systex | 8a2b1661a1a70bba027be9d8363d02f55dc23a70bcd5cbebf8c12c2e6556483c

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 16:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260721-t4ampace68
SHA256 8a2b1661a1a70bba027be9d8363d02f55dc23a70bcd5cbebf8c12c2e6556483c
MD5 d1cafe7b1c5d2b193ad720fdfff8c8db
SHA1 ff5edd893393dbf323e4f26ecb70a9d656871a02
SHA512 4d4a5867c72b185b279c15a546f89ca988dda563962bc6c7ff8e6c4cad0527932d39a64c8d034cd04b151dc1e23bffb171cf6992c277d2ab33ba17c0ccc8382a
SSDEEP 6144:AflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:AflfAsiVGjSGecvX
TLSH
T142747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
6520	cwuomhezxupmhezx.exe
6928	cwuomhezxupmhezx.sys
6232	CreateProcess.exe
7084	ecwurmhfzx.exe
7124	CreateProcess.exe
2584	CreateProcess.exe
2028	i_ecwurmhfzx.exe
2988	zwrpmhezwr.sys
3528	CreateProcess.exe
4652	uomjeywuom.exe
1724	CreateProcess.exe
2716	CreateProcess.exe
5160	i_uomjeywuom.exe
5780	ywtoljebzt.sys
4732	CreateProcess.exe
2916	zwrlgdbwqo.exe
2104	CreateProcess.exe
3292	CreateProcess.exe
7100	i_zwrlgdbwqo.exe
2984	toljgbytqo.sys
3952	CreateProcess.exe
1260	ljdbvtnlgd.exe
1756	CreateProcess.exe
5752	CreateProcess.exe
5340	i_ljdbvtnlgd.exe
428	jdbvtqlgdy.sys
6956	CreateProcess.exe
6960	ysqlidbvtn.exe
3332	CreateProcess.exe
6720	CreateProcess.exe
6236	i_ysqlidbvtn.exe
6712	qlicaysqni.sys
5892	CreateProcess.exe
5984	nifaysqkid.exe
5128	CreateProcess.exe
6696	CreateProcess.exe
4840	i_nifaysqkid.exe
3972	khfausnkif.sys
4608	CreateProcess.exe
5040	icxvpkicau.exe
1320	CreateProcess.exe
3832	CreateProcess.exe
4816	i_icxvpkicau.exe
4984	sqkicauspn.sys
1644	CreateProcess.exe
5744	nkecaurpnk.exe
5360	CreateProcess.exe
4956	CreateProcess.exe
4248	i_nkecaurpnk.exe
4804	ausmkecaus.sys
7136	CreateProcess.exe
7076	smkhcaupmh.exe
5828	CreateProcess.exe
2372	CreateProcess.exe
5812	i_smkhcaupmh.exe
6028	pjhczurmke.sys
1172	CreateProcess.exe
5284	keczurmkez.exe
5876	CreateProcess.exe
6192	CreateProcess.exe
6756	i_keczurmkez.exe
6852	gebztrojhb.sys
3420	CreateProcess.exe
1356	jhbztrljeb.exe

