconfig.exe
4488	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3575702013-381963388-2545377694-1000\{D146AA6E-80BB-4EE6-AAF1-95E89FADEF4A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2164	keczurmkhczurpmk.exe
2164	keczurmkhczurpmk.exe
2164	keczurmkhczurpmk.exe
2164	keczurmkhczurpmk.exe
2164	keczurmkhczurpmk.exe
2164	keczurmkhczurpmk.exe
2164	keczurmkhczurpmk.exe
2164	keczurmkhczurpmk.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1548	i_rpmhezwuom.exe
Token: SeDebugPrivilege	5360	i_ztrpjhbztr.exe
Token: SeDebugPrivilege	3412	i_jgbztrljdb.exe
Token: SeDebugPrivilege	5672	i_gayvtqliga.exe
Token: SeDebugPrivilege	5228	i_aysqlidbvq.exe
Token: SeDebugPrivilege	5620	i_gaysqkidav.exe
Token: SeDebugPrivilege	2912	i_usnkfdxvsn.exe
Token: SeDebugPrivilege	4620	i_jhfzxrpkhc.exe
Token: SeDebugPrivilege	3536	i_xuomhecwup.exe
Token: SeDebugPrivilege	992	i_rmkecwuomh.exe
Token: SeDebugPrivilege	3808	i_geywuomgey.exe
Token: SeDebugPrivilege	3224	i_igeytqljdb.exe
Token: SeDebugPrivilege	1464	i_lfdbvsqolg.exe
Token: SeDebugPrivilege	5580	i_qlfdbvtnlg.exe
Token: SeDebugPrivilege	1744	i_kicausnkfc.exe
Token: SeDebugPrivilege	1688	i_hcausmkecx.exe
Token: SeDebugPrivilege	5652	i_mkecxuhfzx.exe
Token: SeDebugPrivilege	4496	i_bzwurmkecw.exe
Token: SeDebugPrivilege	3504	i_trljebwtom.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4984	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 2164	3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 3344 wrote to memory of 3712	3344	2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 3712 wrote to memory of 4984	3712	iexplore.exe	89
PID 4984 wrote to memory of 5712	4984	msedge.exe	90
PID 4984 wrote to memory of 2760	4984	msedge.exe	91
PID 4984 wrote to memory of 4312	4984	msedge.exe	92
PID 4984 wrote to memory of 2760	4984	msedge.exe	91
PID 4984 wrote to memory of 2760	4984	msedge.exe	91
PID 4984 wrote to memory of 2248	4984	msedge.exe	93
PID 4984 wrote to memory of 2248	4984	msedge.exe	93
PID 4984 wrote to memory of 5804	4984	msedge.exe	94
PID 4984 wrote to memory of 5804	4984	msedge.exe	94
PID 4984 wrote to memory of 5632	4984	msedge.exe	95
PID 4984 wrote to memory of 5804	4984	msedge.exe	94
PID 4984 wrote to memory of 5632	4984	msedge.exe	95
PID 4984 wrote to memory of 5632	4984	msedge.exe	95
PID 4984 wrote to memory of 5192	4984	msedge.exe	97
PID 4984 wrote to memory of 2584	4984	msedge.exe	98
PID 4984 wrote to memory of 5192	4984	msedge.exe	97
PID 4984 wrote to memory of 5192	4984	msedge.exe	97
PID 4984 wrote to memory of 2584	4984	msedge.exe	98
PID 4984 wrote to memory of 2584	4984	msedge.exe	98
PID 4984 wrote to memory of 1360	4984	msedge.exe	99
PID 4984 wrote to memory of 1360	4984	msedge.exe	99
PID 4984 wrote to memory of 5872	4984	msedge.exe	103
PID 4984 wrote to memory of 5012	4984	msedge.exe	104
PID 4984 wrote to memory of 5872	4984	msedge.exe	103
PID 4984 wrote to memory of 5012	4984	msedge.exe	104
PID 2164 wrote to memory of 5896	2164	keczurmkhczurpmk.exe	105
PID 4984 wrote to memory of 2756	4984	msedge.exe	108
PID 3320 wrote to memory of 2068	3320	rpmhezwuom.exe	110
PID 4984 wrote to memory of 3224	4984	msedge.exe	115
PID 4984 wrote to memory of 3224	4984	msedge.exe	115
PID 4984 wrote to memory of 6084	4984	msedge.exe	116
PID 4984 wrote to memory of 6084	4984	msedge.exe	116
PID 2164 wrote to memory of 4484	2164	keczurmkhczurpmk.exe	117
PID 2164 wrote to memory of 3600	2164	keczurmkhczurpmk.exe	121
PID 2540 wrote to memory of 6096	2540	ztrpjhbztr.exe	123
PID 2164 wrote to memory of 3128	2164	keczurmkhczurpmk.exe	126
PID 2164 wrote to memory of 1160	2164	keczurmkhczurpmk.exe	130
PID 5404 wrote to memory of 5084	5404	jgbztrljdb.exe	132
PID 2164 wrote to memory of 5272	2164	keczurmkhczurpmk.exe	135
PID 2164 wrote to memory of 6112	2164	keczurmkhczurpmk.exe	139
PID 5996 wrote to memory of 624	5996	gayvtqliga.exe	141
PID 2164 wrote to memory of 2996	2164	keczurmkhczurpmk.exe	144
PID 4984 wrote to memory of 1404	4984	msedge.exe	146
PID 4984 wrote to memory of 5384	4984	msedge.exe	147
PID 4984 wrote to memory of 4908	4984	msedge.exe	148
PID 2164 wrote to memory of 2992	2164	keczurmkhczurpmk.exe	151
PID 5812 wrote to memory of 5052	5812	aysqlidbvq.exe	153
PID 2164 wrote to memory of 1880	2164	keczurmkhczurpmk.exe	156
PID 2164 wrote to memory of 1944	2164	keczurmkhczurpmk.exe	160
PID 3936 wrote to memory of 6120	3936	gaysqkidav.exe	162
PID 2164 wrote to memory of 5472	2164	keczurmkhczurpmk.exe	165
PID 2164 wrote to memory of 4848	2164	keczurmkhczurpmk.exe	169
PID 4408 wrote to memory of 3348	4408	usnkfdxvsn.exe	171
PID 2164 wrote to memory of 3340	2164	keczurmkhczurpmk.exe	174
PID 2164 wrote to memory of 628	2164	keczurmkhczurpmk.exe	178
PID 1736 wrote to memory of 5196	1736	jhfzxrpkhc.exe	180
PID 2164 wrote to memory of 1596	2164	keczurmkhczurpmk.exe	183
PID 4984 wrote to memory of 4400	4984	msedge.exe	185
PID 4984 wrote to memory of 4400	4984	msedge.exe	185
PID 2164 wrote to memory of 1716	2164	keczurmkhczurpmk.exe	191
PID 4948 wrote to memory of 3688	4948	xuomhecwup.exe	193

