systex | 2fe507689f1cb768ea6f0ddf5309c779bf11414d9f3f68e8facd66af7797c5f8

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260730-wp2hzaej5z
SHA256 2fe507689f1cb768ea6f0ddf5309c779bf11414d9f3f68e8facd66af7797c5f8
MD5 1e7d2a59d3cdc30990465ca399c06727
SHA1 9c7a1a55c398360517b30285048e9899812e712a
SHA512 f822c7e2ce70b60f0c5ab7dcf30c7fe257dcc54d96a9d9db698515e21013743101736ba2d0da0f8030eee826c22a6d965313635d5a1b305c525e1e6a503c7596
SSDEEP 6144:/flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:/flfAsiVGjSGecvX
TLSH
T173747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
6732	keczurpmhezwuspk.exe
1048	keczurpmhezwuspk.sys
1856	CreateProcess.exe
6460	zusmjeczur.exe
5784	CreateProcess.exe
5872	CreateProcess.exe
5224	i_zusmjeczur.exe
6180	zurmbwuomg.sys
6396	CreateProcess.exe
1780	pjhbzuomje.exe
7164	CreateProcess.exe
1384	CreateProcess.exe
1412	i_pjhbzuomje.exe
4336	mgecwuomge.sys
2784	CreateProcess.exe
2132	gerolgdbzt.exe
1556	CreateProcess.exe
5672	CreateProcess.exe
2224	i_gerolgdbzt.exe
5752	bywtoljdbz.sys
5768	CreateProcess.exe
6268	dbywqojgby.exe
6888	CreateProcess.exe
2580	CreateProcess.exe
5612	i_dbywqojgby.exe
4312	ligaytqljd.sys
5864	CreateProcess.exe
572	lidaywqoig.exe
4804	CreateProcess.exe
5096	CreateProcess.exe
4468	i_lidaywqoig.exe
1392	qljdbvtnla.sys
5548	CreateProcess.exe
576	icaysqnlfd.exe
904	CreateProcess.exe
7112	CreateProcess.exe
6428	i_icaysqnlfd.exe
6760	dxvqnifays.sys
3772	CreateProcess.exe
1056	ayspnlfdxn.exe
1068	CreateProcess.exe
2700	CreateProcess.exe
2376	i_ayspnlfdxn.exe
6212	axspnkfdxv.sys
2144	CreateProcess.exe
6100	ausmkhfdxv.exe
6656	CreateProcess.exe
3776	CreateProcess.exe
2904	i_ausmkhfdxv.exe
2624	aurpnhfzxr.sys
1696	CreateProcess.exe
2068	czusmkecwu.exe
2380	CreateProcess.exe
3416	CreateProcess.exe
6908	i_czusmkecwu.exe
2364	cwupmhfzxu.sys
6868	CreateProcess.exe
5708	omhecwurpj.exe
6840	CreateProcess.exe
1224	CreateProcess.exe
5332	i_omhecwurpj.exe
796	wuomkebwuo.sys
1512	CreateProcess.exe
3296	ztrmjebwuo.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3396_387999371\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3396_387999371\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3396_1481262115\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3396_1481262115\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhbzxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keczurpmhezwuspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zusmjeczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gerolgdbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igdyvqoifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusqkhfdau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gerolgdbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbywqojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidaywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ndxvsnkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusqkhfdau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkhfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkhfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czusmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrmjebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ndxvsnkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icaysqnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ayspnlfdxn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czusmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omhecwurpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaytqlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaytqlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omhezwrojz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icaysqnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbzuomje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbzuomje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidaywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbwtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igdyvqoifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zusmjeczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omhezwrojz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbywqojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omhecwurpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbwtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpkhfzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhbzxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ayspnlfdxn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrmjebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpkhfzur.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5496	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
460	ipconfig.exe
5628	ipconfig.exe
6776	ipconfig.exe
6348	ipconfig.exe
5636	ipconfig.exe
3676	ipconfig.exe
4156	ipconfig.exe
5700	ipconfig.exe
6944	ipconfig.exe
7156	ipconfig.exe
6228	ipconfig.exe
3112	ipconfig.exe
4988	ipconfig.exe
6624	ipconfig.exe
6840	ipconfig.exe
940	ipconfig.exe
4260	ipconfig.exe
4424	ipconfig.exe
6208	ipconfig.exe
5984	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299084099481198"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{107FF664-5450-42E5-A075-BFBD5C1B7726}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6732	keczurpmhezwuspk.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6732	keczurpmhezwuspk.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6732	keczurpmhezwuspk.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6732	keczurpmhezwuspk.exe
