systex | 4c6f98d14fe9eaf5548d4fcba3cd3bdfb7ca9f371a5fc7c1066e322c0a2df18f

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 23:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260629-3zalkabs7p
SHA256 4c6f98d14fe9eaf5548d4fcba3cd3bdfb7ca9f371a5fc7c1066e322c0a2df18f
MD5 15b425b45bcf985623173ad068d9d41b
SHA1 e796d9eae9d221e9f5756ad0a02e90c76539aa22
SHA512 f8950c2df9b24197a176017db02f71c26640c389a6cef1f167b7b3ab9c7f0d5e00d2d42602cc800c9fcd2095818ea9abcc2eede63a5c900711908d09a117b4d9
SSDEEP 6144:+flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:+flfAsiVGjSGecvX
TLSH
T1AB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3632	kecwusmkhczxupmk.exe
1392	kecwusmkhczxupmk.sys
2464	CreateProcess.exe
2524	upmhecwrpm.exe
3772	CreateProcess.exe
5060	CreateProcess.exe
4520	i_upmhecwrpm.exe
5660	rpjhczurpj.sys
4360	CreateProcess.exe
2476	ezrpjhbztr.exe
1084	CreateProcess.exe
6100	CreateProcess.exe
2196	i_ezrpjhbztr.exe
5768	bwuojhbztr.sys
6064	CreateProcess.exe
4720	wrpjhbztrm.exe
2252	CreateProcess.exe
1900	CreateProcess.exe
4200	i_wrpjhbztrm.exe
1948	ojgbytqomg.sys
2784	CreateProcess.exe
4456	oigbytrljg.exe
5704	CreateProcess.exe
2920	CreateProcess.exe
1140	i_oigbytrljg.exe
5840	ljdbvtnlgd.sys
4280	CreateProcess.exe
1096	gdbvtnljdb.exe
4272	CreateProcess.exe
3576	CreateProcess.exe
4732	i_gdbvtnljdb.exe
2336	idbvtnljdb.sys
2304	CreateProcess.exe
5700	yvqnigaysq.exe
6116	CreateProcess.exe
1472	CreateProcess.exe
3864	i_yvqnigaysq.exe
1384	nifayvtnlf.sys
988	CreateProcess.exe
5764	igaysqkica.exe
2024	CreateProcess.exe
5644	CreateProcess.exe
1748	i_igaysqkica.exe
3440	ifaxsqkica.sys
1648	CreateProcess.exe
2804	cxvpnkicau.exe
4228	CreateProcess.exe
5828	CreateProcess.exe
5904	i_cxvpnkicau.exe
4664	cxuspkhfzx.sys
2384	CreateProcess.exe
2088	xrpmhfzxup.exe
2668	CreateProcess.exe
3468	CreateProcess.exe
3200	i_xrpmhfzxup.exe
3740	fzwupmhfzu.sys
200	CreateProcess.exe
2004	urmkecwuom.exe
1992	CreateProcess.exe
5868	CreateProcess.exe
2200	i_urmkecwuom.exe
4628	ezxrpjgecz.sys
5976	CreateProcess.exe
796	ezwurmjecw.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_1430968661\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_523760524\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_523760524\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbztrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpmkhcauk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpmhfzxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbztrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlgdbvtoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvpnkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwurpjgebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhecwrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdbvtnljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpmhfzxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qolgdbytqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausmkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbytrljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecwusmkhczxupmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausmkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwuomhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhecwrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbytrljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwurmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwurmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlgdbvtoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qolgdbytqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwuomhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdbvtnljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvpnkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpmkhcauk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjhbztrm.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4196	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3380	ipconfig.exe
2724	ipconfig.exe
2992	ipconfig.exe
240	ipconfig.exe
812	ipconfig.exe
3416	ipconfig.exe
5292	ipconfig.exe
3392	ipconfig.exe
3168	ipconfig.exe
2800	ipconfig.exe
3184	ipconfig.exe
4200	ipconfig.exe
1888	ipconfig.exe
5068	ipconfig.exe
2244	ipconfig.exe
988	ipconfig.exe
6024	ipconfig.exe
4760	ipconfig.exe
2300	ipconfig.exe
5728	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1797646245-3139070211-3019596475-1000\{264D5DBF-3316-4B8C-B117-2C8FDC0C5EB9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3632	kecwusmkhczxupmk.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3632	kecwusmkhczxupmk.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3632	kecwusmkhczxupmk.exe
5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3632	kecwusmkhczxupmk.exe
