systex | 897c9bdcc8260454049110983e326188f053851da99d4e2317af8773113d044b

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260718-mkmdtabx6v
SHA256 897c9bdcc8260454049110983e326188f053851da99d4e2317af8773113d044b
MD5 b9a5020ac5532d8571e0feae8e8d1fe0
SHA1 2471a0d936a8581be7fbe6e5c4000e622c21fd68
SHA512 8d387f5cd6cd6d8ee49843b8eb259a6fca9e58c7fe2e8a2da677d0debcdb7e671e1e1a49a4867fbb33c912c441656be923fbdd007a027165554261c9e2462986
SSDEEP 6144:nflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:nflfAsiVGjSGecvX
TLSH
T1A9747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4344	kecwupmhfzxrpjhc.exe
4776	kecwupmhfzxrpjhc.sys
3876	CreateProcess.exe
5724	mhecwupjhf.exe
5080	CreateProcess.exe
5192	CreateProcess.exe
3392	i_mhecwupjhf.exe
1664	urmkecwuom.sys
928	CreateProcess.exe
4768	ezwuomgecw.exe
5196	CreateProcess.exe
2808	CreateProcess.exe
6056	i_ezwuomgecw.exe
800	zwrojhbztr.sys
5952	CreateProcess.exe
2508	uomgeywuom.exe
3064	CreateProcess.exe
4948	CreateProcess.exe
4384	i_uomgeywuom.exe
4644	gbytromgeb.sys
5624	CreateProcess.exe
6048	gbywqoigey.exe
244	CreateProcess.exe
3868	CreateProcess.exe
3032	i_gbywqoigey.exe
5340	oigaytqljg.sys
2540	CreateProcess.exe
4580	jdbvtnigdy.exe
5928	CreateProcess.exe
1908	CreateProcess.exe
4592	i_jdbvtnigdy.exe
5444	ligdbvtnlx.sys
5612	CreateProcess.exe
4264	xvtnlfdyvq.exe
5512	CreateProcess.exe
4976	CreateProcess.exe
4104	i_xvtnlfdyvq.exe
1640	aysqkicavs.sys
2124	CreateProcess.exe
2768	ysqkicankf.exe
3908	CreateProcess.exe
4320	CreateProcess.exe
2964	i_ysqkicankf.exe
5580	mkifdxvsnk.sys
1768	CreateProcess.exe
3008	spnhfcxusp.exe
2780	CreateProcess.exe
2132	CreateProcess.exe
1004	i_spnhfcxusp.exe
4524	xrpkhczusm.sys
4592	CreateProcess.exe
5944	pkhczusmke.exe
5064	CreateProcess.exe
564	CreateProcess.exe
2720	i_pkhczusmke.exe
3328	hczusmkeur.sys
2816	CreateProcess.exe
3980	rmjhbzxrpj.exe
6080	CreateProcess.exe
2000	CreateProcess.exe
1664	i_rmjhbzxrpj.exe
5276	trmjecwuom.sys
4804	CreateProcess.exe
5812	omgezwjhbz.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_1191740762\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_635110220\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_1768704852\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_1191740762\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_635110220\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_1745256005\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_1745256005\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_1745256005\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_1745256005\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwuomgecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgeywuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlgdyvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpkeca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhecwupjhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbywqoigey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywtrojge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdaysqnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmcwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkicankf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmjhfcwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecwupmhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwuomgecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjhbzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlgdyvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaysqcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkifdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkifdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhecwupjhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnhfcxusp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjhbzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgezwjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywtrojge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpkeca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtnigdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkicankf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezwjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmcwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnhfcxusp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdaysqnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmjhfcwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgeywuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbywqoigey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtnigdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaysqcaus.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1460	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2116	ipconfig.exe
2036	ipconfig.exe
1864	ipconfig.exe
5392	ipconfig.exe
1824	ipconfig.exe
5796	ipconfig.exe
3452	ipconfig.exe
4588	ipconfig.exe
2632	ipconfig.exe
708	ipconfig.exe
1796	ipconfig.exe
5000	ipconfig.exe
4264	ipconfig.exe
2644	ipconfig.exe
3864	ipconfig.exe
3784	ipconfig.exe
2936	ipconfig.exe
1992	ipconfig.exe
3696	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288443029095306"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{172BC6D6-8906-480E-8E96-104B646F4D41}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4344	kecwupmhfzxrpjhc.exe
4344	kecwupmhfzxrpjhc.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4344	kecwupmhfzxrpjhc.exe
4344	kecwupmhfzxrpjhc.exe
4344	kecwupmhfzxrpjhc.exe
4344	kecwupmhfzxrpjhc.exe
4344	kecwupmhfzxrpjhc.exe
4344	kecwupmhfzxrpjhc.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3392	i_mhecwupjhf.exe
Token: SeDebugPrivilege	6056	i_ezwuomgecw.exe
Token: SeDebugPrivilege	4384	i_uomgeywuom.exe
Token: SeDebugPrivilege	3032	i_gbywqoigey.exe
Token: SeDebugPrivilege	4592	i_jdbvtnigdy.exe
Token: SeDebugPrivilege	4104	i_xvtnlfdyvq.exe
Token: SeDebugPrivilege	2964	i_ysqkicankf.exe
Token: SeDebugPrivilege	1004	i_spnhfcxusp.exe
Token: SeDebugPrivilege	2720	i_pkhczusmke.exe
Token: SeDebugPrivilege	1664	i_rmjhbzxrpj.exe
Token: SeDebugPrivilege	4204	i_omgezwjhbz.exe
Token: SeDebugPrivilege	5380	i_geywtrojge.exe
Token: SeDebugPrivilege	1664	i_vtnlgdyvto.exe