C:\Users\Admin\AppData\Local\Temp\2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_1d1b89e0dad77457a4002aedc347b131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Temp\keczurmkhczurpmk.exe
  C:\Temp\keczurmkhczurpmk.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpmhezwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5896
  - - C:\Temp\rpmhezwuom.exe
      C:\Temp\rpmhezwuom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3320
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpmhezwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4484
  - - C:\Temp\i_rpmhezwuom.exe
      C:\Temp\i_rpmhezwuom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrpjhbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3600
  - - C:\Temp\ztrpjhbztr.exe
      C:\Temp\ztrpjhbztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2540
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6096
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrpjhbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3128
  - - C:\Temp\i_ztrpjhbztr.exe
      C:\Temp\i_ztrpjhbztr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgbztrljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1160
  - - C:\Temp\jgbztrljdb.exe
      C:\Temp\jgbztrljdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5084
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgbztrljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5272
  - - C:\Temp\i_jgbztrljdb.exe
      C:\Temp\i_jgbztrljdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gayvtqliga.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6112
  - - C:\Temp\gayvtqliga.exe
      C:\Temp\gayvtqliga.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5996
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:624
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gayvtqliga.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2996
  - - C:\Temp\i_gayvtqliga.exe
      C:\Temp\i_gayvtqliga.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqlidbvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2992
  - - C:\Temp\aysqlidbvq.exe
      C:\Temp\aysqlidbvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5812
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5052
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqlidbvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1880
  - - C:\Temp\i_aysqlidbvq.exe
      C:\Temp\i_aysqlidbvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaysqkidav.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1944
  - - C:\Temp\gaysqkidav.exe
      C:\Temp\gaysqkidav.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3936
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6120
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaysqkidav.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5472
  - - C:\Temp\i_gaysqkidav.exe
      C:\Temp\i_gaysqkidav.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usnkfdxvsn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4848
  - - C:\Temp\usnkfdxvsn.exe
      C:\Temp\usnkfdxvsn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4408
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3348
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usnkfdxvsn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3340
  - - C:\Temp\i_usnkfdxvsn.exe
      C:\Temp\i_usnkfdxvsn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhfzxrpkhc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:628
  - - C:\Temp\jhfzxrpkhc.exe
      C:\Temp\jhfzxrpkhc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1736
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5196
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhfzxrpkhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1596
  - - C:\Temp\i_jhfzxrpkhc.exe
      C:\Temp\i_jhfzxrpkhc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xuomhecwup.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1716
  - - C:\Temp\xuomhecwup.exe
      C:\Temp\xuomhecwup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4948
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3688
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xuomhecwup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1340
  - - C:\Temp\i_xuomhecwup.exe
      C:\Temp\i_xuomhecwup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmkecwuomh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2292
  - - C:\Temp\rmkecwuomh.exe
      C:\Temp\rmkecwuomh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3964
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1216
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmkecwuomh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:880
  - - C:\Temp\i_rmkecwuomh.exe
      C:\Temp\i_rmkecwuomh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywuomgey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4184
  - - C:\Temp\geywuomgey.exe
      C:\Temp\geywuomgey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4620
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2168
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywuomgey.exe ups_ins
    3⤵
    PID:5008
  - - C:\Temp\i_geywuomgey.exe
      C:\Temp\i_geywuomgey.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igeytqljdb.exe ups_run
    3⤵
    PID:5388
  - - C:\Temp\igeytqljdb.exe
      C:\Temp\igeytqljdb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5604
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igeytqljdb.exe ups_ins
    3⤵
    PID:4392
  - - C:\Temp\i_igeytqljdb.exe
      C:\Temp\i_igeytqljdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3224
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdbvsqolg.exe ups_run
    3⤵
    PID:5384
  - - C:\Temp\lfdbvsqolg.exe
      C:\Temp\lfdbvsqolg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4768
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:236
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdbvsqolg.exe ups_ins
    3⤵
    PID:2496
  - - C:\Temp\i_lfdbvsqolg.exe
      C:\Temp\i_lfdbvsqolg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qlfdbvtnlg.exe ups_run
    3⤵
    PID:4940
  - - C:\Temp\qlfdbvtnlg.exe
      C:\Temp\qlfdbvtnlg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2792
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2460
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5636
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qlfdbvtnlg.exe ups_ins
    3⤵
    PID:3912
  - - C:\Temp\i_qlfdbvtnlg.exe
      C:\Temp\i_qlfdbvtnlg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicausnkfc.exe ups_run
    3⤵
    PID:5100
  - - C:\Temp\kicausnkfc.exe
      C:\Temp\kicausnkfc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3824
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kicausnkfc.exe ups_ins
    3⤵
    PID:1956
  - - C:\Temp\i_kicausnkfc.exe
      C:\Temp\i_kicausnkfc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hcausmkecx.exe ups_run
    3⤵
    PID:3284
  - - C:\Temp\hcausmkecx.exe
      C:\Temp\hcausmkecx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3456
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hcausmkecx.exe ups_ins
    3⤵
    PID:1016
  - - C:\Temp\i_hcausmkecx.exe