Loads dropped DLL 1 IoCs

pid	Process
6772	msedge.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6772_946444150\us_tv_and_film.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6772_1890193357\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6772_1890193357\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6772_1471983199\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6772_1471983199\well_known_domains.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6772_946444150\female_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6772_946444150\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6772_946444150\passwords.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6772_946444150\surnames.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6772_946444150\english_wikipedia.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6772_946444150\male_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6772_946444150\model.markov	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6772_946444150\ranked_dicts	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6772_946444150\test.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkhcaupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvqnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljytqljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqnicays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomhezxupmhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwurmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvqnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomjeywuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrlgdbwqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkecaurpnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keczurmkez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljytqljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmkifzxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkhcaupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgavqnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeywtrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomjeywuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrlgdbwqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_keczurmkez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqnicays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkecaurpnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgavqnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmkifzxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xurpkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icxvpkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xurpkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkecwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgeywtrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwurmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icxvpkicau.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1964	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6096	ipconfig.exe
2552	ipconfig.exe
5516	ipconfig.exe
1196	ipconfig.exe
5044	ipconfig.exe
1220	ipconfig.exe
1988	ipconfig.exe
1192	ipconfig.exe
5064	ipconfig.exe
5416	ipconfig.exe
5032	ipconfig.exe
5568	ipconfig.exe
3260	ipconfig.exe
2532	ipconfig.exe
1416	ipconfig.exe
6656	ipconfig.exe
1112	ipconfig.exe
6464	ipconfig.exe
5096	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291253852027899"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{C4954EFA-FF5B-4AAB-A28D-7A2C062472D1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6520	cwuomhezxupmhezx.exe
6520	cwuomhezxupmhezx.exe
6520	cwuomhezxupmhezx.exe
6520	cwuomhezxupmhezx.exe
6520	cwuomhezxupmhezx.exe
6520	cwuomhezxupmhezx.exe
6520	cwuomhezxupmhezx.exe
6520	cwuomhezxupmhezx.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
6772	msedge.exe
6772	msedge.exe
6772	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2028	i_ecwurmhfzx.exe
Token: SeDebugPrivilege	5160	i_uomjeywuom.exe
Token: SeDebugPrivilege	7100	i_zwrlgdbwqo.exe
Token: SeDebugPrivilege	5340	i_ljdbvtnlgd.exe
Token: SeDebugPrivilege	6236	i_ysqlidbvtn.exe
Token: SeDebugPrivilege	4840	i_nifaysqkid.exe
Token: SeDebugPrivilege	4816	i_icxvpkicau.exe
Token: SeDebugPrivilege	4248	i_nkecaurpnk.exe
Token: SeDebugPrivilege	5812	i_smkhcaupmh.exe