3632	kecwusmkhczxupmk.exe
3632	kecwusmkhczxupmk.exe
3632	kecwusmkhczxupmk.exe
3632	kecwusmkhczxupmk.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4520	i_upmhecwrpm.exe
Token: SeDebugPrivilege	2196	i_ezrpjhbztr.exe
Token: SeDebugPrivilege	4200	i_wrpjhbztrm.exe
Token: SeDebugPrivilege	1140	i_oigbytrljg.exe
Token: SeDebugPrivilege	4732	i_gdbvtnljdb.exe
Token: SeDebugPrivilege	3864	i_yvqnigaysq.exe
Token: SeDebugPrivilege	1748	i_igaysqkica.exe
Token: SeDebugPrivilege	5904	i_cxvpnkicau.exe
Token: SeDebugPrivilege	3200	i_xrpmhfzxup.exe
Token: SeDebugPrivilege	2200	i_urmkecwuom.exe
Token: SeDebugPrivilege	1252	i_ezwurmjecw.exe
Token: SeDebugPrivilege	4844	i_jdbztrljeb.exe
Token: SeDebugPrivilege	4652	i_nlgdbvtoig.exe
Token: SeDebugPrivilege	3440	i_qolgdbytqo.exe
Token: SeDebugPrivilege	1424	i_nlfdxvqnig.exe
Token: SeDebugPrivilege	3412	i_nhfaxsqkic.exe
Token: SeDebugPrivilege	3116	i_kicausmkhf.exe
Token: SeDebugPrivilege	576	i_xrpmkhcauk.exe
Token: SeDebugPrivilege	3452	i_zwuomhezxr.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1680	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5484 wrote to memory of 3632	5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 5484 wrote to memory of 1996	5484	2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 1996 wrote to memory of 1680	1996	iexplore.exe	89
PID 1680 wrote to memory of 3296	1680	msedge.exe	90
PID 1680 wrote to memory of 4196	1680	msedge.exe	91
PID 1680 wrote to memory of 4312	1680	msedge.exe	92
PID 1680 wrote to memory of 5440	1680	msedge.exe	93
PID 1680 wrote to memory of 4312	1680	msedge.exe	92
PID 1680 wrote to memory of 4312	1680	msedge.exe	92
PID 1680 wrote to memory of 5440	1680	msedge.exe	93
PID 1680 wrote to memory of 5840	1680	msedge.exe	95
PID 1680 wrote to memory of 5840	1680	msedge.exe	95
PID 1680 wrote to memory of 5840	1680	msedge.exe	95
PID 1680 wrote to memory of 4616	1680	msedge.exe	96
PID 1680 wrote to memory of 4616	1680	msedge.exe	96
PID 1680 wrote to memory of 4616	1680	msedge.exe	96
PID 1680 wrote to memory of 2964	1680	msedge.exe	97
PID 1680 wrote to memory of 2964	1680	msedge.exe	97
PID 1680 wrote to memory of 2964	1680	msedge.exe	97
PID 1680 wrote to memory of 5668	1680	msedge.exe	98
PID 1680 wrote to memory of 5668	1680	msedge.exe	98
PID 1680 wrote to memory of 5668	1680	msedge.exe	98
PID 1680 wrote to memory of 3264	1680	msedge.exe	99
PID 1680 wrote to memory of 3264	1680	msedge.exe	99
PID 1680 wrote to memory of 3608	1680	msedge.exe	103
PID 1680 wrote to memory of 3416	1680	msedge.exe	104
PID 1680 wrote to memory of 3608	1680	msedge.exe	103
PID 1680 wrote to memory of 3416	1680	msedge.exe	104
PID 3632 wrote to memory of 2464	3632	kecwusmkhczxupmk.exe	105
PID 2524 wrote to memory of 3772	2524	upmhecwrpm.exe	108
PID 1680 wrote to memory of 5728	1680	msedge.exe	112
PID 1680 wrote to memory of 3196	1680	msedge.exe	113
PID 1680 wrote to memory of 3196	1680	msedge.exe	113
PID 1680 wrote to memory of 5236	1680	msedge.exe	114
PID 1680 wrote to memory of 5236	1680	msedge.exe	114
PID 3632 wrote to memory of 5060	3632	kecwusmkhczxupmk.exe	117
PID 3632 wrote to memory of 4360	3632	kecwusmkhczxupmk.exe	121
PID 2476 wrote to memory of 1084	2476	ezrpjhbztr.exe	123
PID 3632 wrote to memory of 6100	3632	kecwusmkhczxupmk.exe	126
PID 3632 wrote to memory of 6064	3632	kecwusmkhczxupmk.exe	130
PID 4720 wrote to memory of 2252	4720	wrpjhbztrm.exe	132
PID 3632 wrote to memory of 1900	3632	kecwusmkhczxupmk.exe	135
PID 3632 wrote to memory of 2784	3632	kecwusmkhczxupmk.exe	139
PID 4456 wrote to memory of 5704	4456	oigbytrljg.exe	141
PID 3632 wrote to memory of 2920	3632	kecwusmkhczxupmk.exe	144
PID 1680 wrote to memory of 5164	1680	msedge.exe	146
PID 1680 wrote to memory of 5496	1680	msedge.exe	147
PID 1680 wrote to memory of 5576	1680	msedge.exe	148
PID 3632 wrote to memory of 4280	3632	kecwusmkhczxupmk.exe	151
PID 1096 wrote to memory of 4272	1096	gdbvtnljdb.exe	153
PID 3632 wrote to memory of 3576	3632	kecwusmkhczxupmk.exe	156
PID 3632 wrote to memory of 2304	3632	kecwusmkhczxupmk.exe	160
PID 5700 wrote to memory of 6116	5700	yvqnigaysq.exe	162
PID 3632 wrote to memory of 1472	3632	kecwusmkhczxupmk.exe	165
PID 3632 wrote to memory of 988	3632	kecwusmkhczxupmk.exe	169
PID 5764 wrote to memory of 2024	5764	igaysqkica.exe	171
PID 3632 wrote to memory of 5644	3632	kecwusmkhczxupmk.exe	174
PID 3632 wrote to memory of 1648	3632	kecwusmkhczxupmk.exe	178
PID 2804 wrote to memory of 4228	2804	cxvpnkicau.exe	180
PID 3632 wrote to memory of 5828	3632	kecwusmkhczxupmk.exe	183
PID 1680 wrote to memory of 2368	1680	msedge.exe	185
PID 1680 wrote to memory of 2368	1680	msedge.exe	185
PID 3632 wrote to memory of 2384	3632	kecwusmkhczxupmk.exe	191
PID 2088 wrote to memory of 2668	2088	xrpmhfzxup.exe	193