Token: SeDebugPrivilege	5444	i_fdaysqnlfd.exe
Token: SeDebugPrivilege	5580	i_ifaysqcaus.exe
Token: SeDebugPrivilege	4148	i_spkifdxvpn.exe
Token: SeDebugPrivilege	2752	i_hfzxrpkeca.exe
Token: SeDebugPrivilege	2224	i_zurmjhfcwu.exe
Token: SeDebugPrivilege	1204	i_zurmcwuomg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4168	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 4344	2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 2388 wrote to memory of 2856	2388	2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 2856 wrote to memory of 4168	2856	iexplore.exe	91
PID 4168 wrote to memory of 3104	4168	msedge.exe	92
PID 4168 wrote to memory of 2488	4168	msedge.exe	93
PID 4168 wrote to memory of 1460	4168	msedge.exe	95
PID 4168 wrote to memory of 2488	4168	msedge.exe	93
PID 4168 wrote to memory of 2488	4168	msedge.exe	93
PID 4168 wrote to memory of 6068	4168	msedge.exe	96
PID 4168 wrote to memory of 6068	4168	msedge.exe	96
PID 4168 wrote to memory of 4320	4168	msedge.exe	97
PID 4168 wrote to memory of 5140	4168	msedge.exe	98
PID 4168 wrote to memory of 4320	4168	msedge.exe	97
PID 4168 wrote to memory of 4320	4168	msedge.exe	97
PID 4168 wrote to memory of 5140	4168	msedge.exe	98
PID 4168 wrote to memory of 5140	4168	msedge.exe	98
PID 4168 wrote to memory of 4596	4168	msedge.exe	99
PID 4168 wrote to memory of 4596	4168	msedge.exe	99
PID 4168 wrote to memory of 4596	4168	msedge.exe	99
PID 4168 wrote to memory of 1456	4168	msedge.exe	100
PID 4168 wrote to memory of 1456	4168	msedge.exe	100
PID 4168 wrote to memory of 1456	4168	msedge.exe	100
PID 4344 wrote to memory of 3876	4344	kecwupmhfzxrpjhc.exe	104
PID 4168 wrote to memory of 1512	4168	msedge.exe	107
PID 4168 wrote to memory of 1512	4168	msedge.exe	107
PID 4168 wrote to memory of 760	4168	msedge.exe	108
PID 4168 wrote to memory of 760	4168	msedge.exe	108
PID 5724 wrote to memory of 5080	5724	mhecwupjhf.exe	109
PID 4168 wrote to memory of 3500	4168	msedge.exe	113
PID 4168 wrote to memory of 2632	4168	msedge.exe	114
PID 4168 wrote to memory of 2632	4168	msedge.exe	114
PID 4168 wrote to memory of 1484	4168	msedge.exe	117
PID 4168 wrote to memory of 1484	4168	msedge.exe	117
PID 4168 wrote to memory of 708	4168	msedge.exe	118
PID 4168 wrote to memory of 708	4168	msedge.exe	118
PID 4344 wrote to memory of 5192	4344	kecwupmhfzxrpjhc.exe	119
PID 4344 wrote to memory of 928	4344	kecwupmhfzxrpjhc.exe	123
PID 4768 wrote to memory of 5196	4768	ezwuomgecw.exe	125
PID 4344 wrote to memory of 2808	4344	kecwupmhfzxrpjhc.exe	128
PID 4344 wrote to memory of 5952	4344	kecwupmhfzxrpjhc.exe	132
PID 2508 wrote to memory of 3064	2508	uomgeywuom.exe	134
PID 4344 wrote to memory of 4948	4344	kecwupmhfzxrpjhc.exe	137
PID 4344 wrote to memory of 5624	4344	kecwupmhfzxrpjhc.exe	142
PID 6048 wrote to memory of 244	6048	gbywqoigey.exe	144
PID 4344 wrote to memory of 3868	4344	kecwupmhfzxrpjhc.exe	147
PID 4168 wrote to memory of 5908	4168	msedge.exe	149
PID 4168 wrote to memory of 2132	4168	msedge.exe	150
PID 4168 wrote to memory of 3408	4168	msedge.exe	151
PID 4344 wrote to memory of 2540	4344	kecwupmhfzxrpjhc.exe	154
PID 4580 wrote to memory of 5928	4580	jdbvtnigdy.exe	156
PID 4344 wrote to memory of 1908	4344	kecwupmhfzxrpjhc.exe	159
PID 4344 wrote to memory of 5612	4344	kecwupmhfzxrpjhc.exe	163
PID 4264 wrote to memory of 5512	4264	xvtnlfdyvq.exe	165
PID 4344 wrote to memory of 4976	4344	kecwupmhfzxrpjhc.exe	168
PID 4344 wrote to memory of 2124	4344	kecwupmhfzxrpjhc.exe	172
PID 2768 wrote to memory of 3908	2768	ysqkicankf.exe	174
PID 4344 wrote to memory of 4320	4344	kecwupmhfzxrpjhc.exe	177
PID 4344 wrote to memory of 1768	4344	kecwupmhfzxrpjhc.exe	181
PID 3008 wrote to memory of 2780	3008	spnhfcxusp.exe	183
PID 4344 wrote to memory of 2132	4344	kecwupmhfzxrpjhc.exe	186
PID 4168 wrote to memory of 4228	4168	msedge.exe	188
PID 4168 wrote to memory of 4228	4168	msedge.exe	188
PID 4344 wrote to memory of 4592	4344	kecwupmhfzxrpjhc.exe	194
PID 5944 wrote to memory of 5064	5944	pkhczusmke.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_b9a5020ac5532d8571e0feae8e8d1fe0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Temp\kecwupmhfzxrpjhc.exe
  C:\Temp\kecwupmhfzxrpjhc.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhecwupjhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3876
  - - C:\Temp\mhecwupjhf.exe
      C:\Temp\mhecwupjhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5724
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5080
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhecwupjhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5192
  - - C:\Temp\i_mhecwupjhf.exe
      C:\Temp\i_mhecwupjhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezwuomgecw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:928
  - - C:\Temp\ezwuomgecw.exe
      C:\Temp\ezwuomgecw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4768
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5196
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezwuomgecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2808
  - - C:\Temp\i_ezwuomgecw.exe
      C:\Temp\i_ezwuomgecw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomgeywuom.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5952
  - - C:\Temp\uomgeywuom.exe
      C:\Temp\uomgeywuom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2508
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3064
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomgeywuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4948
  - - C:\Temp\i_uomgeywuom.exe
      C:\Temp\i_uomgeywuom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbywqoigey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5624
  - - C:\Temp\gbywqoigey.exe
      C:\Temp\gbywqoigey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6048
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:244
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gbywqoigey.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3868
  - - C:\Temp\i_gbywqoigey.exe
      C:\Temp\i_gbywqoigey.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbvtnigdy.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2540