      C:\Temp\i_hcausmkecx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkecxuhfzx.exe ups_run
    3⤵
    PID:368
  - - C:\Temp\mkecxuhfzx.exe
      C:\Temp\mkecxuhfzx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5348
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkecxuhfzx.exe ups_ins
    3⤵
    PID:1236
  - - C:\Temp\i_mkecxuhfzx.exe
      C:\Temp\i_mkecxuhfzx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzwurmkecw.exe ups_run
    3⤵
    PID:1548
  - - C:\Temp\bzwurmkecw.exe
      C:\Temp\bzwurmkecw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3508
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4512
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzwurmkecw.exe ups_ins
    3⤵
    PID:3352
  - - C:\Temp\i_bzwurmkecw.exe
      C:\Temp\i_bzwurmkecw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljebwtom.exe ups_run
    3⤵
    PID:1516
  - - C:\Temp\trljebwtom.exe
      C:\Temp\trljebwtom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3204
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6080
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljebwtom.exe ups_ins
    3⤵
    PID:1036
  - - C:\Temp\i_trljebwtom.exe
      C:\Temp\i_trljebwtom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtolgeywqo.exe ups_run
    3⤵
    PID:2312
  - - C:\Temp\wtolgeywqo.exe
      C:\Temp\wtolgeywqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4132
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4468
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ffe01b7c188,0x7ffe01b7c194,0x7ffe01b7c1a0
      4⤵
      PID:5712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,3954390288238740663,12981909373887677320,262144 --field-trial-handle=2940,i,11622862756946646325,13222142482556084552,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:2
      4⤵
      PID:2760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,6195117104483678052,6945834241915790934,524288 --field-trial-handle=2940,i,11622862756946646325,13222142482556084552,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:11
      4⤵
      System Time Discovery
      PID:4312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,6125253666664729031,2406289303644557589,524288 --field-trial-handle=2940,i,11622862756946646325,13222142482556084552,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:13
      4⤵
      PID:2248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3628,i,639215917674121144,178747022728764149,2097152 --field-trial-handle=2940,i,11622862756946646325,13222142482556084552,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
      4⤵
      PID:5804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3640,i,4545364803603382439,4596671767671255309,2097152 --field-trial-handle=2940,i,11622862756946646325,13222142482556084552,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
      4⤵
      PID:5632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,11398482665104539549,1926171192262240181,2097152 --field-trial-handle=2940,i,11622862756946646325,13222142482556084552,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:1
      4⤵
      PID:5192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,10327956113015285843,9380367771033782512,2097152 --field-trial-handle=2940,i,11622862756946646325,13222142482556084552,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:9
      4⤵
      PID:2584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,15879402548237901575,5158539293975502315,524288 --field-trial-handle=2940,i,11622862756946646325,13222142482556084552,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
      4⤵
      PID:1360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,14748047059518002508,13048684433642808022,524288 --field-trial-handle=2940,i,11622862756946646325,13222142482556084552,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
      4⤵
      PID:5872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,8939197184679594855,5734960975706925015,524288 --field-trial-handle=2940,i,11622862756946646325,13222142482556084552,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,8283678934227635276,2673201198058144556,524288 --field-trial-handle=2940,i,11622862756946646325,13222142482556084552,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
      4⤵
      PID:2480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,8283678934227635276,2673201198058144556,524288 --field-trial-handle=2940,i,11622862756946646325,13222142482556084552,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
      4⤵
      PID:2756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,4900397012456338850,13572582997322176231,524288 --field-trial-handle=2940,i,11622862756946646325,13222142482556084552,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
      4⤵
      PID:3224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,15238389769797860431,8707580261964091340,524288 --field-trial-handle=2940,i,11622862756946646325,13222142482556084552,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
      4⤵
      PID:6084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,9726863725447874666,17405446606360123815,524288 --field-trial-handle=2940,i,11622862756946646325,13222142482556084552,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:14
      4⤵
      PID:1404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,15758784206238349130,5404102825740377028,524288 --field-trial-handle=2940,i,11622862756946646325,13222142482556084552,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
      4⤵
      PID:5384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,3007269305127138018,2244467622178050185,524288 --field-trial-handle=2940,i,11622862756946646325,13222142482556084552,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:14
      4⤵
      PID:4908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,14739799438262478968,7720397132811785350,524288 --field-trial-handle=2940,i,11622862756946646325,13222142482556084552,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
      4⤵
      PID:4400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,1103976917144104479,4678927446728380232,524288 --field-trial-handle=2940,i,11622862756946646325,13222142482556084552,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,12175552307664681355,17955861424298271495,524288 --field-trial-handle=2940,i,11622862756946646325,13222142482556084552,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
      4⤵
      PID:5100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,15864187700610135136,13687435286598638544,524288 --field-trial-handle=2940,i,11622862756946646325,13222142482556084552,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:14
      4⤵
      PID:908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6732,i,14898065075642882888,3358663580221875984,262144 --field-trial-handle=2940,i,11622862756946646325,13222142482556084552,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:10
      4⤵
      PID:5360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,17922250160389176668,6737881774795938997,524288 --field-trial-handle=2940,i,11622862756946646325,13222142482556084552,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
      4⤵
      PID:3864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:764