C:\Users\Admin\AppData\Local\Temp\2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-25_15b425b45bcf985623173ad068d9d41b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5484
- C:\Temp\kecwusmkhczxupmk.exe
  C:\Temp\kecwusmkhczxupmk.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upmhecwrpm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2464
  - - C:\Temp\upmhecwrpm.exe
      C:\Temp\upmhecwrpm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2524
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3772
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upmhecwrpm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5060
  - - C:\Temp\i_upmhecwrpm.exe
      C:\Temp\i_upmhecwrpm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezrpjhbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4360
  - - C:\Temp\ezrpjhbztr.exe
      C:\Temp\ezrpjhbztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2476
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1084
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezrpjhbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6100
  - - C:\Temp\i_ezrpjhbztr.exe
      C:\Temp\i_ezrpjhbztr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrpjhbztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6064
  - - C:\Temp\wrpjhbztrm.exe
      C:\Temp\wrpjhbztrm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4720
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2252
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrpjhbztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1900
  - - C:\Temp\i_wrpjhbztrm.exe
      C:\Temp\i_wrpjhbztrm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigbytrljg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2784
  - - C:\Temp\oigbytrljg.exe
      C:\Temp\oigbytrljg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4456
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5704
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigbytrljg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2920
  - - C:\Temp\i_oigbytrljg.exe
      C:\Temp\i_oigbytrljg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdbvtnljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4280
  - - C:\Temp\gdbvtnljdb.exe
      C:\Temp\gdbvtnljdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1096
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4272
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdbvtnljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3576
  - - C:\Temp\i_gdbvtnljdb.exe
      C:\Temp\i_gdbvtnljdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvqnigaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2304
  - - C:\Temp\yvqnigaysq.exe
      C:\Temp\yvqnigaysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5700
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6116
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvqnigaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1472
  - - C:\Temp\i_yvqnigaysq.exe
      C:\Temp\i_yvqnigaysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igaysqkica.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:988
  - - C:\Temp\igaysqkica.exe
      C:\Temp\igaysqkica.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5764
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2024
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igaysqkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5644
  - - C:\Temp\i_igaysqkica.exe
      C:\Temp\i_igaysqkica.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxvpnkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1648
  - - C:\Temp\cxvpnkicau.exe
      C:\Temp\cxvpnkicau.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2804
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4228
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxvpnkicau.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5828
  - - C:\Temp\i_cxvpnkicau.exe
      C:\Temp\i_cxvpnkicau.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpmhfzxup.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2384
  - - C:\Temp\xrpmhfzxup.exe
      C:\Temp\xrpmhfzxup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2088
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpmhfzxup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3468
  - - C:\Temp\i_xrpmhfzxup.exe
      C:\Temp\i_xrpmhfzxup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmkecwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:200
  - - C:\Temp\urmkecwuom.exe
      C:\Temp\urmkecwuom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2004
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1992
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmkecwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5868
  - - C:\Temp\i_urmkecwuom.exe
      C:\Temp\i_urmkecwuom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezwurmjecw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5976
  - - C:\Temp\ezwurmjecw.exe
      C:\Temp\ezwurmjecw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1948
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezwurmjecw.exe ups_ins
    3⤵
    PID:5880
  - - C:\Temp\i_ezwurmjecw.exe
      C:\Temp\i_ezwurmjecw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbztrljeb.exe ups_run
    3⤵
    PID:3636
  - - C:\Temp\jdbztrljeb.exe
      C:\Temp\jdbztrljeb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5380
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4812
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbztrljeb.exe ups_ins
    3⤵
    PID:4292
  - - C:\Temp\i_jdbztrljeb.exe
      C:\Temp\i_jdbztrljeb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlgdbvtoig.exe ups_run
    3⤵
    PID:3812
  - - C:\Temp\nlgdbvtoig.exe
      C:\Temp\nlgdbvtoig.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3740
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6016
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlgdbvtoig.exe ups_ins
    3⤵
    PID:5388
  - - C:\Temp\i_nlgdbvtoig.exe
      C:\Temp\i_nlgdbvtoig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qolgdbytqo.exe ups_run
    3⤵
    PID:668
  - - C:\Temp\qolgdbytqo.exe
      C:\Temp\qolgdbytqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3348
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4404
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qolgdbytqo.exe ups_ins
    3⤵
    PID:4560
  - - C:\Temp\i_qolgdbytqo.exe
      C:\Temp\i_qolgdbytqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfdxvqnig.exe ups_run
    3⤵
    PID:2172
  - - C:\Temp\nlfdxvqnig.exe
      C:\Temp\nlfdxvqnig.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5664
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5932
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfdxvqnig.exe ups_ins
    3⤵
    PID:2428
  - - C:\Temp\i_nlfdxvqnig.exe
      C:\Temp\i_nlfdxvqnig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfaxsqkic.exe ups_run
    3⤵
    PID:2272
  - - C:\Temp\nhfaxsqkic.exe
      C:\Temp\nhfaxsqkic.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4808
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5548
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfaxsqkic.exe ups_ins
    3⤵
    PID:5344
  - - C:\Temp\i_nhfaxsqkic.exe
      C:\Temp\i_nhfaxsqkic.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicausmkhf.exe ups_run
    3⤵
    PID:5416
  - - C:\Temp\kicausmkhf.exe
      C:\Temp\kicausmkhf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1192
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5392
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kicausmkhf.exe ups_ins
    3⤵
    PID:4200
  - - C:\Temp\i_kicausmkhf.exe
      C:\Temp\i_kicausmkhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpmkhcauk.exe ups_run
    3⤵
    PID:4760
  - - C:\Temp\xrpmkhcauk.exe
      C:\Temp\xrpmkhcauk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4884
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:240
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpmkhcauk.exe ups_ins
    3⤵
    PID:5696
  - - C:\Temp\i_xrpmkhcauk.exe
      C:\Temp\i_xrpmkhcauk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwuomhezxr.exe ups_run
    3⤵
    PID:3708
  - - C:\Temp\zwuomhezxr.exe
      C:\Temp\zwuomhezxr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5832
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6020
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwuomhezxr.exe ups_ins
    3⤵
    PID:2268
  - - C:\Temp\i_zwuomhezxr.exe
      C:\Temp\i_zwuomhezxr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwurpjgebw.exe ups_run
    3⤵
    PID:5040
  - - C:\Temp\bwurpjgebw.exe
      C:\Temp\bwurpjgebw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2480
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4496
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2800
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2c8,0x7ffc38dac188,0x7ffc38dac194,0x7ffc38dac1a0
      4⤵
      PID:3296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,1246554272560529017,6156630727832612592,524288 --field-trial-handle=2956,i,1050821672586059647,15919971511999148486,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:11
      4⤵
      System Time Discovery
      PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,8793310644628644999,2534351703941516192,262144 --field-trial-handle=2956,i,1050821672586059647,15919971511999148486,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:2
      4⤵
      PID:4312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,15791050891618955963,15532112094841824809,524288 --field-trial-handle=2956,i,1050821672586059647,15919971511999148486,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:13
      4⤵
      PID:5440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,2112140690288874427,16189011315120525948,2097152 --field-trial-handle=2956,i,1050821672586059647,15919971511999148486,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:5840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,11405134484264595214,5017793594608532451,2097152 --field-trial-handle=2956,i,1050821672586059647,15919971511999148486,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,7825659673116614629,4700950168132382207,2097152 --field-trial-handle=2956,i,1050821672586059647,15919971511999148486,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:9
      4⤵
      PID:2964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,855710876239326797,13295558335104666735,2097152 --field-trial-handle=2956,i,1050821672586059647,15919971511999148486,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
      4⤵
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,17290368926375619372,9788287373459333132,524288 --field-trial-handle=2956,i,1050821672586059647,15919971511999148486,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
      4⤵
      PID:3264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,17627436762952282132,18018339470973999320,524288 --field-trial-handle=2956,i,1050821672586059647,15919971511999148486,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
      4⤵
      PID:3608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,6280883027817738848,3900130511958512439,524288 --field-trial-handle=2956,i,1050821672586059647,15919971511999148486,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:3416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,15072101499528799267,9792583417973988560,524288 --field-trial-handle=2956,i,1050821672586059647,15919971511999148486,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:5196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,15072101499528799267,9792583417973988560,524288 --field-trial-handle=2956,i,1050821672586059647,15919971511999148486,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,6096172881843870532,4323840177805995787,524288 --field-trial-handle=2956,i,1050821672586059647,15919971511999148486,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
      4⤵
      PID:3196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,13175972358073562210,4323141968790198650,524288 --field-trial-handle=2956,i,1050821672586059647,15919971511999148486,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
      4⤵
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,17756523656761084347,1006226890885561897,524288 --field-trial-handle=2956,i,1050821672586059647,15919971511999148486,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
      4⤵
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,13205602640479036906,14346362066263178253,524288 --field-trial-handle=2956,i,1050821672586059647,15919971511999148486,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
      4⤵
      PID:5496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,2217125218801587013,5963512960088454497,524288 --field-trial-handle=2956,i,1050821672586059647,15919971511999148486,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
      4⤵
      PID:5576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1156,i,12665646659101490795,15434157488471434084,524288 --field-trial-handle=2956,i,1050821672586059647,15919971511999148486,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
      4⤵
      PID:2368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,14642377075797327062,13973863864878422178,524288 --field-trial-handle=2956,i,1050821672586059647,15919971511999148486,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
      4⤵
      PID:2600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6148,i,4003133391694968086,335050899669256029,262144 --field-trial-handle=2956,i,1050821672586059647,15919971511999148486,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:10
      4⤵
      PID:4140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,14087931909651293970,16996077266527197922,524288 --field-trial-handle=2956,i,1050821672586059647,15919971511999148486,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
      4⤵
      PID:4920