Token: SeDebugPrivilege	6756	i_keczurmkez.exe
Token: SeDebugPrivilege	1300	i_jhbztrljeb.exe
Token: SeDebugPrivilege	2876	i_ljytqljdbw.exe
Token: SeDebugPrivilege	3868	i_jgavqnlgdy.exe
Token: SeDebugPrivilege	3736	i_dxvqnlfdxv.exe
Token: SeDebugPrivilege	2912	i_aysqnicays.exe
Token: SeDebugPrivilege	6028	i_upmkifzxup.exe
Token: SeDebugPrivilege	5884	i_xurpkhcaus.exe
Token: SeDebugPrivilege	5016	i_urmkecwrpj.exe
Token: SeDebugPrivilege	5088	i_jgeywtrpjh.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6772	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5452 wrote to memory of 6520	5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 5452 wrote to memory of 2412	5452	2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	91
PID 2412 wrote to memory of 6772	2412	iexplore.exe	92
PID 6772 wrote to memory of 6688	6772	msedge.exe	93
PID 6772 wrote to memory of 4368	6772	msedge.exe	94
PID 6772 wrote to memory of 1964	6772	msedge.exe	95
PID 6772 wrote to memory of 4368	6772	msedge.exe	94
PID 6772 wrote to memory of 4368	6772	msedge.exe	94
PID 6772 wrote to memory of 3416	6772	msedge.exe	96
PID 6772 wrote to memory of 3416	6772	msedge.exe	96
PID 6772 wrote to memory of 6476	6772	msedge.exe	97
PID 6772 wrote to memory of 6476	6772	msedge.exe	97
PID 6772 wrote to memory of 6476	6772	msedge.exe	97
PID 6772 wrote to memory of 3568	6772	msedge.exe	98
PID 6772 wrote to memory of 3568	6772	msedge.exe	98
PID 6772 wrote to memory of 3568	6772	msedge.exe	98
PID 6520 wrote to memory of 6232	6520	cwuomhezxupmhezx.exe	102
PID 6772 wrote to memory of 3348	6772	msedge.exe	104
PID 6772 wrote to memory of 2740	6772	msedge.exe	105
PID 6772 wrote to memory of 3348	6772	msedge.exe	104
PID 6772 wrote to memory of 2740	6772	msedge.exe	105
PID 7084 wrote to memory of 7124	7084	ecwurmhfzx.exe	107
PID 6772 wrote to memory of 292	6772	msedge.exe	111
PID 6520 wrote to memory of 2584	6520	cwuomhezxupmhezx.exe	114
PID 6520 wrote to memory of 3528	6520	cwuomhezxupmhezx.exe	118
PID 4652 wrote to memory of 1724	4652	uomjeywuom.exe	120
PID 6520 wrote to memory of 2716	6520	cwuomhezxupmhezx.exe	123
PID 6520 wrote to memory of 4732	6520	cwuomhezxupmhezx.exe	127
PID 2916 wrote to memory of 2104	2916	zwrlgdbwqo.exe	129
PID 6520 wrote to memory of 3292	6520	cwuomhezxupmhezx.exe	132
PID 6520 wrote to memory of 3952	6520	cwuomhezxupmhezx.exe	137
PID 1260 wrote to memory of 1756	1260	ljdbvtnlgd.exe	139
PID 6520 wrote to memory of 5752	6520	cwuomhezxupmhezx.exe	142
PID 6772 wrote to memory of 3420	6772	msedge.exe	144
PID 6772 wrote to memory of 1100	6772	msedge.exe	145
PID 6772 wrote to memory of 2408	6772	msedge.exe	146
PID 6520 wrote to memory of 6956	6520	cwuomhezxupmhezx.exe	149
PID 6960 wrote to memory of 3332	6960	ysqlidbvtn.exe	151
PID 6520 wrote to memory of 6720	6520	cwuomhezxupmhezx.exe	154
PID 6520 wrote to memory of 5892	6520	cwuomhezxupmhezx.exe	158
PID 5984 wrote to memory of 5128	5984	nifaysqkid.exe	160
PID 6520 wrote to memory of 6696	6520	cwuomhezxupmhezx.exe	163
PID 6520 wrote to memory of 4608	6520	cwuomhezxupmhezx.exe	167
PID 5040 wrote to memory of 1320	5040	icxvpkicau.exe	169
PID 6520 wrote to memory of 3832	6520	cwuomhezxupmhezx.exe	172
PID 6520 wrote to memory of 1644	6520	cwuomhezxupmhezx.exe	176
PID 5744 wrote to memory of 5360	5744	nkecaurpnk.exe	178
PID 6520 wrote to memory of 4956	6520	cwuomhezxupmhezx.exe	181
PID 6772 wrote to memory of 5096	6772	msedge.exe	183
PID 6772 wrote to memory of 5096	6772	msedge.exe	183
PID 6520 wrote to memory of 7136	6520	cwuomhezxupmhezx.exe	188
PID 7076 wrote to memory of 5828	7076	smkhcaupmh.exe	190
PID 6520 wrote to memory of 2372	6520	cwuomhezxupmhezx.exe	193
PID 6520 wrote to memory of 1172	6520	cwuomhezxupmhezx.exe	197
PID 5284 wrote to memory of 5876	5284	keczurmkez.exe	199
PID 6520 wrote to memory of 6192	6520	cwuomhezxupmhezx.exe	202
PID 6520 wrote to memory of 3420	6520	cwuomhezxupmhezx.exe	206
PID 1356 wrote to memory of 6456	1356	jhbztrljeb.exe	208
PID 6520 wrote to memory of 5268	6520	cwuomhezxupmhezx.exe	211
PID 6772 wrote to memory of 6184	6772	msedge.exe	213
PID 6772 wrote to memory of 6184	6772	msedge.exe	213
PID 6520 wrote to memory of 612	6520	cwuomhezxupmhezx.exe	216
PID 6344 wrote to memory of 4080	6344	ljytqljdbw.exe	218
PID 6520 wrote to memory of 6236	6520	cwuomhezxupmhezx.exe	221