C:\Temp\keczurmkhczurpmk.sys
C:\Temp\keczurmkhczurpmk.sys
1⤵
- Executes dropped EXE
PID:5036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3688

C:\Temp\gezwrpjhbz.sys
C:\Temp\gezwrpjhbz.sys
1⤵
- Executes dropped EXE
PID:368

C:\Temp\jgeytrljgb.sys
C:\Temp\jgeytrljgb.sys
1⤵
- Executes dropped EXE
PID:2844

C:\Temp\bytqoljdby.sys
C:\Temp\bytqoljdby.sys
1⤵
- Executes dropped EXE
PID:3920

C:\Temp\qoigaytqlg.sys
C:\Temp\qoigaytqlg.sys
1⤵
- Executes dropped EXE
PID:4128

C:\Temp\faxvsqkica.sys
C:\Temp\faxvsqkica.sys
1⤵
- Executes dropped EXE
PID:2408

C:\Temp\zxspkicaus.sys
C:\Temp\zxspkicaus.sys
1⤵
- Executes dropped EXE
PID:2572

C:\Temp\pkhcausmkf.sys
C:\Temp\pkhcausmkf.sys
1⤵
- Executes dropped EXE
PID:1404

C:\Temp\smkhcausmk.sys
C:\Temp\smkhcausmk.sys
1⤵
- Executes dropped EXE
PID:264

C:\Temp\wuomhbztrm.sys
C:\Temp\wuomhbztrm.sys
1⤵
- Executes dropped EXE
PID:6024

C:\Temp\geywromgey.sys
C:\Temp\geywromgey.sys
1⤵
- Executes dropped EXE
PID:4316

C:\Temp\jdbytqljdb.sys
C:\Temp\jdbytqljdb.sys
1⤵
PID:2728

C:\Temp\tqoigdbvtq.sys
C:\Temp\tqoigdbvtq.sys
1⤵
PID:4128

C:\Temp\vsqlidyvqn.sys
C:\Temp\vsqlidyvqn.sys
1⤵
PID:5932

C:\Temp\nifaxvsnlf.sys
C:\Temp\nifaxvsnlf.sys
1⤵
PID:852

C:\Temp\qkicspkhca.sys
C:\Temp\qkicspkhca.sys
1⤵
PID:1116

C:\Temp\mkecaupnhf.sys
C:\Temp\mkecaupnhf.sys
1⤵
PID:2840

C:\Temp\eczurpmhec.sys
C:\Temp\eczurpmhec.sys
1⤵
PID:4276

C:\Temp\bztrljebwu.sys
C:\Temp\bztrljebwu.sys
1⤵
PID:5020

C:\Temp\bzwurljebo.sys
C:\Temp\bzwurljebo.sys
1⤵
PID:5664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aysqlidbvq.exe

Path C:\Temp\aysqlidbvq.exe
Size 361KB
SHA256 97a4befa84f5cda3294de7926cbde5805889c565e3a4d23ae0aaa13a50aa0d30
MD5 974424a3bbdeb03833a9abc8f075c2d2
SHA1 a0157ca34660e3eb1e5efd21192951685919f591
SHA512 711683db8e0d74ba248baca170999edde909a4a6f7d4b3cf52f0eb0275fa65979655eedc4c7770ce085a2b123bbece62d44aa80a4273c80e13978c4eba9874ce
SSDEEP 6144:8flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:8flfAsiVGjSGecvX
TLSH
T148747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytqoljdby.sys

Path C:\Temp\bytqoljdby.sys
Size 293KB
SHA256 eb7cd07a455248c99a0f82beb48e833b7bf24c90863c9a448eb085699e278b23
MD5 b7ee884744bc4008217b30e9b38111b2
SHA1 c5239e9ebcfea81e0431179c9ca38ad3ef7b95e4
SHA512 a751a9708eea77c3581be2a73cf9b2ca1ef48a9b518f6eb66c806cd4295a513940dc6329ec0f1e7840cd8add90463b384d0255b5694199f564b87cd760402de6
SSDEEP 3072:9tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:9IJjiJcbI03GBc3ucY5DCSj
TLSH
T1BA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxvsqkica.sys