6732	keczurpmhezwuspk.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6732	keczurpmhezwuspk.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6732	keczurpmhezwuspk.exe
6732	keczurpmhezwuspk.exe
6732	keczurpmhezwuspk.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6732	keczurpmhezwuspk.exe
6732	keczurpmhezwuspk.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6732	keczurpmhezwuspk.exe
6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5224	i_zusmjeczur.exe
Token: SeDebugPrivilege	1412	i_pjhbzuomje.exe
Token: SeDebugPrivilege	2224	i_gerolgdbzt.exe
Token: SeDebugPrivilege	5612	i_dbywqojgby.exe
Token: SeDebugPrivilege	4468	i_lidaywqoig.exe
Token: SeDebugPrivilege	6428	i_icaysqnlfd.exe
Token: SeDebugPrivilege	2376	i_ayspnlfdxn.exe
Token: SeDebugPrivilege	2904	i_ausmkhfdxv.exe
Token: SeDebugPrivilege	6908	i_czusmkecwu.exe
Token: SeDebugPrivilege	5332	i_omhecwurpj.exe
Token: SeDebugPrivilege	6808	i_ztrmjebwuo.exe
Token: SeDebugPrivilege	1352	i_trljdbwtol.exe
Token: SeDebugPrivilege	5984	i_oigaytqlig.exe
Token: SeDebugPrivilege	5464	i_igdyvqoifd.exe
Token: SeDebugPrivilege	4740	i_ndxvsnkica.exe
Token: SeDebugPrivilege	7028	i_xusqkhfdau.exe
Token: SeDebugPrivilege	5352	i_zxrpkhfzur.exe
Token: SeDebugPrivilege	3148	i_xrpjhbzxup.exe
Token: SeDebugPrivilege	6884	i_omhezwrojz.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3396	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6132 wrote to memory of 6732	6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 6132 wrote to memory of 6380	6132	2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	91
PID 6380 wrote to memory of 3396	6380	iexplore.exe	92
PID 3396 wrote to memory of 4168	3396	msedge.exe	93
PID 3396 wrote to memory of 788	3396	msedge.exe	94
PID 3396 wrote to memory of 5496	3396	msedge.exe	95
PID 3396 wrote to memory of 788	3396	msedge.exe	94
PID 3396 wrote to memory of 788	3396	msedge.exe	94
PID 3396 wrote to memory of 6444	3396	msedge.exe	96
PID 3396 wrote to memory of 6444	3396	msedge.exe	96
PID 3396 wrote to memory of 908	3396	msedge.exe	99
PID 3396 wrote to memory of 5208	3396	msedge.exe	98
PID 3396 wrote to memory of 908	3396	msedge.exe	99
PID 3396 wrote to memory of 908	3396	msedge.exe	99
PID 3396 wrote to memory of 5208	3396	msedge.exe	98
PID 3396 wrote to memory of 5208	3396	msedge.exe	98
PID 6732 wrote to memory of 1856	6732	keczurpmhezwuspk.exe	102
PID 3396 wrote to memory of 568	3396	msedge.exe	104
PID 3396 wrote to memory of 3680	3396	msedge.exe	105
PID 3396 wrote to memory of 568	3396	msedge.exe	104
PID 3396 wrote to memory of 3680	3396	msedge.exe	105
PID 6460 wrote to memory of 5784	6460	zusmjeczur.exe	108
PID 3396 wrote to memory of 6560	3396	msedge.exe	110
PID 6732 wrote to memory of 5872	6732	keczurpmhezwuspk.exe	114
PID 6732 wrote to memory of 6396	6732	keczurpmhezwuspk.exe	118
PID 1780 wrote to memory of 7164	1780	pjhbzuomje.exe	120
PID 6732 wrote to memory of 1384	6732	keczurpmhezwuspk.exe	123
PID 6732 wrote to memory of 2784	6732	keczurpmhezwuspk.exe	127
PID 2132 wrote to memory of 1556	2132	gerolgdbzt.exe	129
PID 6732 wrote to memory of 5672	6732	keczurpmhezwuspk.exe	132
PID 6732 wrote to memory of 5768	6732	keczurpmhezwuspk.exe	136
PID 6268 wrote to memory of 6888	6268	dbywqojgby.exe	138
PID 6732 wrote to memory of 2580	6732	keczurpmhezwuspk.exe	142
PID 3396 wrote to memory of 6120	3396	msedge.exe	144
PID 3396 wrote to memory of 5364	3396	msedge.exe	145
PID 3396 wrote to memory of 5372	3396	msedge.exe	146
PID 6732 wrote to memory of 5864	6732	keczurpmhezwuspk.exe	149
PID 572 wrote to memory of 4804	572	lidaywqoig.exe	151
PID 6732 wrote to memory of 5096	6732	keczurpmhezwuspk.exe	154
PID 6732 wrote to memory of 5548	6732	keczurpmhezwuspk.exe	158
PID 576 wrote to memory of 904	576	icaysqnlfd.exe	160
PID 6732 wrote to memory of 7112	6732	keczurpmhezwuspk.exe	163
PID 6732 wrote to memory of 3772	6732	keczurpmhezwuspk.exe	167
PID 1056 wrote to memory of 1068	1056	ayspnlfdxn.exe	169
PID 6732 wrote to memory of 2700	6732	keczurpmhezwuspk.exe	172
PID 6732 wrote to memory of 2144	6732	keczurpmhezwuspk.exe	176
PID 6100 wrote to memory of 6656	6100	ausmkhfdxv.exe	178
PID 6732 wrote to memory of 3776	6732	keczurpmhezwuspk.exe	181
PID 3396 wrote to memory of 3740	3396	msedge.exe	183
PID 3396 wrote to memory of 3740	3396	msedge.exe	183
PID 6732 wrote to memory of 1696	6732	keczurpmhezwuspk.exe	188
PID 2068 wrote to memory of 2380	2068	czusmkecwu.exe	190
PID 6732 wrote to memory of 3416	6732	keczurpmhezwuspk.exe	193
PID 6732 wrote to memory of 6868	6732	keczurpmhezwuspk.exe	197
PID 5708 wrote to memory of 6840	5708	omhecwurpj.exe	199
PID 6732 wrote to memory of 1224	6732	keczurpmhezwuspk.exe	202
PID 6732 wrote to memory of 1512	6732	keczurpmhezwuspk.exe	206
PID 3296 wrote to memory of 6120	3296	ztrmjebwuo.exe	208
PID 6732 wrote to memory of 4312	6732	keczurpmhezwuspk.exe	211
PID 6732 wrote to memory of 3680	6732	keczurpmhezwuspk.exe	215
PID 7004 wrote to memory of 3640	7004	trljdbwtol.exe	217
PID 6732 wrote to memory of 5000	6732	keczurpmhezwuspk.exe	220
PID 6732 wrote to memory of 6156	6732	keczurpmhezwuspk.exe	224
PID 4496 wrote to memory of 4680	4496	oigaytqlig.exe	226