  - - C:\Temp\jdbvtnigdy.exe
      C:\Temp\jdbvtnigdy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4580
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5928
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbvtnigdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1908
  - - C:\Temp\i_jdbvtnigdy.exe
      C:\Temp\i_jdbvtnigdy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvtnlfdyvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5612
  - - C:\Temp\xvtnlfdyvq.exe
      C:\Temp\xvtnlfdyvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4264
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5512
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvtnlfdyvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4976
  - - C:\Temp\i_xvtnlfdyvq.exe
      C:\Temp\i_xvtnlfdyvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqkicankf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2124
  - - C:\Temp\ysqkicankf.exe
      C:\Temp\ysqkicankf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2768
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3908
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqkicankf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4320
  - - C:\Temp\i_ysqkicankf.exe
      C:\Temp\i_ysqkicankf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spnhfcxusp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1768
  - - C:\Temp\spnhfcxusp.exe
      C:\Temp\spnhfcxusp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3008
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2780
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spnhfcxusp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2132
  - - C:\Temp\i_spnhfcxusp.exe
      C:\Temp\i_spnhfcxusp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pkhczusmke.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4592
  - - C:\Temp\pkhczusmke.exe
      C:\Temp\pkhczusmke.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5944
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5064
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pkhczusmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:564
  - - C:\Temp\i_pkhczusmke.exe
      C:\Temp\i_pkhczusmke.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmjhbzxrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2816
  - - C:\Temp\rmjhbzxrpj.exe
      C:\Temp\rmjhbzxrpj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3980
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6080
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmjhbzxrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2000
  - - C:\Temp\i_rmjhbzxrpj.exe
      C:\Temp\i_rmjhbzxrpj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgezwjhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4804
  - - C:\Temp\omgezwjhbz.exe
      C:\Temp\omgezwjhbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5812
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgezwjhbz.exe ups_ins
    3⤵
    PID:5732
  - - C:\Temp\i_omgezwjhbz.exe
      C:\Temp\i_omgezwjhbz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywtrojge.exe ups_run
    3⤵
    PID:4588
  - - C:\Temp\geywtrojge.exe
      C:\Temp\geywtrojge.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4956
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3100
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywtrojge.exe ups_ins
    3⤵
    PID:4352
  - - C:\Temp\i_geywtrojge.exe
      C:\Temp\i_geywtrojge.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlgdyvto.exe ups_run
    3⤵
    PID:3044
  - - C:\Temp\vtnlgdyvto.exe
      C:\Temp\vtnlgdyvto.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3932
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2836
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlgdyvto.exe ups_ins
    3⤵
    PID:2924
  - - C:\Temp\i_vtnlgdyvto.exe
      C:\Temp\i_vtnlgdyvto.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdaysqnlfd.exe ups_run
    3⤵
    PID:4760
  - - C:\Temp\fdaysqnlfd.exe
      C:\Temp\fdaysqnlfd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4336
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdaysqnlfd.exe ups_ins
    3⤵
    PID:5772
  - - C:\Temp\i_fdaysqnlfd.exe
      C:\Temp\i_fdaysqnlfd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifaysqcaus.exe ups_run
    3⤵
    PID:1988
  - - C:\Temp\ifaysqcaus.exe
      C:\Temp\ifaysqcaus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1484
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1320
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifaysqcaus.exe ups_ins
    3⤵
    PID:2860
  - - C:\Temp\i_ifaysqcaus.exe
      C:\Temp\i_ifaysqcaus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkifdxvpn.exe ups_run
    3⤵
    PID:5568
  - - C:\Temp\spkifdxvpn.exe
      C:\Temp\spkifdxvpn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2304
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2112
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkifdxvpn.exe ups_ins
    3⤵
    PID:3152
  - - C:\Temp\i_spkifdxvpn.exe
      C:\Temp\i_spkifdxvpn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzxrpkeca.exe ups_run
    3⤵
    PID:3648
  - - C:\Temp\hfzxrpkeca.exe
      C:\Temp\hfzxrpkeca.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1220
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5864
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfzxrpkeca.exe ups_ins
    3⤵
    PID:4120
  - - C:\Temp\i_hfzxrpkeca.exe
      C:\Temp\i_hfzxrpkeca.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zurmjhfcwu.exe ups_run
    3⤵
    PID:3328
  - - C:\Temp\zurmjhfcwu.exe
      C:\Temp\zurmjhfcwu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4408
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5288
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zurmjhfcwu.exe ups_ins
    3⤵
    PID:5588
  - - C:\Temp\i_zurmjhfcwu.exe
      C:\Temp\i_zurmjhfcwu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2224
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zurmcwuomg.exe ups_run
    3⤵
    PID:4928
  - - C:\Temp\zurmcwuomg.exe