Path C:\Temp\faxvsqkica.sys
Size 293KB
SHA256 4cf63d24ded5d15a1cd277a916d63cc8b857888ce9892248b588346ec246b597
MD5 7bfa486791c19f6916e638c3da6b6240
SHA1 14a4cbf00dc83076ca7aea0e80f2303d06801dfe
SHA512 624234872932ecfe529bbadb781c10045e4ce56e196c598dc36a276019158ea9585af75e41a9fe847d10bbfae8c6face9970d718442c0fb11b72903f04f2dd92
SSDEEP 3072:itKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:iIJjiJcbI03GBc3ucY5DCSj
TLSH
T185545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaysqkidav.exe

Path C:\Temp\gaysqkidav.exe
Size 361KB
SHA256 0fcc486e9db283a4c55cd1444b3a18f07f3cc214dbdb7f5d95442bd8ad49ca82
MD5 639b87774227dba9624a1394138006a0
SHA1 feab812978f4ee3f8aa7763d82d2bdc1492871ed
SHA512 065489f56723fa3765295269290b223cfcf612db3cd410ad3e762a253a0e1146689d5a71745a0fa5ff0b7232546813ac27b6d28946c0a515ddffcddf9c0a9afd
SSDEEP 6144:VflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:VflfAsiVGjSGecvX
TLSH
T160747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gayvtqliga.exe

Path C:\Temp\gayvtqliga.exe
Size 361KB
SHA256 c2ec6d319928bde6409ec54046d15f5e62708e2e234a85ffea12c32f1030600d
MD5 577a4c16c2ad7c7e7000fc0bedcd9fa5
SHA1 e8912d87ae3bee5090dbd44d23f1b0ac2a96ee81
SHA512 870388dbfd02e6d00b23350bf799050abfcb4b91f515ae2added08e71be4ae67741efb8e2b6094ea7e00a13766e57e4b6e968740ecfb900bff5180552fb31397
SSDEEP 6144:qflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:qflfAsiVGjSGecvX
TLSH
T145747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gezwrpjhbz.sys

Path C:\Temp\gezwrpjhbz.sys
Size 293KB
SHA256 b4a7a80ffbaee006e55e5fd52954cfae147e082ac13ee6354ff46ada8e3a1ea9
MD5 934742cb32e0c64ac5bf108c614d3c7e
SHA1 c1e4d025429dc9e46879c7bc4ce7840f48ff5dbc
SHA512 4ce6a023ed0d5f18f93275ffb47262ef3ac56c24486c00da8da3ad641d8ff4b2c1237bc766d248a3e31d8bee567d9a36c4a7ca04449caee6810d81f61f678620
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T127545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aysqlidbvq.exe

Path C:\Temp\i_aysqlidbvq.exe
Size 361KB
SHA256 b59024760e99da2f50e08c4b95140b0e5864af1cc967c3430627382ded34d77e
MD5 2f87ee15550903d40a8615d73f815fc8
SHA1 0cb7874e6be2e795b7bf11530aa98d57b501f654
SHA512 a21a22212738e0c0bbe1dd7e1618d275dbdb888dc0dbb77f7abc4f89e5cb0394d2e05d8d10943d224b99006cbf2acfd5d4e2cb6ef0066a120fc81e2b995a2ca5
SSDEEP 6144:WflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:WflfAsiVGjSGecvX
TLSH
T113747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gayvtqliga.exe

Path C:\Temp\i_gayvtqliga.exe
Size 361KB
SHA256 a6a1270be0795c03645f3d6d413097b67ddcb6a5d9f3fd6844fb864ec975ceca
MD5 38ccf26561f801124e94dc1e313e7387
SHA1 ea1d92800fdea06c371deb9a2b3a9c3c56378eff
SHA512 efb4cf148718e11cf917820f9ef1c395fbb1f191b6d31bc50967fb987d6de4c77c4c58c15b1a64c80c3d2b20bbcaf234ca157ad728c4d932c54ec447f6e9f0aa
SSDEEP 6144:ZflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:ZflfAsiVGjSGecvX
TLSH
T18C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgbztrljdb.exe

Path C:\Temp\i_jgbztrljdb.exe
Size 361KB
SHA256 459d52f1b4e954f3d4f317455cde041993d14af2b4e9da6935eac219e2e0960e
MD5 7c63466f3232fc2136f5d6764f6b0df9
SHA1 51cdeaeebaffa1bd2666fb457f7688af0d7bca12
SHA512 825998207fc612f7a42fcfd606886aa45892efa63b7f6af5fb1aa2bfe9a0f63fdb491c9564b5cc7aba42635ca0b8ff77883ab8c97d3926d85f6aa628e9033f4e
SSDEEP 6144:6flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:6flfAsiVGjSGecvX
TLSH
T142747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpmhezwuom.exe

Path C:\Temp\i_rpmhezwuom.exe
Size 361KB
SHA256 f316d05fef97b5f0e24789bbe737b5bd13e01ada876440781baab3c6c1e855b6
MD5 143f65692cf6a8ed890fe02d705b8f1f
SHA1 0ca54a2fb45106f29b3060071e04f3686ad9b9d1
SHA512 4215a9ffd20ad1f4590277770f541936c30b053240f7225c387c3beb6528b7073862fa436b31cffb4bafd04f0c7ffa9a0b4ecc48b1165ad9a299a45dbba1e10b
SSDEEP 6144:aflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:aflfAsiVGjSGecvX
TLSH
T19D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztrpjhbztr.exe