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4752

C:\Temp\kecwusmkhczxupmk.sys
C:\Temp\kecwusmkhczxupmk.sys
1⤵
- Executes dropped EXE
PID:1392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2808

C:\Temp\rpjhczurpj.sys
C:\Temp\rpjhczurpj.sys
1⤵
- Executes dropped EXE
PID:5660

C:\Temp\bwuojhbztr.sys
C:\Temp\bwuojhbztr.sys
1⤵
- Executes dropped EXE
PID:5768

C:\Temp\ojgbytqomg.sys
C:\Temp\ojgbytqomg.sys
1⤵
- Executes dropped EXE
PID:1948

C:\Temp\ljdbvtnlgd.sys
C:\Temp\ljdbvtnlgd.sys
1⤵
- Executes dropped EXE
PID:5840

C:\Temp\idbvtnljdb.sys
C:\Temp\idbvtnljdb.sys
1⤵
- Executes dropped EXE
PID:2336

C:\Temp\nifayvtnlf.sys
C:\Temp\nifayvtnlf.sys
1⤵
- Executes dropped EXE
PID:1384

C:\Temp\ifaxsqkica.sys
C:\Temp\ifaxsqkica.sys
1⤵
- Executes dropped EXE
PID:3440

C:\Temp\cxuspkhfzx.sys
C:\Temp\cxuspkhfzx.sys
1⤵
- Executes dropped EXE
PID:4664

C:\Temp\fzwupmhfzu.sys
C:\Temp\fzwupmhfzu.sys
1⤵
- Executes dropped EXE
PID:3740

C:\Temp\ezxrpjgecz.sys
C:\Temp\ezxrpjgecz.sys
1⤵
- Executes dropped EXE
PID:4628

C:\Temp\hbzwrojhbz.sys
C:\Temp\hbzwrojhbz.sys
1⤵
PID:1152

C:\Temp\wtomgeywro.sys
C:\Temp\wtomgeywro.sys
1⤵
PID:4976

C:\Temp\tolgdyvtqo.sys
C:\Temp\tolgdyvtqo.sys
1⤵
PID:4820

C:\Temp\qlidbvtnli.sys
C:\Temp\qlidbvtnli.sys
1⤵
PID:3196

C:\Temp\kicauspnif.sys
C:\Temp\kicauspnif.sys
1⤵
PID:3512

C:\Temp\usqkivpnhf.sys
C:\Temp\usqkivpnhf.sys
1⤵
PID:3532

C:\Temp\xrpnkhczxr.sys
C:\Temp\xrpnkhczxr.sys
1⤵
PID:3272

C:\Temp\fzxrpjhbzu.sys
C:\Temp\fzxrpjhbzu.sys
1⤵
PID:3516

C:\Temp\ebwuomgeyw.sys
C:\Temp\ebwuomgeyw.sys
1⤵
PID:5996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bwuojhbztr.sys