      C:\Temp\zurmcwuomg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5084
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4740
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zurmcwuomg.exe ups_ins
    3⤵
    PID:4520
  - - C:\Temp\i_zurmcwuomg.exe
      C:\Temp\i_zurmcwuomg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1204
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff84354c188,0x7ff84354c194,0x7ff84354c1a0
      4⤵
      PID:3104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1916,i,14215534036939855091,8190576284179120031,262144 --field-trial-handle=2512,i,16043098397087082842,2174701473862617,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:2
      4⤵
      PID:2488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,12074583050890607089,12966240653942275755,524288 --field-trial-handle=2512,i,16043098397087082842,2174701473862617,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:11
      4⤵
      System Time Discovery
      PID:1460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2688,i,16302042922407058000,3207343651563823952,524288 --field-trial-handle=2512,i,16043098397087082842,2174701473862617,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:13
      4⤵
      PID:6068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,6184332996055447088,15655243702665625327,2097152 --field-trial-handle=2512,i,16043098397087082842,2174701473862617,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,7295466076195876444,17259155170816727303,2097152 --field-trial-handle=2512,i,16043098397087082842,2174701473862617,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
      4⤵
      PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,16905783858247722755,9561835756973147287,2097152 --field-trial-handle=2512,i,16043098397087082842,2174701473862617,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
      4⤵
      PID:4596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,10453598509205420454,11712100528327915827,2097152 --field-trial-handle=2512,i,16043098397087082842,2174701473862617,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:9
      4⤵
      PID:1456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,5332238972221099274,3353411522612973618,524288 --field-trial-handle=2512,i,16043098397087082842,2174701473862617,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
      4⤵
      PID:1512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,10008064743364454980,11815210787165376429,524288 --field-trial-handle=2512,i,16043098397087082842,2174701473862617,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
      4⤵
      PID:760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,11586155393049300450,10390858585175595022,524288 --field-trial-handle=2512,i,16043098397087082842,2174701473862617,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
      4⤵
      PID:3044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,11586155393049300450,10390858585175595022,524288 --field-trial-handle=2512,i,16043098397087082842,2174701473862617,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
      4⤵
      PID:3500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,5961290803447436284,16732466823551802774,524288 --field-trial-handle=2512,i,16043098397087082842,2174701473862617,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
      4⤵
      PID:2632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,13850173757877464305,13924833606100407610,524288 --field-trial-handle=2512,i,16043098397087082842,2174701473862617,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
      4⤵
      PID:1484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,6679703569515972706,11629700385142454647,524288 --field-trial-handle=2512,i,16043098397087082842,2174701473862617,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
      4⤵
      PID:708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1424,i,14306542665895565097,6120153565359123738,524288 --field-trial-handle=2512,i,16043098397087082842,2174701473862617,262144 --variations-seed-version --mojo-platform-channel-handle=1384 /prefetch:14
      4⤵
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1432,i,9360362533057152189,4668182989569503344,524288 --field-trial-handle=2512,i,16043098397087082842,2174701473862617,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:14
      4⤵
      PID:2132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1440,i,17459791202433125277,15525620079907707185,524288 --field-trial-handle=2512,i,16043098397087082842,2174701473862617,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
      4⤵
      PID:3408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,14642498062839991299,4539435425102222659,524288 --field-trial-handle=2512,i,16043098397087082842,2174701473862617,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
      4⤵
      PID:4228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,17476039546155607668,7934691740241752647,524288 --field-trial-handle=2512,i,16043098397087082842,2174701473862617,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
      4⤵
      PID:2952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1440,i,6358834920342603744,10658748721770441285,524288 --field-trial-handle=2512,i,16043098397087082842,2174701473862617,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:14
      4⤵
      PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,10793292170518056932,12453058881200669309,524288 --field-trial-handle=2512,i,16043098397087082842,2174701473862617,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:14
      4⤵
      PID:4648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4240,i,7901820962950236785,2585397772433050151,262144 --field-trial-handle=2512,i,16043098397087082842,2174701473862617,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:10
      4⤵
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,14906099311492107307,14462690841251750148,524288 --field-trial-handle=2512,i,16043098397087082842,2174701473862617,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
      4⤵
      PID:5752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3424