C:\Users\Admin\AppData\Local\Temp\2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_1e7d2a59d3cdc30990465ca399c06727_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6132
- C:\Temp\keczurpmhezwuspk.exe
  C:\Temp\keczurpmhezwuspk.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zusmjeczur.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1856
  - - C:\Temp\zusmjeczur.exe
      C:\Temp\zusmjeczur.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6460
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5784
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zusmjeczur.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5872
  - - C:\Temp\i_zusmjeczur.exe
      C:\Temp\i_zusmjeczur.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5224
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhbzuomje.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6396
  - - C:\Temp\pjhbzuomje.exe
      C:\Temp\pjhbzuomje.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1780
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:7164
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhbzuomje.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1384
  - - C:\Temp\i_pjhbzuomje.exe
      C:\Temp\i_pjhbzuomje.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gerolgdbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2784
  - - C:\Temp\gerolgdbzt.exe
      C:\Temp\gerolgdbzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2132
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1556
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gerolgdbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5672
  - - C:\Temp\i_gerolgdbzt.exe
      C:\Temp\i_gerolgdbzt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2224
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbywqojgby.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5768
  - - C:\Temp\dbywqojgby.exe
      C:\Temp\dbywqojgby.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6268
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbywqojgby.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2580
  - - C:\Temp\i_dbywqojgby.exe
      C:\Temp\i_dbywqojgby.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lidaywqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5864
  - - C:\Temp\lidaywqoig.exe
      C:\Temp\lidaywqoig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:572
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4804
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5636
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lidaywqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5096
  - - C:\Temp\i_lidaywqoig.exe
      C:\Temp\i_lidaywqoig.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icaysqnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5548
  - - C:\Temp\icaysqnlfd.exe
      C:\Temp\icaysqnlfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:576
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:904
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icaysqnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:7112
  - - C:\Temp\i_icaysqnlfd.exe
      C:\Temp\i_icaysqnlfd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ayspnlfdxn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3772
  - - C:\Temp\ayspnlfdxn.exe
      C:\Temp\ayspnlfdxn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1056
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ayspnlfdxn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2700
  - - C:\Temp\i_ayspnlfdxn.exe
      C:\Temp\i_ayspnlfdxn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ausmkhfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2144
  - - C:\Temp\ausmkhfdxv.exe
      C:\Temp\ausmkhfdxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6100
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6656
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ausmkhfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3776
  - - C:\Temp\i_ausmkhfdxv.exe
      C:\Temp\i_ausmkhfdxv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czusmkecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1696
  - - C:\Temp\czusmkecwu.exe
      C:\Temp\czusmkecwu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2068
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2380
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:7156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czusmkecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3416
  - - C:\Temp\i_czusmkecwu.exe
      C:\Temp\i_czusmkecwu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omhecwurpj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6868
  - - C:\Temp\omhecwurpj.exe
      C:\Temp\omhecwurpj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5708
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omhecwurpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1224
  - - C:\Temp\i_omhecwurpj.exe
      C:\Temp\i_omhecwurpj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrmjebwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1512
  - - C:\Temp\ztrmjebwuo.exe
      C:\Temp\ztrmjebwuo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3296
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6120
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrmjebwuo.exe ups_ins
    3⤵
    PID:4312
  - - C:\Temp\i_ztrmjebwuo.exe
      C:\Temp\i_ztrmjebwuo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljdbwtol.exe ups_run
    3⤵
    PID:3680
  - - C:\Temp\trljdbwtol.exe
      C:\Temp\trljdbwtol.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:7004
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3640
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljdbwtol.exe ups_ins
    3⤵
    PID:5000
  - - C:\Temp\i_trljdbwtol.exe
      C:\Temp\i_trljdbwtol.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigaytqlig.exe ups_run
    3⤵
    PID:6156
  - - C:\Temp\oigaytqlig.exe
      C:\Temp\oigaytqlig.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4496
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4680
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigaytqlig.exe ups_ins
    3⤵
    PID:912
  - - C:\Temp\i_oigaytqlig.exe
      C:\Temp\i_oigaytqlig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igdyvqoifd.exe ups_run
    3⤵
    PID:5100
  - - C:\Temp\igdyvqoifd.exe
      C:\Temp\igdyvqoifd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3732
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2112
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igdyvqoifd.exe ups_ins
    3⤵
    PID:4224
  - - C:\Temp\i_igdyvqoifd.exe
      C:\Temp\i_igdyvqoifd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ndxvsnkica.exe ups_run
    3⤵
    PID:6752
  - - C:\Temp\ndxvsnkica.exe
      C:\Temp\ndxvsnkica.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6504
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3672
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ndxvsnkica.exe ups_ins
    3⤵
    PID:3428
  - - C:\Temp\i_ndxvsnkica.exe
      C:\Temp\i_ndxvsnkica.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xusqkhfdau.exe ups_run
    3⤵
    PID:1928
  - - C:\Temp\xusqkhfdau.exe
      C:\Temp\xusqkhfdau.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3496
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:7156
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xusqkhfdau.exe ups_ins
    3⤵
    PID:6040
  - - C:\Temp\i_xusqkhfdau.exe
      C:\Temp\i_xusqkhfdau.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:7028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrpkhfzur.exe ups_run
    3⤵
    PID:6848
  - - C:\Temp\zxrpkhfzur.exe
      C:\Temp\zxrpkhfzur.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4656
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6552
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrpkhfzur.exe ups_ins
    3⤵
    PID:4428
  - - C:\Temp\i_zxrpkhfzur.exe
      C:\Temp\i_zxrpkhfzur.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpjhbzxup.exe ups_run
    3⤵
    PID:4644
  - - C:\Temp\xrpjhbzxup.exe
      C:\Temp\xrpjhbzxup.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2708
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6420
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpjhbzxup.exe ups_ins
    3⤵
    PID:504
  - - C:\Temp\i_xrpjhbzxup.exe
      C:\Temp\i_xrpjhbzxup.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omhezwrojz.exe ups_run
    3⤵
    PID:4100
  - - C:\Temp\omhezwrojz.exe
      C:\Temp\omhezwrojz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5300
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4528
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6348
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omhezwrojz.exe ups_ins
    3⤵
    PID:6312
  - - C:\Temp\i_omhezwrojz.exe
      C:\Temp\i_omhezwrojz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljebwuom.exe ups_run
    3⤵
    PID:1256
  - - C:\Temp\trljebwuom.exe
      C:\Temp\trljebwuom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2880
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6664
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5984
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:6380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ffc611dc188,0x7ffc611dc194,0x7ffc611dc1a0
      4⤵
      PID:4168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,10507945256256122668,2166749486753706588,262144 --field-trial-handle=2372,i,10518879051966557558,14313874543039887683,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
      4⤵
      PID:788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,17156549317012933504,13022033055071577407,524288 --field-trial-handle=2372,i,10518879051966557558,14313874543039887683,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:11
      4⤵
      System Time Discovery
      PID:5496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,16688727344012833423,312656644423729548,524288 --field-trial-handle=2372,i,10518879051966557558,14313874543039887683,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:13
      4⤵
      PID:6444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,17752976552059515462,9307146200216140005,2097152 --field-trial-handle=2372,i,10518879051966557558,14313874543039887683,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:5208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,16868802792197864256,7956034381679347902,2097152 --field-trial-handle=2372,i,10518879051966557558,14313874543039887683,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,13430927781959489784,13536672009270294349,524288 --field-trial-handle=2372,i,10518879051966557558,14313874543039887683,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
      4⤵
      PID:568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,7129019573430118146,4699540924906340455,524288 --field-trial-handle=2372,i,10518879051966557558,14313874543039887683,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
      4⤵
      PID:3680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,18225894158723734937,7314311006226381158,524288 --field-trial-handle=2372,i,10518879051966557558,14313874543039887683,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
      4⤵
      PID:6900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,18225894158723734937,7314311006226381158,524288 --field-trial-handle=2372,i,10518879051966557558,14313874543039887683,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
      4⤵
      PID:6560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,15944068616046509949,15769477479584249480,524288 --field-trial-handle=2372,i,10518879051966557558,14313874543039887683,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
      4⤵
      PID:6120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,14663843704292144634,4687218587213281371,524288 --field-trial-handle=2372,i,10518879051966557558,14313874543039887683,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
      4⤵
      PID:5364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,9270537845220594797,11266918351526475820,524288 --field-trial-handle=2372,i,10518879051966557558,14313874543039887683,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:5372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,16605663407786903612,12269373275149167763,524288 --field-trial-handle=2372,i,10518879051966557558,14313874543039887683,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:3740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,1071624182508801283,7403120359522973586,524288 --field-trial-handle=2372,i,10518879051966557558,14313874543039887683,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
      4⤵
      PID:52
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=924,i,7507268300029141783,17800952264576565682,262144 --field-trial-handle=2372,i,10518879051966557558,14313874543039887683,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:10
      4⤵
      PID:6908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4076,i,9423877355489195523,18126762556881371751,524288 --field-trial-handle=2372,i,10518879051966557558,14313874543039887683,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
      4⤵
      PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6372