Path C:\Temp\i_ztrpjhbztr.exe
Size 361KB
SHA256 716b1bc1e05cacbbc0147b4089961655d28610c7b4b0c8467adc48470681b708
MD5 7f278c450e4a89ec8daa6d11cb5ec445
SHA1 a7f600a789bfc9502a2866574d2e9395a6f1a7e8
SHA512 30543eb64003e2e62335d815c62eb588e76a6100bda58d7952dc38e7be0ed435b2f888368026ed4cdb18cab0fb3cebf1ca403595bd855649dedb87dfb02cf742
SSDEEP 6144:aflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:aflfAsiVGjSGecvX
TLSH
T139747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbztrljdb.exe

Path C:\Temp\jgbztrljdb.exe
Size 361KB
SHA256 97a6704802b97f26ff5ea99d11ea54063791978df9534c49eab7511c52bb1da2
MD5 354e5a953aa8105c3f3ab019c50a0ab6
SHA1 6a36a3a06569a6e96cdee804dc3097704c9cd0b6
SHA512 1b23c7b5ff4a40e682c1dd2c5f4e2b0468b8749054d46d19bb71fe4b28d5feb3449b0e4139e04abea79ad71a39ecb92a30e275df35bd7c276aa9f6ba35ace20f
SSDEEP 6144:FflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:FflfAsiVGjSGecvX
TLSH
T192747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgeytrljgb.sys

Path C:\Temp\jgeytrljgb.sys
Size 293KB
SHA256 5f87000fcbbbfdb58738faa286e2b9a975f1472ad01425e9f702c2e8984b462f
MD5 8d45a708dc438b16c1cd3595e16fd1dd
SHA1 48582f4ce31a3115c4fe35deefcd4a13e07cd32b
SHA512 1974d11edbfd3f0a858547ab60cb60d85bf0b7e1a8e7e08e2ffb01bf12b98852bd5a92da79b041e91950fa60e7f95cde50d50a961da0b3a59694ef3288eba5a4
SSDEEP 3072:0tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:0IJjiJcbI03GBc3ucY5DCSj
TLSH
T1BC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keczurmkhczurpmk.exe

Path C:\Temp\keczurmkhczurpmk.exe
Size 361KB
SHA256 6fe38b3e71d978de213d69af86846588d8be4e7e4958b0d5d948aeb391ede785
MD5 395c9f16513f1cd179c2ab569da81fc1
SHA1 147d7a135e9851e6f69e91530b22b46a77d1febe
SHA512 5eeaa1412c65ca77023202d9dcd8b0c3fac89671ce3a2ab5600c251ea29e8d98f3da00b1b88c05aa38f5933d1787a99f14d96a69e250b2e5c6ca37297d49ba61
SSDEEP 6144:5flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:5flfAsiVGjSGecvX
TLSH
T1F0747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keczurmkhczurpmk.sys

Path C:\Temp\keczurmkhczurpmk.sys
Size 293KB
SHA256 190516a6c6a8ba29155c54bbd9e907d939dc547468cffc8943ec267fee7b1eab
MD5 9ec14a665f90e09ab4f0d3de12989604
SHA1 3725b3a469f85e17a0e3fa5bc160c4dc1a7d487d
SHA512 b131167a0902862c68138b7c83b363870b37af9c5c56eaf7f72a6af4c5f4d991475692f2fa1682e353f30857a1ec824f07fe1c2a824c8791e203735d234b312e
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdO:xIJjiJcbI03GBc3ucY5DCSjT
TLSH
T110545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigaytqlg.sys

Path C:\Temp\qoigaytqlg.sys
Size 293KB
SHA256 21164e16dbd5e1a29e182b948f720b747d0755fac0ec9e0c77f4c2c098ddc0a4
MD5 6adf664e1518bc3e18b8ad2c3f3e97b0
SHA1 f360128e8842edbaef1d0258b2646b2155c9f117
SHA512 3650400166adc7cad50ed4cba866a11c8c70574eb154c2a0672d6d26d542b1018dec520abb3c93629ed63d789cb56da64954a6a2ae4a8ee4b8f1289addf0dce6
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T142545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpmhezwuom.exe

Path C:\Temp\rpmhezwuom.exe
Size 361KB
SHA256 6675aebeb6941fa027592c93266929bb1b53887519f3d98c7f94002dc5e9f897
MD5 592e384c0ad2182096e02c3c1d6defd1
SHA1 5985cd4b527f848b08e8964518a8ae6b8e162078
SHA512 9ecc548999527ec2af2de51a68d59bcaed78e84581b0280f2cb832d4e252232df55753ebf73405db05a7e32fed699d35c9fe426e279e7675a10d1c3f4ef770f6
SSDEEP 6144:vflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:vflfAsiVGjSGecvX
TLSH
T15B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrpjhbztr.exe