C:\Temp\kecwupmhfzxrpjhc.sys
C:\Temp\kecwupmhfzxrpjhc.sys
1⤵
- Executes dropped EXE
PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1288

C:\Temp\urmkecwuom.sys
C:\Temp\urmkecwuom.sys
1⤵
- Executes dropped EXE
PID:1664

C:\Temp\zwrojhbztr.sys
C:\Temp\zwrojhbztr.sys
1⤵
- Executes dropped EXE
PID:800

C:\Temp\gbytromgeb.sys
C:\Temp\gbytromgeb.sys
1⤵
- Executes dropped EXE
PID:4644

C:\Temp\oigaytqljg.sys
C:\Temp\oigaytqljg.sys
1⤵
- Executes dropped EXE
PID:5340

C:\Temp\ligdbvtnlx.sys
C:\Temp\ligdbvtnlx.sys
1⤵
- Executes dropped EXE
PID:5444

C:\Temp\aysqkicavs.sys
C:\Temp\aysqkicavs.sys
1⤵
- Executes dropped EXE
PID:1640

C:\Temp\mkifdxvsnk.sys
C:\Temp\mkifdxvsnk.sys
1⤵
- Executes dropped EXE
PID:5580

C:\Temp\xrpkhczusm.sys
C:\Temp\xrpkhczusm.sys
1⤵
- Executes dropped EXE
PID:4524

C:\Temp\hczusmkeur.sys
C:\Temp\hczusmkeur.sys
1⤵
- Executes dropped EXE
PID:3328

C:\Temp\trmjecwuom.sys
C:\Temp\trmjecwuom.sys
1⤵
- Executes dropped EXE
PID:5276

C:\Temp\jheywrojgb.sys
C:\Temp\jheywrojgb.sys
1⤵
PID:5760

C:\Temp\geywqoigay.sys
C:\Temp\geywqoigay.sys
1⤵
PID:5856

C:\Temp\wqoigbqkid.sys
C:\Temp\wqoigbqkid.sys
1⤵
PID:6132

C:\Temp\nligaysqli.sys
C:\Temp\nligaysqli.sys
1⤵
PID:2324

C:\Temp\axsqkifaxs.sys
C:\Temp\axsqkifaxs.sys
1⤵
PID:3312

C:\Temp\spkicausmk.sys
C:\Temp\spkicausmk.sys
1⤵
PID:1836

C:\Temp\kecxuhfzxr.sys
C:\Temp\kecxuhfzxr.sys
1⤵
PID:2472

C:\Temp\czurpjhecw.sys
C:\Temp\czurpjhecw.sys
1⤵
PID:4784

C:\Temp\omgezwrojg.sys
C:\Temp\omgezwrojg.sys
1⤵
PID:4600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ezwuomgecw.exe

Path C:\Temp\ezwuomgecw.exe
Size 361KB
SHA256 c361a4bfb2fd0a366278f0c9d6ef5c16ddc604d7feb27d68fa4ffb5f2853d12e
MD5 03736db1c1f079828265a7f4811780f6
SHA1 a489493a22020226cffa6ec67e9c727286414e07
SHA512 62d1a1af3ea18241d7ed3fff3157f73cdb8c6b03cf8bb52f9892cc3af0902d9e42c85c2672de495540910d92e31535b7e8c786cc8425d15546fa56f6ac06d107
SSDEEP 6144:JflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:JflfAsiVGjSGecvX
TLSH
T1C7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytromgeb.sys

Path C:\Temp\gbytromgeb.sys
Size 293KB
SHA256 ac92099bf4e2792212bb64891ad93ca80bb19de27ea85ef8ddca299d2724a0c4
MD5 0932d039c0d453b9ae645995d58f7866
SHA1 66493e9d631b468f3744fa3e4a9327e1e0bc1a42
SHA512 213124f5efd1452bede6973f1ced3f114cb86232d6c74c6c9cf94dd33a9a4cb4510b4e7d213d49a7c821b25e2ea594a6a084caaee752680452b6a1d011645f02
SSDEEP 3072:8tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:8IJjiJcbI03GBc3ucY5DCSj
TLSH
T1C9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbywqoigey.exe

Path C:\Temp\gbywqoigey.exe
Size 361KB
SHA256 0fc1224d4e37f1bcafec9db6c18b4a0fbdaffe300194fc272054d2beaf39578b
MD5 9ea0a67b3a12cb3964e3f585544efdd4
SHA1 3039b1da8c2f5163adb14535f99fac0f9443d40a
SHA512 5623cb5d464a2eaa63b3d8741907b14a6d1b099a032fd171ab22733e4fe7e5865c074f7892528820877fba87f0422e9fa5d29d555704fadbd99634bfe9d56894
SSDEEP 6144:MflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:MflfAsiVGjSGecvX
TLSH
T110747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ezwuomgecw.exe

Path C:\Temp\i_ezwuomgecw.exe
Size 361KB
SHA256 af48a502a60efb73cc1e54c61dadef95518e45ec36cfdc30d6aab4b02618db9c
MD5 6b6db323913a769ce646154b5dc14ff2
SHA1 2e451657ad28e988532e60d6e2cebe62cab99d64
SHA512 4feb61d32b591f0aa55778075333c40f0ea474e54ff66b2d31e9f25e94495f8430cf44845b526fa596cbf747660f1fe7de63169a29d88f1461836ffd8f68c4f6
SSDEEP 6144:jflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:jflfAsiVGjSGecvX
TLSH
T171747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbywqoigey.exe

Path C:\Temp\i_gbywqoigey.exe
Size 361KB
SHA256 09f0c3f3dd78de9fd25466036324e9dc67142fecb60797e3c5eec2293e3834b5
MD5 82e27219415946299edeca90211fa73a
SHA1 3f6e5e4bdec1a225e6ac8a3a4f0243c8ce935a96
SHA512 e2e48f93ac9740e431b5eae4f52a8f893977f344ab524ed8698997b8498abe5c0027deeeb451b7f2a0627bf2396d144b1a7948ddc1a4b46c991b9cf89692054c
SSDEEP 6144:tflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:tflfAsiVGjSGecvX
TLSH
T1CA747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jdbvtnigdy.exe

Path C:\Temp\i_jdbvtnigdy.exe
Size 361KB
SHA256 ec5dfb6060a473176d5c93a6ceed59817aeddac45e3b6d25afb2c7c57b3fc918
MD5 9c9df2444e601766706d3061e7081387
SHA1 c8b0ba1547ae9639f71ef00eac3e84ee90df4939
SHA512 de1e8fd6918a8b4fcb45abd6df00c3747ebd006c39136741e30047d5e959560b9e1ed86aeac6f1747eeb41bc21063bddae716c23afc2ad2c25d3e23216d80008
SSDEEP 6144:rflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:rflfAsiVGjSGecvX
TLSH
T122747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mhecwupjhf.exe

Path C:\Temp\i_mhecwupjhf.exe
Size 361KB
SHA256 b18bfbd7f5751d8e596295933d28c5979047ca62755f3fef434b7b1073ae5a6e
MD5 cb4cf2881bda9e83344217de8c836629
SHA1 84198094d150fb9e0baf9b9faf564aa5cfa42bb2
SHA512 b99401dc885433b51e73e92a353924966ee4d5d2f34080aa13ebb24ad9c521da7e0385e523d33e21f185787e68caf6e03c0d099195d38f4260773186e22ee951
SSDEEP 6144:mflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:mflfAsiVGjSGecvX
TLSH
T10E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uomgeywuom.exe