Path C:\Temp\bwuojhbztr.sys
Size 293KB
SHA256 5f9ef7c2bb27e474054c195d7fbef75bca45b7466c891d05675badfd1c5ae935
MD5 cf008169da5f40973a3737d2219ea4f5
SHA1 3a5dc1a6f562ea563cb51b49a173c8823111cec6
SHA512 a660e922b206953df15a3f5b3fd42fd1cf3e5d6bd22d812ad17840b5651d049a994e466b0b81c39420539ce81a731eccf0d70deeb950e451699a0f2f4d228ba9
SSDEEP 3072:6tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:6IJjiJcbI03GBc3ucY5DCSj
TLSH
T11C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezrpjhbztr.exe

Path C:\Temp\ezrpjhbztr.exe
Size 361KB
SHA256 90d1399acc536fc4d2934059038ed81b2cd9c84538e3a4d090286d8fc46a3d68
MD5 ab1d1f5f6c195e668036e0291c44aff9
SHA1 4ed597d9a7cf99ba6a59dd001fb0cfa967ba958b
SHA512 cdc59c236ebb0e8b919df58370cd586f3fc38f39d9edd1a9339c8d7ab6ffde4ebbb2c88151df8c90269a85d83b9c4268567eb1da02d79d6a213d3b6c6271adc0
SSDEEP 6144:eflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:eflfAsiVGjSGecvX
TLSH
T19C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdbvtnljdb.exe

Path C:\Temp\gdbvtnljdb.exe
Size 361KB
SHA256 1010b2bbec61e474117b2e8a5487f099389a4286bf765a506ee109c952c3fb1f
MD5 baced55cf9dfce6cb8d5b754b9dacbf3
SHA1 4d68ccd9733d653a0d7a465d153566fe017051e3
SHA512 26a2a0ecb70c78fb80152ff3f0d74b34e2080716e16f230d304fdddaf6744592b4601a24bbd59084f1c62d9401b0a6d65cf21a99c9174438bfb37ce6d70022a8
SSDEEP 6144:6flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:6flfAsiVGjSGecvX
TLSH
T11D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ezrpjhbztr.exe

Path C:\Temp\i_ezrpjhbztr.exe
Size 361KB
SHA256 e3d645d585b6be1bdd06bc69373d4b0effd4a791a5ce5de1b2dec9daf3e9e505
MD5 aaa3440cdcf7bba7e4abf9bdc9e31bbb
SHA1 f38972d83e4999f86ef443ecf541bc30cc3545d7
SHA512 59a4b398c97931bafe753affd6db175573b2bb1f64e3e9a8de3f2741a2a17568e7a86fef867ce65e0966c494f28cd23741566cd6a22df2bdbba600cc46c51ee7
SSDEEP 6144:DflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:DflfAsiVGjSGecvX
TLSH
T1A1747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gdbvtnljdb.exe

Path C:\Temp\i_gdbvtnljdb.exe
Size 361KB
SHA256 7f2f61e4df3a33e551b8f2274113bc7ed1e97eea6a1127fde93c64b23e96742c
MD5 dcec49dd1c254c70bd5a8c78ad3f5231
SHA1 536a6c362444a3d419d5eec4de3a5873b1540848
SHA512 61c22e72a9fad30c5f4c678e1dd1bdd58aa3ee7f16731788d5e4821eecd1cbd7ecf0e85e6d221fe3bc4beadaa57e9523d58b33b9c8a1987203db09d4dadf82b0
SSDEEP 6144:qflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:qflfAsiVGjSGecvX
TLSH
T14A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oigbytrljg.exe

Path C:\Temp\i_oigbytrljg.exe
Size 361KB
SHA256 a84afa90694e92d4a53514fe6456c39d51640c30bcb94f5cac9c97a4c513d94e
MD5 ba64fb72f14f277684a032ab2494cb57
SHA1 b8eeace0d862a0435f5a87bbe27e85e6cc205a5b
SHA512 5465a85a1df1882b5374a1f0fb8a48dc401a21337f5e41276c04cfa47bb50e80ae29e99a52be77bd3234996d6e977938e2cc33d98bc3f5c9ad41ade88501c428
SSDEEP 6144:OflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:OflfAsiVGjSGecvX
TLSH
T121747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_upmhecwrpm.exe

Path C:\Temp\i_upmhecwrpm.exe
Size 361KB
SHA256 1fce15564d810329f9bac92db8c991b30e324bff3c0ff4fe7e589f82a20d3006
MD5 79e0ee5b8fe0241a599b55346366b417
SHA1 8fbcece93457a9773b1def3e65a021177448fdfc
SHA512 21c108a336da86e07d8cb66bf0e6e34ecdf821ac135c0eef9e85ce3c0c0f82f2b58e3625e193d5941898101556228c94fd1ff8e94f671ece16fc0f12b49e6e4c
SSDEEP 6144:6flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:6flfAsiVGjSGecvX
TLSH
T123747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrpjhbztrm.exe

Path C:\Temp\i_wrpjhbztrm.exe
Size 361KB
SHA256 e16c3e1c3968d4d9b70d4bd2c13f84445c0082266a22e1ee81110fd76eba298a
MD5 b89533500fa4c01b7864166d8734bdfb
SHA1 eac672b0d702a04c17c3624e6eeb345827da5427
SHA512 1f66bc9caa4113237d8849040edca67927e5d6b429e8bf368ef4dd3d5cc7cf8a535f8c8bc0ce5e6279dc6a98abbea4d34bcc6b8a9649055db57b10e487ba3fc0
SSDEEP 6144:/flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:/flfAsiVGjSGecvX
TLSH
T185747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvqnigaysq.exe