C:\Temp\keczurpmhezwuspk.sys
C:\Temp\keczurpmhezwuspk.sys
1⤵
- Executes dropped EXE
PID:1048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4980

C:\Temp\zurmbwuomg.sys
C:\Temp\zurmbwuomg.sys
1⤵
- Executes dropped EXE
PID:6180

C:\Temp\mgecwuomge.sys
C:\Temp\mgecwuomge.sys
1⤵
- Executes dropped EXE
PID:4336

C:\Temp\bywtoljdbz.sys
C:\Temp\bywtoljdbz.sys
1⤵
- Executes dropped EXE
PID:5752

C:\Temp\ligaytqljd.sys
C:\Temp\ligaytqljd.sys
1⤵
- Executes dropped EXE
PID:4312

C:\Temp\qljdbvtnla.sys
C:\Temp\qljdbvtnla.sys
1⤵
- Executes dropped EXE
PID:1392

C:\Temp\dxvqnifays.sys
C:\Temp\dxvqnifays.sys
1⤵
- Executes dropped EXE
PID:6760

C:\Temp\axspnkfdxv.sys
C:\Temp\axspnkfdxv.sys
1⤵
- Executes dropped EXE
PID:6212

C:\Temp\aurpnhfzxr.sys
C:\Temp\aurpnhfzxr.sys
1⤵
- Executes dropped EXE
PID:2624

C:\Temp\cwupmhfzxu.sys
C:\Temp\cwupmhfzxu.sys
1⤵
- Executes dropped EXE
PID:2364

C:\Temp\wuomkebwuo.sys
C:\Temp\wuomkebwuo.sys
1⤵
- Executes dropped EXE
PID:796

C:\Temp\trljebwuom.sys
C:\Temp\trljebwuom.sys
1⤵
PID:6844

C:\Temp\ywtolgdywq.sys
C:\Temp\ywtolgdywq.sys
1⤵
PID:4788

C:\Temp\idavtnlfdx.sys
C:\Temp\idavtnlfdx.sys
1⤵
PID:6416

C:\Temp\qnigaysqki.sys
C:\Temp\qnigaysqki.sys
1⤵
PID:2736

C:\Temp\vpnkicaxvp.sys
C:\Temp\vpnkicaxvp.sys
1⤵
PID:5924

C:\Temp\fzxspkicau.sys
C:\Temp\fzxspkicau.sys
1⤵
PID:1524

C:\Temp\fzxrpmkecz.sys
C:\Temp\fzxrpmkecz.sys
1⤵
PID:4768

C:\Temp\wurmkecwuo.sys
C:\Temp\wurmkecwuo.sys
1⤵
PID:6448

C:\Temp\romgeywrom.sys
C:\Temp\romgeywrom.sys
1⤵
PID:6576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ayspnlfdxn.exe

Path C:\Temp\ayspnlfdxn.exe
Size 361KB
SHA256 6381ee1737d7212e00ae840632d59b8968518aaf890327ae4bdeb9d8ba49e565
MD5 bf9d1455902932f3ef459e4902207f60
SHA1 2d4a2c26e8f4da44f8ca437a842fe940754a74c4
SHA512 cc40c5e10744e124473327fc9360647bd00ef5db862c6dc76e4d9a34c5fa87f95aa8f2271fe8494402951f262def7dceccf0c77c72524c74912b62acf5b0f7e7
SSDEEP 6144:bflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:bflfAsiVGjSGecvX
TLSH
T1F8747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bywtoljdbz.sys