C:\Users\Admin\AppData\Local\Temp\2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_d1cafe7b1c5d2b193ad720fdfff8c8db_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5452
- C:\Temp\cwuomhezxupmhezx.exe
  C:\Temp\cwuomhezxupmhezx.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwurmhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6232
  - - C:\Temp\ecwurmhfzx.exe
      C:\Temp\ecwurmhfzx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:7084
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:7124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwurmhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2584
  - - C:\Temp\i_ecwurmhfzx.exe
      C:\Temp\i_ecwurmhfzx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomjeywuom.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3528
  - - C:\Temp\uomjeywuom.exe
      C:\Temp\uomjeywuom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4652
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1724
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomjeywuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2716
  - - C:\Temp\i_uomjeywuom.exe
      C:\Temp\i_uomjeywuom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwrlgdbwqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4732
  - - C:\Temp\zwrlgdbwqo.exe
      C:\Temp\zwrlgdbwqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2916
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2104
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwrlgdbwqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3292
  - - C:\Temp\i_zwrlgdbwqo.exe
      C:\Temp\i_zwrlgdbwqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:7100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbvtnlgd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3952
  - - C:\Temp\ljdbvtnlgd.exe
      C:\Temp\ljdbvtnlgd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1260
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbvtnlgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5752
  - - C:\Temp\i_ljdbvtnlgd.exe
      C:\Temp\i_ljdbvtnlgd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqlidbvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6956
  - - C:\Temp\ysqlidbvtn.exe
      C:\Temp\ysqlidbvtn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3332
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqlidbvtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6720
  - - C:\Temp\i_ysqlidbvtn.exe
      C:\Temp\i_ysqlidbvtn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nifaysqkid.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5892
  - - C:\Temp\nifaysqkid.exe
      C:\Temp\nifaysqkid.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5984
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5128
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nifaysqkid.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6696
  - - C:\Temp\i_nifaysqkid.exe
      C:\Temp\i_nifaysqkid.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icxvpkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4608
  - - C:\Temp\icxvpkicau.exe
      C:\Temp\icxvpkicau.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5040
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1320
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icxvpkicau.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3832
  - - C:\Temp\i_icxvpkicau.exe
      C:\Temp\i_icxvpkicau.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkecaurpnk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1644
  - - C:\Temp\nkecaurpnk.exe
      C:\Temp\nkecaurpnk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5744
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5360
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkecaurpnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4956
  - - C:\Temp\i_nkecaurpnk.exe
      C:\Temp\i_nkecaurpnk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkhcaupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:7136
  - - C:\Temp\smkhcaupmh.exe
      C:\Temp\smkhcaupmh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:7076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5828
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkhcaupmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2372
  - - C:\Temp\i_smkhcaupmh.exe
      C:\Temp\i_smkhcaupmh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\keczurmkez.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1172
  - - C:\Temp\keczurmkez.exe
      C:\Temp\keczurmkez.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5284
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5876
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_keczurmkez.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6192
  - - C:\Temp\i_keczurmkez.exe
      C:\Temp\i_keczurmkez.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbztrljeb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3420
  - - C:\Temp\jhbztrljeb.exe
      C:\Temp\jhbztrljeb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1356
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbztrljeb.exe ups_ins
    3⤵
    PID:5268
  - - C:\Temp\i_jhbztrljeb.exe
      C:\Temp\i_jhbztrljeb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljytqljdbw.exe ups_run
    3⤵
    PID:612
  - - C:\Temp\ljytqljdbw.exe
      C:\Temp\ljytqljdbw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6344
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4080
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljytqljdbw.exe ups_ins
    3⤵
    PID:6236
  - - C:\Temp\i_ljytqljdbw.exe
      C:\Temp\i_ljytqljdbw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgavqnlgdy.exe ups_run
    3⤵
    PID:1440
  - - C:\Temp\jgavqnlgdy.exe
      C:\Temp\jgavqnlgdy.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5032
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3464
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgavqnlgdy.exe ups_ins
    3⤵
    PID:5944
  - - C:\Temp\i_jgavqnlgdy.exe
      C:\Temp\i_jgavqnlgdy.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvqnlfdxv.exe ups_run
    3⤵
    PID:4332
  - - C:\Temp\dxvqnlfdxv.exe
      C:\Temp\dxvqnlfdxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4752
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1596
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvqnlfdxv.exe ups_ins
    3⤵
    PID:5056
  - - C:\Temp\i_dxvqnlfdxv.exe
      C:\Temp\i_dxvqnlfdxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqnicays.exe ups_run
    3⤵
    PID:6112
  - - C:\Temp\aysqnicays.exe