Path C:\Temp\i_yvqnigaysq.exe
Size 361KB
SHA256 e3b3bb000f75ab0653ae3b2ec7f99efe0d6288681a2e23c4c38329f7ad81121f
MD5 1524d56443823847ab68c863a6126c9d
SHA1 38659368dfb30c8f8bc211dbf5fad14d78c65de0
SHA512 5e93733ec44cc57ffd7f4b8753746ebbd877e7ceee38cad0d018f7a2249008685200ab2b460bf2957ff5f9a241bd06c502722ac6bc352a8b0ff3a7918e7b860e
SSDEEP 6144:wflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:wflfAsiVGjSGecvX
TLSH
T1ED747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idbvtnljdb.sys

Path C:\Temp\idbvtnljdb.sys
Size 293KB
SHA256 11d57e2b34736cc72b11cfb7a0b7b13a4b65a853fcbebc0c3fe2b5327c4674e9
MD5 06f734307ae03cabb73ada1c2ccef5bc
SHA1 a3f279cff847dc4eb1e26917dffb765612a6a8b7
SHA512 c2cfbf5c4e176cc411bfe2f4a326f6a031b787236ebd322722094d8f62860b135de198edf2dfc175e6b43a579f5ae94095344769202b21eba30a1d6d0d5701a6
SSDEEP 3072:ktKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:kIJjiJcbI03GBc3ucY5DCSj
TLSH
T178545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwusmkhczxupmk.exe

Path C:\Temp\kecwusmkhczxupmk.exe
Size 361KB
SHA256 10747bdd9bedcff6d511567b810cec75d660784b53070d585e90db3735a55ef5
MD5 8762d01b03dd221f5c621810c8e4ac06
SHA1 70f9a86b1abebd115ff517bc1dc6f07d4987c7c5
SHA512 9bf35f3ad6be95c7fa2ef38d68688d88e8a467ab6990dcf3e8b2839248c5c9e571cbb4fc52089b0941e5903c7be23be838c1489b7b8a2b791cb3919f9feb9dd0
SSDEEP 6144:GflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:GflfAsiVGjSGecvX
TLSH
T1DF747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwusmkhczxupmk.sys

Path C:\Temp\kecwusmkhczxupmk.sys
Size 293KB
SHA256 cc45cfaf87b1afe7a223d1140afa080f816c9d85abebe899c6e6915913504866
MD5 7f81723df18c3da9678b78b5afc18ffc
SHA1 cbcad959e44428ad75be6be91eb17f9e1d585a5f
SHA512 e94f478f87c583e7da09903788c8ff558e67165bc2d84176b6a3fd0860f0573f9ff82ddddfbfb7010e545657b6fbb5dbef5adc120b7b7ef2a735d1404967cb26
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T195545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbvtnlgd.sys

Path C:\Temp\ljdbvtnlgd.sys
Size 293KB
SHA256 56a110be7a420317d85d3c33eaee38be63f67b2fab1b3bcef681d3aea328b9f2
MD5 a24868f3d158e39e1405d99ffd6d890f
SHA1 0a489c7d947c707f0fb828d1d296dc9c87e24054
SHA512 dd74aebc84453b9c39619686ea9db3057e8197add5d54b206ca4583ca574191ce076518a69fb8745df1904b52f2fe2a3d067f3fe18839ddb8b42ee22ba6fe3f9
SSDEEP 3072:7tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9Ed9:7IJjiJcbI03GBc3ucY5DCSj
TLSH
T15F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigbytrljg.exe

Path C:\Temp\oigbytrljg.exe
Size 361KB
SHA256 9365f7b155150ba961946f052a21e607182264fff464ae8793150342306f73cf
MD5 64c60c51a596c35ce30c019cc1a12363
SHA1 c67e128a55119f9c186cdda63668add5032b5ed2
SHA512 b199a6df88323a939cf34c2ce4b938b79fd79e32179428f3c75bab21644cf3393c03be19d9b3ecefd123937da53f1a25e6c531ca0a8f6c9c6b3a6f4788983e3e
SSDEEP 6144:OflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:OflfAsiVGjSGecvX
TLSH
T18A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgbytqomg.sys

Path C:\Temp\ojgbytqomg.sys
Size 293KB
SHA256 5bc3d281e34236ed9765371c97f150762000f842f16516f9bd17720601a3d88b
MD5 a998e58f214ab555360b5266026d966f
SHA1 0577cf828f0dc931ba3b79912f007a2c545714ca
SHA512 497ca9dfd216cdbd869716f7a16fe5d4e0a2d831a4f0db3beaf287ec31bd42466c8a56151a390fec9021f57405de5c3aca602f7c9b7c8ea29270ca9768eaeba4
SSDEEP 3072:ltKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:lIJjiJcbI03GBc3ucY5DCSj
TLSH
T187545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhczurpj.sys

Path C:\Temp\rpjhczurpj.sys
Size 293KB
SHA256 9368d1369d543aebc1562468cb68d0a29219c202e8ddeba9c4fe77de46f93f02
MD5 e0a2761f494f531e1db326d8d5059fad
SHA1 75489a783e3ed1d3b3cec3f2a8ef2b8367d2209c
SHA512 cb641473dd69f2ac66a38cf8ab39d5369b87a1fc450303f8f03a7e9e0be7d89d37dbac0b5af26512f346e28e94dba7b1f143bad560b9a12543c5768d32f1580e
SSDEEP 3072:btKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:bIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upmhecwrpm.exe