Path C:\Temp\bywtoljdbz.sys
Size 293KB
SHA256 75974add64774da1cf8e330d5c5a843471382a659bdb0a45858c53bd95c26714
MD5 8b868e43c535ae6d4df2af60dd90c321
SHA1 700f64834eea114b72f08a5652e346da7b0b719d
SHA512 ecb653ba3fc53b4074d704b6458352c890dd15ccc50fb70d3ad6c1fec216841a9674b6af51790dd70c964d5c71b562596f0eca6906bc5cbacc32937c4b820cce
SSDEEP 3072:/tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:/IJjiJcbI03GBc3ucY5DCSj
TLSH
T1C8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbywqojgby.exe

Path C:\Temp\dbywqojgby.exe
Size 361KB
SHA256 16286b0ccde290fd1cb074101641e3ee2f5213f25753ba94cbcdc44d1bcbb49d
MD5 61c0bfabafe731d3fab40e0dbc829dd6
SHA1 5302ca210d38f390669f5dc0d4ed0d6679bb7b55
SHA512 fe6afc588f86a9bd7d19613de2a768521989729d01a17f119a16972270ee35b3611ac8797e757253e239367a7b8459b95231f968a30037db4d09369cf0de9514
SSDEEP 6144:jflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:jflfAsiVGjSGecvX
TLSH
T1F4747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvqnifays.sys

Path C:\Temp\dxvqnifays.sys
Size 293KB
SHA256 1287e35446f057368ddd54af55420d2609be2d561d78e5757c1f3b7755ec0c2c
MD5 4246631ca6aacff9cb2ea9b0ae95b80f
SHA1 8f1d0c1f774fab10818970691f780f64cfb05ff4
SHA512 6478bb817d13c5eca3fdec61921c10624ff294141e925137de878bd7f37a871b0e73b5092ba64d0739484979ea3d13b404be027086dea8a52288f5ecdf68d029
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gerolgdbzt.exe

Path C:\Temp\gerolgdbzt.exe
Size 361KB
SHA256 32bc66af90c1012221fe48f3c14802f8c3083afa246ee2191734872b82f33c1d
MD5 5c0df0a423dd859ab11f348f399c872e
SHA1 62e065c0d3daf18ef4f044b5a484413f54fcbb99
SHA512 8ad4309d95de0fecd8a45709af7eb33a54417e6d9544db8657a5cee6b7d304b8e5e4b7991249de50ab6e2f1ed4b60fc0b9f424362e5642847f5b915509d1f5ef
SSDEEP 6144:mflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:mflfAsiVGjSGecvX
TLSH
T1FB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbywqojgby.exe

Path C:\Temp\i_dbywqojgby.exe
Size 361KB
SHA256 832ffa20bedd0b658542d6ee3278e19e95e99e3fed601c337bdf33fa6b826cf1
MD5 f87437d9fd94750847351824b63d9d5d
SHA1 0cf0cca13c500c6068ebd9d033fff85e6857717a
SHA512 4fea24f442d8bddf816e88fd51ccea820d72fcdd3dd12ad2e7f3b97bf43b50742304f4848ec0e510e82a788bb8c43c51256dd79daeb6aaf933a8faf2e493ff76
SSDEEP 6144:0flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:0flfAsiVGjSGecvX
TLSH
T12F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gerolgdbzt.exe

Path C:\Temp\i_gerolgdbzt.exe
Size 361KB
SHA256 c8ddf97ee37bf5b33cc945db16b7dea8da72743fbfcd2f14bf6ef4f1d781769a
MD5 3a505a8629f0dba8e2064a52943fe2dd
SHA1 ef0e334d49cc447aa83a9991d18f6ec8eb3af459
SHA512 f2ee224d4602fd50c33324080c4cef53a2e5a164ee9965dc650463bc070900ac0bef4fbea9c40ad4d8d9ce44d09dd61da973598d3eee5eb1572ddbb06f32d8ec
SSDEEP 6144:GflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:GflfAsiVGjSGecvX
TLSH
T121747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_icaysqnlfd.exe

Path C:\Temp\i_icaysqnlfd.exe
Size 361KB
SHA256 c29402529c52d6ebcd5762bd34c78e8142596cd3401a0f7c08857bbe936d48a0
MD5 b36accdbbfd7e1d24b2b0161367d8da2
SHA1 31a79c397aefe1414e957e100e5f90d8e751ecf6
SHA512 ee197b283cb545a1962dba9f72fca48bb3c9dda17572ec703778a29bc1ee32094db501e2405910c5d8cfeca53e2548efe9c76c95725f4f955834c7bfe78c9e7e
SSDEEP 6144:hflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:hflfAsiVGjSGecvX
TLSH
T1D7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lidaywqoig.exe

Path C:\Temp\i_lidaywqoig.exe
Size 361KB
SHA256 e639d9c9efa16981bf51b309e1a841b64c3144736d19d3e31c5ac8f409af91b8
MD5 3fd0a1e3738da08c502e1c8608f780c2
SHA1 b9c1d055b0f1788a1818e8676cec87fe30001e05
SHA512 90e015ad70e7238251656e2f310eaa59f7fcd81661844497449a9c6114cd1bda789f5e34b19ddac8801ea14b9413497b5bf33f44c21f7edf780036b2ab0648d9
SSDEEP 6144:eflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:eflfAsiVGjSGecvX
TLSH
T10E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pjhbzuomje.exe

Path C:\Temp\i_pjhbzuomje.exe
Size 361KB
SHA256 6a3ffc6dd20297f28fced704984ed14ff87b76951a61a3c2b35d23b37b7f780b
MD5 bca66170f4621bba03007c42a4c50e4e
SHA1 77df55024d36b102453330634d38fd780459abf7
SHA512 688727e1f6f4fc3ae89aad905b367e91cb2e6080c114bdd8c75e8b14a628016b6d0fcd005231309e36198ef73673df2aa274fd47cad9c144ba4dd3a9735e267f
SSDEEP 6144:aflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:aflfAsiVGjSGecvX
TLSH
T1A4747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zusmjeczur.exe