Path C:\Temp\i_uomgeywuom.exe
Size 361KB
SHA256 60afad106550d12610d5b4f39eee5fde61720f61258068789843ebc5838da4c2
MD5 991ac0efae39eb910e9b8d652d9e1bff
SHA1 8fa88aad2d18bc758267acc293e4a3882e991d00
SHA512 e300d78a6ab8a9140212b78467069ecadfff6bdcfa0f7d751ef94b0b285414e235bc8965908ad94b7d2f6e036c2384fa11a76ed0d74708dca086379c39228b56
SSDEEP 6144:HflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:HflfAsiVGjSGecvX
TLSH
T173747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbvtnigdy.exe

Path C:\Temp\jdbvtnigdy.exe
Size 361KB
SHA256 26c91d590c94295331d62c99e6268bca181f312da84cb29123fee0c35583b4c1
MD5 dc022faa1f7ae157aedc24d955314f45
SHA1 f3c72564ce98fc8c7865943b2e6de16600b5909d
SHA512 86eee7ec0c57a35734872901ad66e5fb132f007277b6e0bfd5e382c9ff7df2091971c476c52f57d28767f75c50128253130c3daa2a66e6269e4fc494e7720021
SSDEEP 6144:IflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:IflfAsiVGjSGecvX
TLSH
T18E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwupmhfzxrpjhc.exe

Path C:\Temp\kecwupmhfzxrpjhc.exe
Size 361KB
SHA256 26d23a4fcab16fa48cd786adf11503a3548b63aa244726afd69e28400ac8e257
MD5 4abeeadd31e11fcd6900a73c2943cb42
SHA1 4855726792c3e7dd15ff37ef60fac978ec6362cb
SHA512 dc5bffe34674bd814eba26e86f93369fd6e89da759732c1c248d3defc19626ce7300a7588645dce28a4964574b8daf229ac54bc88b158528c3cf4fd99273c640
SSDEEP 6144:7flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:7flfAsiVGjSGecvX
TLSH
T1DC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwupmhfzxrpjhc.sys

Path C:\Temp\kecwupmhfzxrpjhc.sys
Size 293KB
SHA256 79f076aa1103b9107495b543a08d1243d017a84130d02b87592d9b607863a71c
MD5 faab1e9afa9b0d2418d448f5e69526f3
SHA1 421cae1fdb67be092d022d450ca2a3bfd2dd0048
SHA512 0de44c67890923f789a78e5168aae9770194a4194208a25ecc57a3163d04ae50e10fa5630c8a4a24c86e1e39a6065257fa5783db1aeb69ebe11188fef985de82
SSDEEP 3072:vtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:vIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ligdbvtnlx.sys

Path C:\Temp\ligdbvtnlx.sys
Size 293KB
SHA256 f6a70fecdb6af8d7c0c5fe974fabbf0f491129800ce17be4692c3712e8bb94a9
MD5 613224791593aa933dc17819f58c7ec7
SHA1 9009c5441f9dd8911089177a36d7896323a337c4
SHA512 49c27cc0475cea584e7eb1073593b48bc3d718bdbd2d2259936e3eae26f065e1d80af0330ddd33646295ca7e0900518a93b6dc36e82304c5b92166136b42a899
SSDEEP 3072:NtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:NIJjiJcbI03GBc3ucY5DCSj
TLSH
T139545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhecwupjhf.exe

Path C:\Temp\mhecwupjhf.exe
Size 361KB
SHA256 d50d3b1f0d5de8f6e419fa48ec157663c0a87273e57ce294f7aef3f874626f9a
MD5 51ceb983698b9c4eac315c7369e5a8bf
SHA1 535b114d898c9398ee7bb6b0253229cfde609f76
SHA512 a1e7e79f474497a94a2071213752d2d812f16d44859ddf20289c6e2bccf69c06fdf1b7bffd7d6b8bfd58c4ac3fa76cdadb003510b73cd91c72b49a75e91ba05c
SSDEEP 6144:eflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:eflfAsiVGjSGecvX
TLSH
T14B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigaytqljg.sys

Path C:\Temp\oigaytqljg.sys
Size 293KB
SHA256 4921b8b294bc1bac2f9354cca865d89506d02bd0907310597ba32e29b9694720
MD5 b4982e7507a041f6c0bb0483f476b3d5
SHA1 886469ad0c70c01e039df1f07f23c1a9935b5b16
SHA512 2d7ac8e09910a6d5f8716d7222b703fed1cd5f970dc996e9ee8ab5a151f7d8d1e40a0a038f53606348a44125eac746c4654ab5020bf5b13b066751fc2e0db625
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdI:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgeywuom.exe

Path C:\Temp\uomgeywuom.exe
Size 361KB
SHA256 e95c4266c27a635fa36a9ef3d5762717b7c479cf0fd88866d7aefc4d2525bc87
MD5 c31cfbb446cfc1e1814507140fbe95fb
SHA1 526e374927c490503194c21d6b99bcf9e69ac052
SHA512 2e84ab52aadf9951316624ba92e9db714c40dd18d6db44fb63752a1b8c2d9135e8271c4cb68a23491d1aa8d1a4233375069c57261ea0b2e552dd15623c8cc9b9
SSDEEP 6144:KflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:KflfAsiVGjSGecvX
TLSH
T1E5747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmkecwuom.sys

Path C:\Temp\urmkecwuom.sys
Size 293KB
SHA256 728305dbf84bc029b1705a1badec48e7fb368e3d920014f2d49888c4335af03a
MD5 f25360b33fd1a57e6e33d2e8330b5c4d
SHA1 5ee8a35011e5a9516897d34ce0ebe7bb07b8bd70
SHA512 fd76560ace1f135e4f89ff687accfea798f2ce87a8ebcc19089915deb2e0e92228be9444f5e609037c2d3961113d3cac91b4ea37e99c7b190a79d0b5ec3af62f
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T12F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvtnlfdyvq.exe