Path C:\Temp\upmhecwrpm.exe
Size 361KB
SHA256 914d0a8e64381c142e90b5acaa8f3e3dfd2c748866a297560cde5e33596733b8
MD5 48bf662ae68a647944cb6a48ec25f700
SHA1 16bc0f09b6a643762834c15b346c2a7d8e398f4b
SHA512 828e17b045e57545a81583cff00a21a3acfa48fecadab66c64ed8ebd4f3464040e64203e1a43c01b9c034a9e4a13e31328de5cbdfbc96fa8172f05f4fee493e7
SSDEEP 6144:6flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:6flfAsiVGjSGecvX
TLSH
T17D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrpjhbztrm.exe

Path C:\Temp\wrpjhbztrm.exe
Size 361KB
SHA256 e69d68df8c731c63a27efc65b41519c475d226c8b7aee29800a33c905c84a790
MD5 51fd5bacb2ac0c8de4be5e67f98a382f
SHA1 8865182357392b33922665a94a00a6e1519fb847
SHA512 9541e29170584bf885078e3a7499e41f281db33d5805fdf511ba94ff16c17392e72341f0a9a588012c0f16f850ed6e9b9ca727a0af00c547b0d622cd520c6a73
SSDEEP 6144:XflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:XflfAsiVGjSGecvX
TLSH
T1A8747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqnigaysq.exe

Path C:\Temp\yvqnigaysq.exe
Size 361KB
SHA256 bfcf0544cdf67aa30e6fcfe14764af0c0d94fa49919d9fcf5e4e127fa27b8b93
MD5 80ac54e4ebf2afb71a7dba33802526a8
SHA1 4b2acc26f1fe798da07a0b8f40043041bc3acc53
SHA512 ddb08cff6dabd9d5f0acad2757d6e3906b7e0274e2dd0844961a4b955c07a07a7291179d922c866f652a31e29525b9f5e17e85902fac9751f9332bd44f471698
SSDEEP 6144:pflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:pflfAsiVGjSGecvX
TLSH
T17F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9ee8b00c5eccab84404f41fa5a938e6b9e2129213bd97cde6c60973bfccf9540
MD5 0a273f57544ca9c385c90abd2fb2f8b8
SHA1 663d351037054236aaa58a924f66180602045244
SHA512 8a731bd22460fb3b026847be48aab957fe90f0ad7e2dcb291305580f3553409cfdff67355886d3d2f95cd8f8ff1d2726447bc2b96bce2cdcc51a8a15cbcb9d0c
TLSH
T1CFD0C010324DB00CC040203214210360F2309610602B47084020F02CCC78DA173466CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85900118c71217b605d5ac64fa104d9bdf3a2ae1825187ef3a6a9c3ea75946b8
MD5 b694af012c621426ee8e90a8ed586333
SHA1 e839cf90b93d2693f8046fc19ae1373628f0cf99
SHA512 b9142bc76c532d8974de0c5db727ec4870a44225dc222a9fdc138b1278d0f4cb8cef786ed6b936ee6b436177a50e31c07b489d69dd8d25de345ea17638a55e56
TLSH
T188D08055364DB40CC151253254615365F6749651B42B57185460B01CDC78DA173576DF
MD5 SHA1 SHA512 TLSH