Path C:\Temp\i_zusmjeczur.exe
Size 361KB
SHA256 0b5b6615755cefa514c89a167f1f5c443d834a44cfd757ee9dfb1acfb5acc208
MD5 555e2e3f359b37c17d0efebe6817aa45
SHA1 260e0b885bf995337e302ab475e284799f612a5c
SHA512 dd23b8b9c3114bb1318dae35002afa67f2da52d5dbf85196ace48bd8bb64f75e3ea9e763d2a938735ca2694646ac2ceee15c51a5fd477ac5c9805f3ad8fb7841
SSDEEP 6144:GflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:GflfAsiVGjSGecvX
TLSH
T130747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icaysqnlfd.exe

Path C:\Temp\icaysqnlfd.exe
Size 361KB
SHA256 fca95ae36992940619cfd16040ed59f3e69520d05cf8312eb79541fb40c5ea0d
MD5 5df8d6f9b5632dbe4c19a75febf9c425
SHA1 024b9fa1d573dd85c1ce713a973db0333a7bd5d6
SHA512 f5f7320bbd1b889b58d7c254c8684001dac478a79a72c73d1edd4f7f781a140eddbd24dabd299e55a7ed4cb445e86287edbc87081cb95fc317b7726797ff72c6
SSDEEP 6144:SflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:SflfAsiVGjSGecvX
TLSH
T1FD747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keczurpmhezwuspk.exe

Path C:\Temp\keczurpmhezwuspk.exe
Size 361KB
SHA256 d4c9e5c79d3e27594d504644e0e7282c03d294430741143ae0423090844e1501
MD5 06116554c1a007244b97ad860486aa70
SHA1 772f8ffec2dbd5b64c2d7b00824ee13b75511978
SHA512 414fc7b6fe4024fd294d0565be871aba5e76b2a9b2f5554cb5b9382a5dee946178d93355988a26d311ea9bb1dde766e6a6c04cfeca4df6d4d99e5028ecf183a0
SSDEEP 6144:HflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:HflfAsiVGjSGecvX
TLSH
T1BD747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keczurpmhezwuspk.sys

Path C:\Temp\keczurpmhezwuspk.sys
Size 293KB
SHA256 b21134610e891e8a42434cdf284c9e58e469e2f72ca8ee2d37e9862f241e4d5d
MD5 f35b617f3d844119893b9216d60f9ec1
SHA1 21162d0239e83ebcc174a428b79d7c489030456f
SHA512 9d17613f7662ce2b4603c7eec5e9bcf6dd45c057f9bc64d5c545ddce04b84d113c3c84e2ddbdc503842206a89c9219bbe0c8cf6b41e8b9569956afdc8b94e6f3
SSDEEP 3072:stKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:sIJjiJcbI03GBc3ucY5DCSj
TLSH
T168545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidaywqoig.exe

Path C:\Temp\lidaywqoig.exe
Size 361KB
SHA256 92b62116bc32b975649181de4261531f8281f31fe8ac1a5c0256f01c1be80b6c
MD5 501db4a74ae396b075d442f0799fac89
SHA1 6ea714285c303e5362b015515c368996626cadf7
SHA512 3e33d224576f82e54bcde0c5a2bf27360995b51c131632686830a387c5bacbc4dd1dc3470801314983cbf0bc06fec0ddd4d1be7d944412794c7c8e05ad605f20
SSDEEP 6144:mflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:mflfAsiVGjSGecvX
TLSH
T14D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ligaytqljd.sys

Path C:\Temp\ligaytqljd.sys
Size 293KB
SHA256 812ee5a204028b84e3e7fe9809e9d2334d58a6d723701570d91aa09be8c4dfdd
MD5 d82ab0f1a871f9c717b51fa8334efd23
SHA1 95808f349a34309c0feec2a8a74482f6dcd62ec5
SHA512 230bdbce4e3561fa1fce30d0612a96324ca4b0a8132bcc82826c6cb1838d820134e7bf5c502aa86bf2641c6f05e185725e3e3f06cd8b54e179ea66dd4b7c8a90
SSDEEP 3072:atKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:aIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgecwuomge.sys

Path C:\Temp\mgecwuomge.sys
Size 293KB
SHA256 46b876d8238b7d452741024d4884d91799c89ac54fea3f4ef9e3145efae3351f
MD5 3c32e1bc165540adb31bf5a9ae418cf1
SHA1 c219f85097193992fc4aff07f9fa36267449a4ca
SHA512 14daf1781d1ed389c4ec45ab609c99489cc6734e92181a6b0aa3bfbf2ff4e193f0266ebd3b511265f814ffa905a6eae45b320301281b39bb456cb33c2cd02fc8
SSDEEP 3072:JtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:JIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhbzuomje.exe

Path C:\Temp\pjhbzuomje.exe
Size 361KB
SHA256 980b8ac2f0fa0c21cac506f5f41a4c3d7aefefd85270d367bf0e88f09388ce6d
MD5 a8c50751826cc8b54fcd0e4c1931857a
SHA1 6b6a4ba5ccec46a00fd83db118e8f950a5465fa8
SHA512 0f27e6bc9b70d9dcca7ec2e8be8ec539da0e58c3cf3d29c6cfbd92eaa44a27dccf48c8f880dde58c55341b649c3c9e3cab7d245b60bd1d549d02df2f0a7b4399
SSDEEP 6144:mflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:mflfAsiVGjSGecvX
TLSH
T1AC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qljdbvtnla.sys

Path C:\Temp\qljdbvtnla.sys
Size 293KB
SHA256 6662e1044ef9747c4ccc16c3bdcd6fc383ee2fc503fd1fb0017216b91ea935c5
MD5 7f12e55dd973a73e938dd65977b57103
SHA1 e73aa501e49a7e85261c57e4108d41bdd04f6a04
SHA512 8397feca9ab4bc045d4bc92e1676724190409cfc0ca4b9c7289e1fb52782cb06897fbb6c56a807dae79f551be308ef559b352123239773d91362ee3599ae70c2
SSDEEP 3072:LtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:LIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurmbwuomg.sys