Path C:\Temp\ztrpjhbztr.exe
Size 361KB
SHA256 a6f3528ade00b9dd679ff984253c91ae0fb6d43ac6c8ec5baaec1ef8bedf5d03
MD5 ba7329dddf53bbfa0eba72c86c9a051f
SHA1 7946efa05596b15572cb84d32bd96b6ad3425110
SHA512 bfc1c1d6e4273f1c43b87a8950b9ab831252d38da06c87f081f45af7c9cc798f61334cf533fcc438f688d7db17656823822001f0a13c5c79b7fdf86003977ef3
SSDEEP 6144:BflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:BflfAsiVGjSGecvX
TLSH
T134747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fff4f5462f00db2197bad3d5dba44e0ed82332400e95ccd8e5aacbd03ea21ee9
MD5 5de064ddd4c36dfd1714ea6c60646443
SHA1 48976457417008f63c629290b82b7fcabfe4a7d6
SHA512 7cceae45d0afd44ac6288bfcc0bb9265585ec202aeed97194d26f5a717e32b99e16c516c465e3a99e12146fb39abc1e5707717e4ab27a4263928a6eadc9da500
TLSH
T1D6D09B747671D508DB40267265E55767F2015D35541D010C4041F17948557D106574AB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5373dba236158f8b47a5d7b664d171a8c47fe1fccd7b9ce0e1bd4afa2951d836
MD5 94a2023674c565156f1a36186c104810
SHA1 86e289a50e37125a5f15b949883b1e7188e31934
SHA512 d74a13f710bdf2137189f88217902762a3207a2efa776e19c74d44824ac997d398c4d0995f1b45894fe98d29700bf2a4ab26ab89b59bd32b83e714bdb7d03691
TLSH
T115D09B747661D508DB40267265E55767F2115D35681D010C4041F16948557D106574BF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8de26479b810ac45782af084d316ea532c05229d04a00e0c98dd505618195a10
MD5 eb9c513d6e4af70062aee3634bf2383d
SHA1 67cc0733ed4ffe5a37ab996cf8b9740a9bb357f6
SHA512 40133dbb5ee2818712e43b383a3dd4b2db76c590543eca45348f84572a406f2e7934d4f369e53991d93fd84cc74aaea98ab49852812f0b97456ad4a365bc6331
TLSH
T1C5610BD6137607EFDB2D9DF653E5A8983A7063770C0B9E83D0B9913A458B344B6012E2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59790e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59790e.TMP
Size 3KB
SHA256 92298dc2713194b2f9a3081944834e9390a2511881704c7334e35b3de58ab65f
MD5 d204d22dff139bcbb4a25b242f96670a
SHA1 843902a1314099d7dfca0eddc8f45dee542a968c
SHA512 4b77570349009f6897552bc7f7dbc7557ff68ede69ca2dcffeeb8f8ba33a02984da56f141f18c5ca2ea9a1d36a67aeaed384e675c5544dd25bc5efe9f8fd62d5
TLSH
T15A610BD6037607EFDB2D9DF653E5A8983A7063770C0B9E83D0BD913A458B344BA512E2
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2cf08b538a68d33a3130a8f96bd609292fffa41fb8a8b557aed4b90038272c61
MD5 5c5f7f6325d550a1dd8d4fecc7ff3603
SHA1 17f4764f23f1397337358b22659e70de568684c3
SHA512 f55a5aa1d0f5a6065449e38f69b3bca90159d4e35409dbd50029144055fd59a338f15e27077891c19557d53d0ef24e3f1ede4066d8e5aa77e011a9b733753ffb
TLSH
T1AD51A9F782E4866DC91156F0AB186E2BCE1D0A15832C3D5AC9E0EE5BD3E3471E102A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 75dc1efc49fc48b210c44c1ea3166e302356c7aa63024a70d4ef3f2c97ce02ef
MD5 f836f9783e690a6b8a1cd6611fe64772
SHA1 757d4495fee4f53cef64e7b03f8580e537d94387
SHA512 13cfab36365ef52328991955d20ca1d06626f14a738cf3fce6e8fa80f12517811e572488c0112206b0f99355c27257ebd1239791579c353c9e5f3c877a26239c
SSDEEP 192:sxR+/yM/jK1Ml8wCV/f4sR29sZXkbvdHdGzoA8p9+/g6+WNCty/YPX7tifGJIgtJ:sxR+58V/f4sRwSUb1RU/59/2Jv3
TLSH
T18862D9166A349977CCDBD219FA557F53D6F81562E2901E48AAFCCB0C01E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a3f5b23cb666712f844c3cb54f05be941582885280518ef5b110df157cb83193
MD5 62bf27227fda1d8ddd9ef583cd6435d4
SHA1 4310b574941eae35c571cfd3a214552aa9c1e124
SHA512 6f17cd39cd0c1ea0658df6737addf148a9ebbc8938e51ee118506590543243db1adeff53cc878dd685d586c8ffa290eb6ac359121057cc865604a1ea34d017bd
SSDEEP 192:sxRh/yM/jK1Ml8UQ2CV/f4sr29sZXkbvdHdGzoA8pr+/g6+WNCty/YPh7tifGJIp:sxRh5qxV/f4srwSUb1Ra/59/aJv+
TLSH
T1BB62D916AA349977CCDBD219FA55BB53D2F85572E2901E44AAFCCB0C01E7ADC211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3ef21fdf9843622f1efbcb91d4bebd7d9524b1fed9f30ea306885ae99c9226cf
MD5 3384976a31eba2eb50dbb53eb0b637d1
SHA1 fe4be92a4f3f78d12a4f90713d8249aafce3e250
SHA512 89f51690c355aed0bc798e4907c3193002640868429204a3b4d27088aed51dcb73bafa3e6f70c2def7fd0f136fd09f23b39763ef7d669bdaa963a23091176487
SSDEEP 192:sxRh/yM/jK1Ml8wCV/f4sr29sZXkbvdHdGzoA8p9+/g6+WNCty/YPX7tifGJIgDi:sxRh58V/f4srwSUb1RU/59/2Jv+
TLSH
T12B62DA16AA349977CCDBD219FA557F53D6F81562E2901E48AAFCCB0C01E7ADC211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 83fef6aa65fcb8c3328c07c379410d71924a721769f7d4cf493f05a61dad024b
MD5 7d3315b1a2e7554894f691247997d5ba
SHA1 d43bf011e16858d4ef5e18e6fbb9eed57ac4d876
SHA512 87a80ee0f4adff549199137f7234d2cf65e943f579ef017268a0f176338ca86355232556fe6bd157e8ea7b422737a717f13d15b70c97733e3d0fc9654ae193a0