Submit Download

0633283d-b4f7-4242-9afc-a60009a3370f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0633283d-b4f7-4242-9afc-a60009a3370f.tmp
Size 32KB
SHA256 a5cfa18283fc90788cb554427dc409a32a0c430a0dc6688bed23fa64b472db36
MD5 95255b7c998914a1411f1be2c4d7c7dc
SHA1 a8024f285db2fbc66c885d70005229de69d9a0e9
SHA512 8bb9cd7db1861a588038318e5a84db6bdaa2fc81ad55f777e36e7376da25945d84603f5a1ac07336b1c41b3c5d09292ef6ca321af32e1c5b0d1edfd242d79dd2
SSDEEP 768:JOVPHO7pLuL7E1WgesfvQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUmjPE+WroXIh5C:JOVPHOE7E1WgesfvQu1jaXmjc+ti5C
TLSH
T14BE2FB3B680CCB7E4F804ADDE82D7D9E6DE802CB56D8CD5447EA840C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 88b60bf2e87328c78c6589cd930dea62a93f052fa6a174c8bad42f3a990614f2
MD5 d07f55354d151d92f45dce3fced414c8
SHA1 70c19b752bf7c8f9df23491a522184b3134f09ac
SHA512 001b839c4eada756f9a871424c0db5b507d91b25552b9eb6a010eb82c89dd6f5edc3f49938ffe135825519124cb882b8e1ed30594c73cc049ecb7452df37b289
TLSH
T138517514E2758EA2C761013F06D1C6FA337A868642876E3CD194F1F4FD3AB5EE0B1090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595bd2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595bd2.TMP
Size 3KB
SHA256 9363e50c94a2d0afa13333e0427e3014bc9f42921bdc39b17f3b64326a94eaff
MD5 4d15d7316c3e90a84ad2af0ff03e528d
SHA1 6ac292ce05dd5817db9cb055d315f416be9c0397
SHA512 ef6a4414c721a808f8526e1485b7ab9e34d35a5e4485fac94b163c6019f2fda9383727c3eca07b416e7a9774a9937921a26c54be61279106b52557c5b9afd3a8
TLSH
T170517515E6758EA1C761013F06D1C6F6337A828642876E3CD198F1F4FD3AB5EE0B1090
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 00f3d8f68f2a2cf779448400390d25363ae097485d9573c56e969a7d56c21047
MD5 73bf396c98de710c0c5f45642d5f79b2
SHA1 069fc549a6598f9452f034cc198fa4544d6f2fcb
SHA512 942ce9dba3abf089c065f5902b10a31a956a263017dd8fed065132001f0922c0cb56645abf186569efefcf320df45bae52d6fa9d23c41e5ddda3c0d266956c4c
TLSH
T14851ABF783E8866EC91156F0AA187E1BCE1D0914832C3D5AC9E4AF1B93E3471E145A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c96d60fb019b7d5dc9ad05ef3a9e3bfba75fedef5428c01e00d003e1ad73fd98
MD5 27af53b193aac4919be16411e8f77207
SHA1 d822ce2c523d6f02d1fda48d7aa6063fede159ad
SHA512 7067ab0670cca17a2bb3f5fd1fbe735c9596d3200f01a1a7203a641c5dd58239e40c815a9e43b6d9442af2c1192ea7b949b4c75cde213cff38e92fde2992db2a
SSDEEP 192:sxR1RZyM/jK1Ml8wc2/fks2tJsZkKHgzoA8p9k/g6+WNCgw/YH9HMwGnIgtJ:sxR1dC2/fkskJSkiZW/5O/6k3
TLSH
T16262D8166A3869378CDBD209FA557B53D6FC0563A2951E44AEFC8A0C01E76ED221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 cc6402b7b44002008a0c121323f3ffa11fe7111e1a976752bcbe6a3a39347306
MD5 eda78f6c53de2fca70719af2d0a9903c
SHA1 1529c2766ba16d1539d7b2c7a68f40be5d039472
SHA512 b9c4875c2708a44ae3b0ad0b2fabb314fef934f19b43c0ce91ff8ba06987a6a816b5649c5c035113f130317a059a0a54431cc4a64acfe773f3e56626cd4b20de
SSDEEP 192:sxRGRZyM/jK1Ml8wc2/fks7tJsZkKHgzoA8p9k/g6+WNCgw/YH9HMwGnIgDuJ:sxRGdC2/fksxJSkiZW/5O/6kO
TLSH
T12C62D816AA3869378CDBD209FA557B53D6FC0573A2951E44ADFC8A0C01E76ED221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a6d3bc0e1d16e751f8966eb4f00282a42315e1005dc03372bb06b3ba62f72573
MD5 f94c31b84ca06cae602ac205e507afd9
SHA1 ea08573a48bc0eadb9e7d8c790bd004e4a40acf6
SHA512 4c530afb6d6d6c1e5a47578bc012ca182ea9c7d69d7bbbcf4f45d0d561ad6be193555de1a8dab1f15dff97865ac99b2d33bbfc3611f73726780888b7722b7c16
SSDEEP 192:sxRGRZyM/jK1Ml8UQvc2/fks7tJsZkKHgzoA8prk/g6+WNCgw/YHxHMwGnIgDuJ:sxRGdqk2/fksxJSkiZg/5O/okO
TLSH
T10662D816AA386937CCDBD209FA957B53D6F80573A2951E44ADFC8A0C01E76DD221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59f8ae.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59f8ae.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 403d81cf38034b0eafd18d8e43f406a7189401f0de7818cbcd5e3af329017595
MD5 6f74bd9136aa15ee58ddaf4218a15ab7
SHA1 d5892a59efb733304c8ee07325d91cc7fc90002f
SHA512 51cf48b1f0c35ebc45c8ecc6944377baf0c706fc98017578fab9288db90e95b40306a23697245db20a04f958ca71f8def6521b1c00785363ee9d4d6486f5ba7d
SSDEEP 768:6j+9A3X3t9R2ByTFFPYyDPm6MGjzJU/zn12bfF:59A3XZoAHQyDnMiOByF
TLSH
T167F2BF319CA5AE731CE3C68A764B3BC7AFE451A385850E88D9D94F4E02C7B5D130B866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 46d19626b8bf73fb55a2e09bb7232002d5683b3532bd57ee5136fa15741ec930
MD5 dbe68a4338202b37b0475993b0ef8a10
SHA1 d1f1cb9011d8acd91ddebc0d2b84e6821bf62706
SHA512 ea20a7954fef9581dee1a13ced42dc68272cdf233be199a56ba6181c03d85fcb3c284fa0718a6aff898cb16427dca751e78b1f082535fb33fd259b201a576306
SSDEEP 768:Vrv+4UNbdl3uPR2ByTDPYyDPm6MGjzJ84+8rY0n:Vbsbn3goADQyDnMi5DrY6
TLSH
T19903C0319CA46A736CF2CA85364B3B477FF4919396C40F8499DA1F4D429F96D130B8A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 753d16959f6f02b4cc47f0b5e196ace601a62eabf4883dcd10133875ef55d414
MD5 b442ca673093d32c33b48cc66c7120d5
SHA1 5cb8b137a40a76e1f2e898b5d7c5d265ba6a3e0d
SHA512 2fd99e1157b229f1fb22beb21b9c82132def22e977fc7754dabf878e29b2302baa886518b8f017fffbd0d372ee8f55fc67ae32c4f4026727499e798052bfa0d9
SSDEEP 768:NF1j+9A30wgp3DxRByTFFPYyDPm6MGjzJU/zn12bfF:E9A3GJAvQyDnMiOByF
TLSH
T1EC1328F198D39A36D8AE8787677E2E469EBCC193B1841984B7C44D4DCC8767FC30A851
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

2ea944d7-c363-4fdd-abb5-b92fa78a1868.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2ea944d7-c363-4fdd-abb5-b92fa78a1868.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1680_2102288261\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 ef25cc5626251e5e5aa52490cdf237c9588884fe73b9c6dd3fdc59458974656d
MD5 d701d4e00e6416edfae565a9b13a5871
SHA1 818f35ea9ba38e7372c32c2f0231f6a56bb15e09
SHA512 ad0afcac9fb9f83efb965277c681280ff1d7d1c8d18473e499a7c6d4d54130b4e5f47a46625f8387cdf140edbe44525b1baaca608a107741ba0afd8e871d4767
TLSH
T1C171238356B9C9B2C5DA5FF002835604F6FB2338077330604B55554AAB30A7E54B9F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1152-386-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1384-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1392-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1948-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2336-299-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3196-427-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3272-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3440-329-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3512-431-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3516-459-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3532-436-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3740-375-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3740-348-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4628-373-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4664-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4820-407-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4976-391-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5660-197-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5768-244-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5840-284-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5996-479-0x0000000000010000-0x00000000000AB000-memory.dmp

Download