      C:\Temp\aysqnicays.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6120
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6348
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqnicays.exe ups_ins
    3⤵
    PID:5460
  - - C:\Temp\i_aysqnicays.exe
      C:\Temp\i_aysqnicays.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upmkifzxup.exe ups_run
    3⤵
    PID:3188
  - - C:\Temp\upmkifzxup.exe
      C:\Temp\upmkifzxup.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3608
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4128
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upmkifzxup.exe ups_ins
    3⤵
    PID:3484
  - - C:\Temp\i_upmkifzxup.exe
      C:\Temp\i_upmkifzxup.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xurpkhcaus.exe ups_run
    3⤵
    PID:6016
  - - C:\Temp\xurpkhcaus.exe
      C:\Temp\xurpkhcaus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5512
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6500
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xurpkhcaus.exe ups_ins
    3⤵
    PID:4484
  - - C:\Temp\i_xurpkhcaus.exe
      C:\Temp\i_xurpkhcaus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmkecwrpj.exe ups_run
    3⤵
    PID:2176
  - - C:\Temp\urmkecwrpj.exe
      C:\Temp\urmkecwrpj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6472
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6528
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmkecwrpj.exe ups_ins
    3⤵
    PID:4272
  - - C:\Temp\i_urmkecwrpj.exe
      C:\Temp\i_urmkecwrpj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgeywtrpjh.exe ups_run
    3⤵
    PID:6892
  - - C:\Temp\jgeywtrpjh.exe
      C:\Temp\jgeywtrpjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:7128
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2476
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgeywtrpjh.exe ups_ins
    3⤵
    PID:3160
  - - C:\Temp\i_jgeywtrpjh.exe
      C:\Temp\i_jgeywtrpjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zljdbwtoig.exe ups_run
    3⤵
    PID:5772
  - - C:\Temp\zljdbwtoig.exe
      C:\Temp\zljdbwtoig.exe ups_run
      4⤵
      PID:3684
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ff9601ec188,0x7ff9601ec194,0x7ff9601ec1a0
      4⤵
      PID:6688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,6816265014879326866,11300436678948287033,262144 --field-trial-handle=2292,i,15748322893723233031,6424231438687159293,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
      4⤵
      PID:4368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,1740276924421803776,11123832345848814651,524288 --field-trial-handle=2292,i,15748322893723233031,6424231438687159293,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:11
      4⤵
      System Time Discovery
      PID:1964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,16429078873564027444,17202170353987979142,524288 --field-trial-handle=2292,i,15748322893723233031,6424231438687159293,262144 --variations-seed-version --mojo-platform-channel-handle=3344 /prefetch:13
      4⤵
      PID:3416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,17073283960845076431,14404691182135151512,2097152 --field-trial-handle=2292,i,15748322893723233031,6424231438687159293,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:6476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,11657381493557005193,8664339280041547139,2097152 --field-trial-handle=2292,i,15748322893723233031,6424231438687159293,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:3568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,13359516273137393780,11757356087139178124,524288 --field-trial-handle=2292,i,15748322893723233031,6424231438687159293,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
      4⤵
      PID:3348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,16283641818885712989,5187361091761592628,524288 --field-trial-handle=2292,i,15748322893723233031,6424231438687159293,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
      4⤵
      PID:2740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,7270938623850011429,4118370987328586247,524288 --field-trial-handle=2292,i,15748322893723233031,6424231438687159293,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
      4⤵
      PID:5892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,7270938623850011429,4118370987328586247,524288 --field-trial-handle=2292,i,15748322893723233031,6424231438687159293,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
      4⤵
      PID:292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,9404333967152005971,9120248098120569524,524288 --field-trial-handle=2292,i,15748322893723233031,6424231438687159293,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
      4⤵
      PID:3420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,13162121522523302545,18116995395176471981,524288 --field-trial-handle=2292,i,15748322893723233031,6424231438687159293,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
      4⤵
      PID:1100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,12282778304016258122,13848551769384235960,524288 --field-trial-handle=2292,i,15748322893723233031,6424231438687159293,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
      4⤵
      PID:2408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,11186280174085109395,6791996605578231418,524288 --field-trial-handle=2292,i,15748322893723233031,6424231438687159293,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
      4⤵
      PID:5096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2740,i,16765142493782567074,5190993595820278585,524288 --field-trial-handle=2292,i,15748322893723233031,6424231438687159293,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
      4⤵
      PID:6184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,14614390247493432135,8205196108328999037,524288 --field-trial-handle=2292,i,15748322893723233031,6424231438687159293,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:14
      4⤵
      PID:1992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6604,i,17861465971996725297,10628254361367332178,262144 --field-trial-handle=2292,i,15748322893723233031,6424231438687159293,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:10
      4⤵
      PID:5968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,4740972080576624577,13541838309032002650,524288 --field-trial-handle=2292,i,15748322893723233031,6424231438687159293,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
      4⤵
      PID:7008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6960