Path C:\Temp\xvtnlfdyvq.exe
Size 361KB
SHA256 4ca3a68ab40830fc1dd90339e98f6e23d0a874b55ea330393f7bf1b1f4a449bf
MD5 6bcdc7e215ff717f079879a9bd14afbb
SHA1 2733622c0117b1cbbc1b51ad3e9108d54991fe9f
SHA512 3efb374da88d52545f3140e1583d29c2c5c0d1c3377e52460cb8dc9c01120def1ef04ab300e8aeb744b0735d03ca2b5edede929e77c177e493755309cefbfec7
SSDEEP 6144:1flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:1flfAsiVGjSGecvX
TLSH
T128747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwrojhbztr.sys

Path C:\Temp\zwrojhbztr.sys
Size 293KB
SHA256 92d7b40cbe74e2e248291e007b2383502acabd7cf74c4db25e83ee09f40890a3
MD5 7d840727c29f31d29fad1143d5eb005e
SHA1 3f4519937b762c4e7bf3a4868d483a90317805e6
SHA512 de2502c925685b7e0ce6bf5f900e140bcf98522c9a88eb7c5c0aaa68d9634c75da182fe52d795a0d5d3d6e292acf0400212476e1e33fffc5fc7c3d6fadf42324
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T11B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6efd0591db2fbf5c000f2e42b225d483fe94c1e034f605f566106308461f5c99
MD5 358b9e6630f3ce4e3e8e2ecfbe02e165
SHA1 92045178b9669edac9a197cdc9f137cc11ad63bc
SHA512 441aa4ee9d0045d9d0abd3042cbdbb799677c9e9a1c4c4c25cf52921b4ed48c1db23e7c99562c9647f2b82f92c1d31376891f89fab4b5febc65c610f1a100ede
TLSH
T17D419392532417D1D7A14EB261E1B65832FCD4BD8607AEC97A002D7CAF05F385AD14A3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596289.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596289.TMP
Size 2KB
SHA256 298c5cd710ced0cf93d9b33cdfba3f88e616c7fe674547950949d394d7accdbe
MD5 c8fe03af181aaa2425bfc5e959b7cd17
SHA1 4a04b55c91c0ac273ed3e962fd75adf37d659930
SHA512 b6b0944e2f02f55ee944f73cf8f35c9f8cf1eb49df63e82433c0484ada55f6f460d24ca007243eb2796047cff42599278513b1a0021d2fe4d06c9ba804b44355
TLSH
T1B541A492532417D1D7A14EB365E1B65832FCD0BD8607AECA7A002D7CAF05F385BD1463
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 00ee777c8b6a4744d07ef8df517325027d03a59810a288fa8bc0548a2bb4a956
MD5 427d2a243481633f70f8824f4950a5bb
SHA1 33836b1ef9bed20f84a6cf58668568e2a879952c
SHA512 071791cfeed778d309adcfcdd176e66cd185c6a77b302d97cc5ab06204cd7593a8817b8dcf1a50c70e601a391ed9ff28043d0d632f15e579bd5af5cb30f72c8f
TLSH
T11F51AFF3C7E8862D890156F0AB187E2BCE2D0954432C3D5AC9E4AF1BA7E2471D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 bc9cbff7e4cc2e79333f027867cfe198b849680304c3b771a521c855c8d87cc7
MD5 95cf58fc6762aeda38e55c97dd0efc9f
SHA1 5f4197e65ff31069416a703aa9906722a4c61799
SHA512 cccb1e2b1654c4b9a7bbb208554e2b289c44c7e85ed52edc456678c9a20dfe0338bd431f63c0f9d0c54cd13531fa58014a0db47dbc4266b0f4e49e1007698fd5
SSDEEP 192:sxRzRTCE/fUs3yTYDde5lSlzoD8p9p/g6+WNCsK/YCuuO8GAIgtJ:sxRzsE/fUs3yTYc5lkP/5c/I03
TLSH
T18A32B6166E28A93B9CC7D21DBB55BFA3D2F91133A5D01E48E7FC860C05EA6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2d295f7581f1e78d976cb9ea0dfe7da7fb17be8c3b49fd77494077383549da32
MD5 ffa10daa63e37cd706772e3e29cafa54
SHA1 76d7e72bc88afc001278f5f49f5eef472542e994
SHA512 5b18ba0b5593ad1ce3b93c024b9ae50110046782409d9657a8be60f7cb1cbbcf503c17e6505b4d4f763da608c48fdea873666be8bb8bea43693a613f472488d4
SSDEEP 192:sxR8RTCE/fUsIyTYdZr2en/zoD8p9p/g6+WNCsK/YCuuO8GAIgDSJ:sxR8sE/fUsIyTYTTnPP/5c/I0a
TLSH
T1B042B6166A28993B9CC7D20DBB55BF93D6F95033A1941E48E7FC871C05EA6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 74c67798b7c2dd02c3ef950c10ff9d3d552f2017204a8df3935c8dc155df1b70
MD5 89418e3e59f144636defa32a0c3bc918
SHA1 37766ba971fff9f318293a04e1d9da9734e7818c
SHA512 207aa1e89e49ac2edfb8ae2f0df6e5f8357ef335309e488cea15225bd8888147fa4ccd1a851f3493a32ef5143e9c89664d152d31481b51eb203b1f8198386a1d
SSDEEP 192:sxR8RTCE/fUsIyKYdZr2en/zoD8p9p/g6+WNCsK/YC5uO8GAIgDEJ:sxR8sE/fUsIyKYTTnPP/5c/x0k
TLSH
T1C542B5166938993B9CC7D20DBB55BF93D2F96033A1941E48E7FC8B1C15EA6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 604d24afdebac51611128ab530f2eac9969043ca12f410f4facdb22c271fe32a
MD5 a59ca5c449c7a9fd307ceb3ab1bb8757
SHA1 e4b8d746fb4d14e76cfb80047ed952c5aa079f24
SHA512 897f4ee7c5b5d113abc7952978afc1449e7584839fd4e2b4b182ba0f7f68e314a03c1f590541e2310f25d6dac6933939d3170c5f3d51b7738aef1f1d2cb6587f
SSDEEP 768:jC+vfN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OV830QqcZroZs:jC+vf7E7JQWgQ+f4+u1jab30VcSu
TLSH
T1C4D2EB7B640DCB7F4F804ADDEC197E9E6DA802CB9698CD5047FA841C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ae9ef45b66b1ebe9b542761dfa07433a48f7f64ea8f7ed82e9ea863a5fb2a0af
MD5 65b7979c13f15478e00a31855d6104fb