SSDEEP 768:+Pw4HY7pLuL7QBWg5tf+T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVa8cUx2Dro/wZ:+Pw4HEE7QBWg5tf+Tu1jaV8cW2w2
TLSH
T12BE2EC7B680CCB7E4F804A9CAC29BD9BADD801CF96D8C95447FE881C03C66EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a159c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a159c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 4933a1817fe658f50927e622890df5e8fa508162251da6bb269e9dc2c6184b54
MD5 eb25ba51b39be07642a49ee52d07868e
SHA1 072d0c476f5a0fa6e8d15fa31f819ce2b4143c74
SHA512 da8c10fc40fd295cd2628a97b4632d8533eab910ec9b4f2708f715b3e2f2b3cf50e9510077d1de998c3e70884bbe1f555d09c90f6346e8b6c9c2eb0290040ecf
SSDEEP 768:grv+4UNbdX3ONSAYLNfR/cuyvKweY5PWu3N+py+UigCS:gbsbl3ON2Nfiua4e/0U5l
TLSH
T1F513CF32ACA5DD338CFBE294F24BB693AFB8206385840B58C1E51B0D075759D271BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 a68c658f98dc707c022cc255b3a6c3e1310ed9e2532291a3115f8cd6eb650cc2
MD5 5942567233de8c85b400079823f2c21c
SHA1 48db8866056001f50613ae5e1ccbefca66a81de2
SHA512 0987c5b47b1c164636c886d008a76b9832deefb8777dd6984e59ba538589b95043a76a735e8cf1765cf751e7bb840504247abadf851bad5d65ebce532d20e740
SSDEEP 768:1F1j+9B3RwgjNee7NfRRcuyvKweY5PWu3N+py+b9Mh:c9B3zNLNfYua4e/0b+h
TLSH
T1F91329F298D38A76D8AE4793A73D6E469EFCC163B1884984B7D41E0DCD831BFC206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 c465da295c89466078b7ce16b49a51289998d6d210ba043bce8358dbf7217152
MD5 ba812ea6874c47dc32e67e5afcf39c22
SHA1 52a244a02e42cc4b65c36b11b335a4d86d6f00e6
SHA512 845911fc160efdaff0aca5df69413e53e56e2d6c0c1e21f322f036f35d876ff627eb6d85e7921013b467a3e3acc0cd925408b072349f6e6bb0bca56c9bc8e76c
SSDEEP 768:Yrv+4UNbd43Pd6YLNfGcuyvKweY5PWu3N+pmPDUigCI:YbsbW3PzNfzua4e/hU53
TLSH
T18A03BF33ACA4D9738CE7A295F24BB693BFB81153D6840788C1E82B0D475759D2347D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9928accf06740e56da1f085df3b66ebb1185b216e94acb86c1d41c29cc5e70c9
MD5 afc05ecb28fb1d8ef562469ed9cb1908
SHA1 a6c5cfb066684f75bd831625a4b9dfb8d957e944
SHA512 dd0102285789b6a83d6cbeac7ffe8abb7a05ddf50bd7399c34cb47a51c5ea29a62b8346c433797a4250c838457f38730dcac65056d8e721a13fbdc60c7b211df
SSDEEP 768:5j+9B3JN3AYLNfRPcuyvKweY5PWu3N+py+b9Mh:k9B3JNTNf+ua4e/0b+h
TLSH
T134F2AE72ACA69E738CE792A4F75A7792EFF4116381840F48D5E86F0E068369C2717816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

9fead5ee-379d-4f4e-b3a1-54083c775888.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9fead5ee-379d-4f4e-b3a1-54083c775888.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4984_90765778\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 0439394503ee7d9e73c24b254f19efa23df2b392a909cec556de9e129e8fb7b7
MD5 436d2903b1754e2870cbc1a15f02300a
SHA1 0d6fc75ae54fee6818f5016a7984a25fd9cd8951
SHA512 983b2e8669f532194838be03a374cea66e50c6f15a48f56ddb324ee227fb7f3f40dfa6c128300bcd5086c99b3209173dd5d5db16019cb9e2710c422928ccf47f
TLSH
T1707123C35BF8CAF2C5DA5BF002836648F2FF2238076330744B519586AB30A7A18B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/264-347-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/368-245-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/368-193-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/852-446-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1116-457-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1404-331-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1404-349-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2408-310-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2572-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2572-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2728-401-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2728-423-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2840-462-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2844-276-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2844-239-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3920-268-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3920-295-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4128-421-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4128-285-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4276-482-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4316-381-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5020-494-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5036-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5664-511-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5932-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6024-352-0x0000000000010000-0x00000000000AB000-memory.dmp

Download