Path C:\Temp\zurmbwuomg.sys
Size 293KB
SHA256 7097a568b5c38ba20680035d51f5252a1140cd965ae8a4de460e751e77e3f7f5
MD5 2d1ebeee372a10bf14ec35be79069f7d
SHA1 9adf9591a5edb5e2044d8c3821bad45365a073d8
SHA512 2d7b1ed5febf811fe7edf563d12b5feec4b51fc1ca401848f59adc4bb0862b98253821b2a5809f17e9abf3977a43b570d2cc4c8b68c5b24e3e0e33e6f63fbeda
SSDEEP 3072:ttKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:tIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zusmjeczur.exe

Path C:\Temp\zusmjeczur.exe
Size 361KB
SHA256 881ee36f198979e69fbccb322bd7c82faf96d9011b58b9a8ce82e4da4f0452e1
MD5 a63f43060569f3597bd758d1a8b45748
SHA1 e2afdc59b5fc7a2e22d3c8b39b1f412ad6bec948
SHA512 687ce769c751ef1e70f409555605e19e8a88c84b49c963df7a1aaaff0fbbbd81b5d4c59ddda4fff2a65be199d63a9aaa2ca3a8c4d285c353027d4f788dbccf89
SSDEEP 6144:vflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:vflfAsiVGjSGecvX
TLSH
T1B4747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2ed0b7f4-3e5a-4a96-a28f-5c54e9c37f11.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2ed0b7f4-3e5a-4a96-a28f-5c54e9c37f11.tmp
Size 24KB
SHA256 6a953fbe225c1b4b4aed7a2969fac977454b3e4dd2894adf548510b94d3e94aa
MD5 2a24e7199b8262d21c1ef9d53fa1232c
SHA1 1f3bd146a8bf6d0bc95756bb17f2844a6f63d704
SHA512 2041c5c57c5c28efec17e7a9f19cf4797074fc3b6720c338f48b6f4d210941a5ab503e7c910443b0f7c0061789efdc8cc3969a31d5c46668e421078e425eab84
SSDEEP 384:nEiF1tNn/s3n9Sl8NLM8TUNTUlIR7PvuTsEDEqf+GGrpjBslRcFOOvQo8LEEIzhB:fF1j+9AQMwgluB7GrlsOok
TLSH
T1B0B22A36E865CDB7ACE74FC9B74A7643EEE011A384889AD4D6D85D4D00C72AD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 251a139a544e07935a4a06b45596a0d568a6cb59694d49c1b969e2618f6cd0c9
MD5 8b5c79b53985408ab18720c639b17353
SHA1 ee139a6ba836df42aa493452c4f7afc7b6814cdf
SHA512 0fe379a6c6c647138335e376d7e77f1bb917f1730f56bb5e759971befa376a260ee7de4543dbd4c80329a5518fdbd9cbaf56f7f255307b34491c10a590093587
TLSH
T155F0F4AAD921AC371DFC1B1960A50B47EB51136B3B41984B3B3E921C4FB0B3B468AC1C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 aeed8c203d477438c3a81de1a7da1f15bf05e125d78524043c7001f84071a95e
MD5 fc09975b215d3cfdc2b1d9718f5d410b
SHA1 d74c6f181517c8a4d15b20fda7738d06a6c0cf85
SHA512 7a86dde93ff6f60994d57b8f334d16dd05a6546ef7fc7c1aa63d0a1211356b5be5fabb6cb502bfe7c680092189f256f762d404f1a5879dd5b241846f8494ffa4
TLSH
T15951BEF783F4856DC91196F0AB187E2BCE1C0914832C3D5AC9E0AE1BA3E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f18e6217a63a90a1ae299b61540ee56c35d1d2eb8e960d75413c1b6c08b6d947
MD5 fe7fb178a573bab3bba6bf8a69850796
SHA1 1d4b0cedd5777a40f1951739a007ea72830cbf05
SHA512 ef78a8642082b15205f7387f29ca54c5ab5a58c1ee9dec03e65c7de9c34fd0f0a161ad1eae16e1111aa97a68b158e1a33bc0b0551d985292b85dfac045fb153d
SSDEEP 384:sxRJm5/fCsmBN/RIvTJ/55/Wb9sGQ41se:sVm5/fcTWV/59Wb9sGQ49
TLSH
T15152C71A6A689D3B4CC7D21ABB557F53D2FD1132A0916E48A7FC8B0C04EA7DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c846fba7b0bfd7867e84a0ade91de2850f9c5472441982c39fcffbe42fad3c17
MD5 a32ad780a8c7c4a58fe4b35a3d0c2da2
SHA1 fd5171dd090d8fc64d78b07adde284e072f21fa1
SHA512 fb246bd9979c5f31fdde9739b914a7b7917e8a03ce52e21f14187007484ace1047a27b261463a8d36283b0732b4061274e28025e06ea134b4d37545744971fc4
SSDEEP 384:sxRJm5/fCsDBN/RIvTJ/55/Wb9sGQ41je:sVm5/ftTWV/59Wb9sGQ4k
TLSH
T1AB52C81A6A689D3B5CC7D21ABB557F53D2FD1132A0916E48A7FC8B0C14EA7DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2d9a34456ee0a53ff71e82a6da4e6876d311628fb48385328d2c51195bc78cdf
MD5 5706d6cfa01ae3d0fa585c5c04dc3c08
SHA1 a5160a26c90c8afa468575dcb6b2b7cd1606f0bd
SHA512 8fe992dbe08b154a1cf04dc83dff7ea1597c18b2fc0f68c81be1f2d14e8e6db44e09d4144f38bca859e95eca062426ba9cda281b250b969d2d11eba6cc413e0b
SSDEEP 384:sxRJm5/fCsm7N/RIvTJ/55/WbEsGQ414s:sVm5/fcxWV/59WbEsGQ4z
TLSH
T1DE52D81A69689D3B5CC7D21ABB557F63D2F91132A0916E48A7FC8B0C04EB7DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 9694d71c20310c6dff0dbd44ea54f5caed451b7ea510bcd4612226074ff751cc
MD5 5a1674459ee4cf0b0eddff3988454192
SHA1 ee12d678488b89fc3ebb6d061043e5d86a1a3abd
SHA512 fe202a00a7130fc8fa02dd9256c8dc2477d7cd8b7b5930e4635a66a54ae0217cc529962bb2fd997afcc4c68e31a4eed8fe2ef025424594823ce918f117989b5e
SSDEEP 768:O+WYbx7pLuL7+TWg1Nf9B8F1+UoAYDCx9Tuqh0VfUC9xbog/OVioDbDezro/a4m:O+WYbnE7+TWg1Nf9Bu1jaJoDHeA9m
TLSH
T1F8D2DA7B740DCB7E4F800ADDAC197A9F6DA802CB9698CD4087FE951C02C6BFA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8aecf9f730f9f7a1b45918e59a207d12d9550247cca3c7b529f010099603100a
MD5 1dd65f15b8f07d9a7fc8326c79efac00