C:\Temp\cwuomhezxupmhezx.sys
C:\Temp\cwuomhezxupmhezx.sys
1⤵
- Executes dropped EXE
PID:6928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4288

C:\Temp\zwrpmhezwr.sys
C:\Temp\zwrpmhezwr.sys
1⤵
- Executes dropped EXE
PID:2988

C:\Temp\ywtoljebzt.sys
C:\Temp\ywtoljebzt.sys
1⤵
- Executes dropped EXE
PID:5780

C:\Temp\toljgbytqo.sys
C:\Temp\toljgbytqo.sys
1⤵
- Executes dropped EXE
PID:2984

C:\Temp\jdbvtqlgdy.sys
C:\Temp\jdbvtqlgdy.sys
1⤵
- Executes dropped EXE
PID:428

C:\Temp\qlicaysqni.sys
C:\Temp\qlicaysqni.sys
1⤵
- Executes dropped EXE
PID:6712

C:\Temp\khfausnkif.sys
C:\Temp\khfausnkif.sys
1⤵
- Executes dropped EXE
PID:3972

C:\Temp\sqkicauspn.sys
C:\Temp\sqkicauspn.sys
1⤵
- Executes dropped EXE
PID:4984

C:\Temp\ausmkecaus.sys
C:\Temp\ausmkecaus.sys
1⤵
- Executes dropped EXE
PID:4804

C:\Temp\pjhczurmke.sys
C:\Temp\pjhczurmke.sys
1⤵
- Executes dropped EXE
PID:6028

C:\Temp\gebztrojhb.sys
C:\Temp\gebztrojhb.sys
1⤵
- Executes dropped EXE
PID:6852

C:\Temp\rojhbztrlj.sys
C:\Temp\rojhbztrlj.sys
1⤵
PID:6924

C:\Temp\olgdywqoig.sys
C:\Temp\olgdywqoig.sys
1⤵
PID:6892

C:\Temp\ifdyvqoiga.sys
C:\Temp\ifdyvqoiga.sys
1⤵
PID:4288

C:\Temp\aysqkicavs.sys
C:\Temp\aysqkicavs.sys
1⤵
PID:4740

C:\Temp\fdxvpnifax.sys
C:\Temp\fdxvpnifax.sys
1⤵
PID:6876

C:\Temp\cxupmkhfzx.sys
C:\Temp\cxupmkhfzx.sys
1⤵
PID:2264

C:\Temp\xupmhfzxrm.sys
C:\Temp\xupmhfzxrm.sys
1⤵
PID:5916

C:\Temp\mjebwtrpjh.sys
C:\Temp\mjebwtrpjh.sys
1⤵
PID:4528

C:\Temp\bwtomgebwu.sys
C:\Temp\bwtomgebwu.sys
1⤵
PID:4196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cwuomhezxupmhezx.exe

Path C:\Temp\cwuomhezxupmhezx.exe
Size 361KB
SHA256 1930f318aa103290d1f13dbf74caab8202bde0c4fc73857ada30f001451de6f9
MD5 59bcc12466ca318ebb59bb6484b1746a
SHA1 2c00332ab03efb09a08e3508c7c848caa25f7b19
SHA512 f647e4fc65461bb1bfb7420888bd1861b3f8c0de39e4d8a5385643f7f51807f30d93212a86ea832f5b46e45edd0601775fa246dd1a47721310a81ad4e3e48d9c
SSDEEP 6144:2flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:2flfAsiVGjSGecvX
TLSH
T14A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwuomhezxupmhezx.sys

Path C:\Temp\cwuomhezxupmhezx.sys
Size 293KB
SHA256 38f49eedf36ea23b6a988e47d00af1714ffd2ffc1460c67aece4d842628f1670
MD5 50a247f0b6a2245dd307637dd24acd9f
SHA1 c1755fcf7fd30a707b2595595892dabf64e4c4e7
SHA512 52fc258b2da2428c050e18137d561659397ed2fc140ec07b489cf22fcc148581f8f29a26cd70859f4a4d7a55beca048a45c5899388b4a19fa79abf57e8aafa89
SSDEEP 3072:StKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:SIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwurmhfzx.exe

Path C:\Temp\ecwurmhfzx.exe
Size 361KB
SHA256 075ece5770238b05dd19dce8df820a5a9c7e9c47300b6d79049b62a2fc81a370
MD5 7a987ab9f030500d187ad30b59cf359b
SHA1 4ecc479c9fb873dbc1b31c5ddd53452eb8b45989
SHA512 e3ad4c6060985ced4c1e151779a60efc3888408cb0c47522dbf7885a1b2e8c4f18f49ee0cc787d899df7db34b546e6fa79608cab0a47efe07600d8743691823b
SSDEEP 6144:cflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:cflfAsiVGjSGecvX
TLSH
T164747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecwurmhfzx.exe

Path C:\Temp\i_ecwurmhfzx.exe
Size 361KB
SHA256 a6bfa12cc0c0e1e7c192e24804798180cd5c7ae0294e3a601c0c5625d3d513a1
MD5 1a916cdb389a05bcf4feddddca3c36eb
SHA1 ba234f6aea066b86e3ce1cee16db5927695f3b25
SHA512 b1adce7c003393ceeb5ce60850441d71de69aefe8ae3ef8b1b155d2b5909571144a8c7743467d6663f5f9a5d06cb808d65b35495cc7247c4805330a547dc1295
SSDEEP 6144:oflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:oflfAsiVGjSGecvX
TLSH
T181747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljdbvtnlgd.exe

Path C:\Temp\i_ljdbvtnlgd.exe
Size 361KB
SHA256 2a688f3b8b497046ae09cc227393644d4b4bb928a7fe8dc9c9cdbab3f83a7147
MD5 a99298aaa8c951ef8640662a5ccf3707
SHA1 902df00ede43fa85265e64a4c99c2002c3350153
SHA512 15ca930f2346acc7707ab992f07ac21675678a1fcc30586f31d7530fa8d2c315b01c765c2385bc9f3dbf96c036d8844b0f38c6b36dad9816c6f29a9799749877
SSDEEP 6144:oflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:oflfAsiVGjSGecvX
TLSH
T15E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nifaysqkid.exe