SHA1 fd0043fb9a761b2c0c9a4c72f772180cd90b5385
SHA512 446da97ef619be8708d78c23c3ed05d5d05515aea7982386eb6ad0ab2fa954882fece172c95445e5629719e26da5f871ca478962f755d5ca43a9cedf89f49b57
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHyX+SkE0SWcJhgCSK4Xg4ScCqRwSbHYp8O:CbEBVj5JAdSp9/EgTK7j6dJOHyX+SkEP
TLSH
T1FE913400313B02C0383DBA4CC1B89C6E86C574737416E56B7BA945AA0F67E479EFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59fdcf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59fdcf.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 270d80fce362f4be00c76745171a08602438727bea8e4e0c99c34acc36defd90
MD5 83f8e1269e2ce35c48e67dbc38483819
SHA1 6520c2d13767c6c3d040130ba1fb15f8c3864e30
SHA512 1b63a3c0e8478cde2969797948ac1b4e7f89e6a482721ac404977806168a90a5dfbeb9e439a4d6fe38696856f196cf2d598852d60a19ce705ce4af51a37c5de7
SSDEEP 768:Wrv+4UNbdM3p/4TSp8+p3bd66j+4BRv86aLIWWb9ML:Wbsb63is8+p3Z6n4ygb+L
TLSH
T1AC13BF72F869DD339CF2C604B2863B937FF8216395C00E94E9D96B4D45971AD270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 775fe00993b1eabecbd72e8518b74e19a11deaf37f90990543a472ef0365c46c
MD5 0ace1e7ecb2ab7eb10309a63c6e6a9cf
SHA1 813ff2e92f5329247a5b216e3bb2a51c1fd9d154
SHA512 3c29e07d4f55893dab970213766bc519c9086f1eb9a8a860b36ab2a56a1b98378e025f7ee0b6b3a6a18d49294e02395720c9a0f5ee99274102dcca8d072f0fd7
SSDEEP 768:Irv+4UNbdD3kcONp8+p3bd66j+4BRv86aLIiv2bwCl1:Ibsbp3CL8+p3Z6n4y10ww
TLSH
T10503BE73F9A899339CF6C644B2467A437FF851A396C10AC4D5CD2B4E419A19E230BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 0e6f5f1bba2ceb06c8e8d623fbf918b9f38b2c0048dadfefb2ff1742b7756920
MD5 9b8b300636bb1458b7199d547b3dab64
SHA1 324ceb3bde5ad5f790ea9501a79079df4df1ee58
SHA512 d01fbe0e9828708d5211497cb313707be913f7115b8e2e9c2007c1d7afecb932e6b3408f4b4aed504e2eb0609f676760630acf9e38ce9f92d06a2da1682db327
SSDEEP 768:hrv+4UNbdM3g/4TSp8+p3bd66j+4BRv86aLIWWb9ML:hbsb63ps8+p3Z6n4ygb+L
TLSH
T18B13BF32F869DE339CF2C604B2863B937FF8216395C00E94E9D96B4D45971AD270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 50KB
SHA256 09123b9b725e8674060a7f0ca4ea31b662dca6b5086956cb5ce59449b408b87f
MD5 380e35f5018713c7c5038c665531e628
SHA1 97f2ac2d2c4bfb68021925ab83c24277094e22d5
SHA512 9e4fbbf123755cc00a361785a56b0b81c6b93422522dda676a80d9028c94f9920cae30d9c7998865f9d798616333528e056b9446e6d097162f677f665af0e692
SSDEEP 768:iF0rv+4UNbdm3TwgGkt4p8+p3bd66j+4BRv86aLIWWb9ML:DbsbY3U8+p3Z6n4ygb+L
TLSH
T13E3328F294D78937D8AE8743637D2E42AEBCD16375844994F7C45E4CCC860BFD20A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

7af44879-7463-424e-852f-62fa5a354c77.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7af44879-7463-424e-852f-62fa5a354c77.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4168_1079354566\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 25f9b2f3bc788f574f5b07518f74b5488cf4519d3c156adb082b7f4c07f36f1d
MD5 63a612bacaad1261d8460b063af3a368
SHA1 5e6b8828d9882af6ec695bfaee3108beffd8f70d
SHA512 ec25c3861458e51321e6ab8c40be121f4839c3ff241cadd41d5213e2917385bb54029a1186d627821f9ab17b5b2b3448280670394023f19205700a313962a058
TLSH
T10471238356B9D9B3C1DA5BF002835248F1FB2278073370244755568AAB30A7A24B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/800-234-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1640-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1664-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1836-446-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2324-430-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2472-466-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3312-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3328-337-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4524-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4600-487-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4644-262-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4776-63-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4784-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5276-366-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5340-276-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5444-297-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5580-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5760-386-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5856-418-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6132-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download