SHA1 aec209f51de736da56424084095333aa8036917a
SHA512 3add63829bd0491d551bcf4223d2c28ee0ba932fd34c50e677028644f677891be48f92d6350783b6c62abf6a57b208e1a60bafd769320c2e8488233cf524663c
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9LD6:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRH
TLSH
T1E5B25B11713F5680383EB90C81B8D81F96C2B4637519E56F7BA801A65F67E039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 6e2e698a4819170db12527c4f49d88d0c7f54beb3ccc79e2b00ef53908542ed6
MD5 faf85124196cfddbc369d6eaefce3fef
SHA1 e2607cf28e8bb1da8f6e8275a105fce6e3afe422
SHA512 99e1e18d490fbd06da45f511b0ebac9fbbc0bf9baae98a7bfb21557989cb4f99436e44ee2e21ad0a13777aa93a881ee78d222244c06b8f463ef201eec4ac2547
SSDEEP 384:nxiF1tNn/s3n9S98NLM8TUNTUlIRdPvuTfFDEqf+GGrpjBslRct2OOObjI9G6w7u:YF1j+98QMwgTuJ7GrlUO29Mu
TLSH
T158E2D3F6A8D78977D89E4B87A33E2E4299FCC1A3B4885984B7C45D0CCC861BFC706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 9d12cf258cd359232f27d814e1cccd6d46fd90b74a28babcc5909524eabc0bf7
MD5 1b37f5c2e534c8ec5d241d1f8fe46b75
SHA1 ab3222020df29d8c4e1959915b096636acf37a0a
SHA512 14b4b5c9aa1df481f306b0e5dc22051288d1e052f1f2282444e51dfae6c2b4ff82235156731df6b517595678be23da786e1cae3cf0a25d4dd9898614fe86c711
SSDEEP 384:nwiF1tNn/s3n9Sn8NgX8TUNTUlIRiPvuTuIREqf+GGrpjBslRYLGOObjI9G6w7hq:LF1j+9SXXwgUuRZGrTG29M4
TLSH
T125C24A36EC65CEB7EDE74F98B34A7A46EEE01267849C59D8EAC85D0D00871ED0707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e19d9487dbf1ee682bcd9cb4dff3dde3ee3c280688be56cab6b23096470c1936
MD5 cf99a6c3f42f2efba6f6aaf48bd71f15
SHA1 aeb7f6d153e3a95fc540d38fd8773bb05f8e0dad
SHA512 6baba48a3dfd6eb64823f89aef1140ccfdeaf96bbbbfc5d62a4bdc69ef46455bb034187ea9e24534f381fbbc844b37cc91457a9c8231304c19097d91c29832cb
SSDEEP 384:njiF1tNn/s3n9Sl8NLM8TUNTUlIRdPvuTfEDEqf+GGrpjBslRcFOOOObjI9G6w7u:OF1j+9AQMwgTug7GrlsO29Mu
TLSH
T1D0D24B36E865CEB7ECE74F95B25A7A47EEE012A3848C59D8E6C55D0D00C72ED070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 462d7e808963e2604c30ade17e2177d755e533a3d5aafcfbd2a338e44dc14cbc
MD5 4f68dd1a44247528a0d6d45f87ce7cac
SHA1 915377a893f8c5ecd5719a8c912769fc0dcc13d7
SHA512 a6b09d5a431c47f0a1fa3a5c33b691431b8ae6599019bd7234d89ea7c4b0db1b23099541e7816a87f856c0237ad1af9b703afe90f4f88c203704e09c67a9d5bd
TLSH
T1724163D04C391AC1D4BD0E6FB45B29FC94ECD726F490347C2858EA98567E65E314083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 60dcf11b489bd712b3d51c6df8db08d58506497d44b6cfb082dedd072a4df063
MD5 0377a5d6371c66cfaf9dd565ac7c2d77
SHA1 491afdd6904c8115bb052650bec6c40f8e6fb506
SHA512 ca1536cd5af2846e985e793f00070078fc31c0dced432df28b75b6386bc041ac08ec211daad9474e7aaa297f0925b18e24a390fb551dbb349557cd723805e641
TLSH
T1B74130E04C381AC1D4FD0E6F748B39FC84E8C726F4A4347828A8E958557E65E258483F
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 64bacc618debf3f0f96061005bf07e9b3a52100c9ce7db486ceb9a3a62929a8c
MD5 c41d678dd7fc2cd8d2cdc3f606e061d2
SHA1 6b44c737ea61f1131697f58f019b83bd5b34d8e0
SHA512 1b810e6399be1a244e03970c3459006a00b08a424fdbdd50b6f4989b5f012c3165ca8acfee045c9db6255570b958b261d1c6eb310e15cdc06edbe47576ec5988
TLSH
T1157123835AB8D6F3C5DA5BF002835248F6FB23380B2330750B559546AB30A7A18B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/796-300-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1048-59-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1392-232-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1524-354-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2364-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2624-278-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2624-292-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2736-345-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4312-219-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4336-186-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4768-358-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4788-309-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5752-206-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5924-349-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6180-151-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6212-274-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6416-328-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6448-369-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6576-373-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6760-268-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6844-304-0x0000000000010000-0x00000000000AB000-memory.dmp

Download