Path C:\Temp\i_nifaysqkid.exe
Size 361KB
SHA256 8832b4e1c32b4f27c23b492da29c392ca25a5e68fbc53697e862449f37673e02
MD5 a0db0a1475ea6c0c8b621b743eb0fa14
SHA1 cc04f12ff3d69b6c86e706c746e04a737f112ac4
SHA512 1f0f7c970b942c07c8fe1d1260c6873acc520f0798b3385643ec3888c237ebd4182a63e5fd6ef8cec41981dd0afea26dacea02d275bcbe0358900ac455d8c48f
SSDEEP 6144:kflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:kflfAsiVGjSGecvX
TLSH
T146747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uomjeywuom.exe

Path C:\Temp\i_uomjeywuom.exe
Size 361KB
SHA256 5858b324edc2f3e7e0b9417db753e067ac0efc4a73c58bc8b5fda56c8d468df3
MD5 c2af646e8c66be9f884eb15fc00bf535
SHA1 fd6197cf2ff144fb2eef8bec1d57fc39524f9909
SHA512 2c662623107e42ed82cf57f20ad033d2919d8555a779ebccc41a8b20c8a03756a62ee0ce07eb427799f8d68b6b6960c05726b475c241b2154739e0a12bc8842e
SSDEEP 6144:hflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:hflfAsiVGjSGecvX
TLSH
T1EA747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqlidbvtn.exe

Path C:\Temp\i_ysqlidbvtn.exe
Size 361KB
SHA256 db85bf5b64f32b1563eab52d5f0772f37b9a90cd66ac0274b5b5e0071220accf
MD5 a2029d7f284abbdb4a7892f9abcfc59c
SHA1 4d5373b48c16b987e745e891ecdf5bd181ba0108
SHA512 d5e80498baf64d0118ad906b9bc6f87d813852902c039eebb51cd0addb2a79c97b80638eb65268c3d1451f8c5b957158897d1414478058bb72ab02b5735c4f3e
SSDEEP 6144:kflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:kflfAsiVGjSGecvX
TLSH
T1C1747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zwrlgdbwqo.exe

Path C:\Temp\i_zwrlgdbwqo.exe
Size 361KB
SHA256 04ed544f338f1528cbe5b17ffcf1a5aa417cc5a45137498e99d31937d39f5558
MD5 e2a944d94dfd8587a430b9592b5dc02a
SHA1 c39518568aef9f129149094b21e708ef508f3327
SHA512 2de78c5d3e972c49c89ec697ca2fb37b907cd9b70df51922b3ba1a78efc0370020deb63f467ed123f312b820b9b53564cf7c7baa836c2f45fa62552d70c88774
SSDEEP 6144:9flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:9flfAsiVGjSGecvX
TLSH
T16E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icxvpkicau.exe

Path C:\Temp\icxvpkicau.exe
Size 361KB
SHA256 4bccec8e05b12922bfc972490e862c81aecfd958def7895f48f87d1f788dcf7a
MD5 d49d932f1372b22e18afcb4f550a5866
SHA1 3c419668316204b87d9e089b906dd240e85418d1
SHA512 38f65583882ec8d39404ec78dd4e9d564de91c3b69ae0ca6dfdd626a7f47a84919d1560662fb40503358fcf9a698127eca7ecba47d16894a0d4437299c3067eb
SSDEEP 6144:LflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:LflfAsiVGjSGecvX
TLSH
T1C2747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbvtqlgdy.sys

Path C:\Temp\jdbvtqlgdy.sys
Size 293KB
SHA256 dbde7dbc0302f3b1b1be736dd71ecd280a4a7fec0ba0c6671b543fd80eb15d1c
MD5 dac9262b2251a45fe9e5049f7befe376
SHA1 28f6a2bd5ea8fd6e2ef44c7eed642ab85e8b731e
SHA512 26e179d368c5916cc3b9cf85e8e45222efae0f63e146c3502fe7b57e0f5fc9297049bca08f704463de90e0b5eb098cc4d141bebeef40fca1f2838d11e4c656f3
SSDEEP 3072:vtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:vIJjiJcbI03GBc3ucY5DCSj
TLSH
T123545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khfausnkif.sys

Path C:\Temp\khfausnkif.sys
Size 293KB
SHA256 3f19c4932e111e7982ec7d2a4b177a24d83f5569cd0b91d6a6682e712efb84f9
MD5 9fd8f0c95bcf4d3934ca0f26590d47b6
SHA1 c05a93bd3d089e14237c29c2f9a12d81b14b94fc
SHA512 7ce3d73a8643ac50fd09730827323b8ac205fbbe02ab53720aa87ed4f4582579a7a2d82709babad515c79f5555b53d1b4c1829dc8c1a5acd5b2127f42f15425f
SSDEEP 3072:0tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:0IJjiJcbI03GBc3ucY5DCSj
TLSH
T1BF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbvtnlgd.exe

Path C:\Temp\ljdbvtnlgd.exe
Size 361KB
SHA256 59b56bdcf178997bbe00346cceb3a5b734ca317bed4498afceea42ebb71ecc88
MD5 e5a638e8b6b8d13e21f646230673377e
SHA1 269312ccd3fef9dd6f0a8d4116893d438f956c1a
SHA512 7223260065d775238fc556825d05dcc29da27d9c9252731a78c38bd039a888bacffc794248eeec5e85ab42cdb9dc8430165134a20c3f25b18234c1d264ab36ba
SSDEEP 6144:WflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:WflfAsiVGjSGecvX
TLSH
T13D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifaysqkid.exe

Path C:\Temp\nifaysqkid.exe
Size 361KB
SHA256 d8532aeb5a13ed4acaed5b7f74f5b065b6e50dcde02c26cb214dd42a2c0df216
MD5 f0532013343f3f28d7ecf1f89ba51578
SHA1 a62bb24eb17614c848c900c5c6bc73c8c2186538
SHA512 66e2210cb161736fbd93a3601ef692587253899ab7b8a3f5266c15efcbde94cfcb159e737437e18c6c1804c984f141b2cd6fcef814436bb8655c4257036012af
SSDEEP 6144:iflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:iflfAsiVGjSGecvX
TLSH
T147747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qlicaysqni.sys

Path C:\Temp\qlicaysqni.sys
Size 293KB
SHA256 6bfba4b16c0db34c94d68b06176c74c19c4005dc4a296397fed089db13529604
MD5 83e57215bb4f0893166311274bbd005b
SHA1 6dbc17ea785455de0efb399ec941846cc7e3f53f
SHA512 8e0c2bc4094ada65295fa55bb2dd32b34efc1cc0d2bdccfde0733e9721ccb876eca6091e21edc74095458a0fbcaf5a6e5fb8d48a3452160ee088a6bfe690b4db
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T16A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

toljgbytqo.sys

Path C:\Temp\toljgbytqo.sys
Size 293KB
SHA256 f3cc616a2f94dfef23fa095cfaf25dbca91f5f46ed26ed67b4f035c4d6780b61
MD5 b7631df2ab796282eb5cea9e2ae1c93c
SHA1 c7e50890968a051137c0e47e405addc3155ad063
SHA512 57ad099254766788d5f27b66039750914ac3cc9a25ff99bd27c76e3b1536c4ca5a25dbe4b840d8616ea5d43e9364b64e79e749cc76ba3406bba4f6c8729998ca
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T12C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomjeywuom.exe

Path C:\Temp\uomjeywuom.exe
Size 361KB
SHA256 1968abf79e592afdd8d28861ebe1b2fc11c8b02a1c4a8b98b20474d95acf859b
MD5 54bfc685b85f036ac63089044e7d9be6
SHA1 a8f219a38737b2d4c652e35bf6c0f03b0b2ab73b
SHA512 6268e5948d97ccd19c554d18007da094421f50a08069f98b8d019bfa4b4f142f6700f1bc2633b6e90500f11d9c6e4b182c237a13b8ef45dc0005537dd43c9e9e
SSDEEP 6144:SflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:SflfAsiVGjSGecvX
TLSH
T1FC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqlidbvtn.exe

Path C:\Temp\ysqlidbvtn.exe
Size 361KB
SHA256 ee527cabd90114f3ebcbd76ff2f4f262a30c32ef0e23018147b3d2c0c7d50ea9
MD5 c516bacb889b08d3fefc46f452a4dcd2
SHA1 0c4d6c7f50b52deb126e6958d423d1a9d84abd93
SHA512 47a723d3e461a22b02fbc470a343b810e9d15c3fd2a26e902eeecfb8558f08469730373ebd3550e975a2a2de79a8767e63bf0f94168484d40ec969663eb5351a
SSDEEP 6144:SflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:SflfAsiVGjSGecvX
TLSH
T164747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywtoljebzt.sys

Path C:\Temp\ywtoljebzt.sys
Size 293KB
SHA256 12f035fb586a9177bf23ee7a3cebe6fe8a52266ac4057425d3339d40f996835c
MD5 480445fb3c55c8f4a512bada700fa162
SHA1 0409179abd26776bc819184ae3b61bbe9886fe4d
SHA512 f249e0f9d4f7bf034a3896b4438d9289682ca2ea2b60fbff9774cf126f7b90ba2918ce2176151418119aeec712ca320ef5a27aedda8f346939dcb03d59bc18c3
SSDEEP 3072:ZtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:ZIJjiJcbI03GBc3ucY5DCSj
TLSH
T178545B44AAA4B0F6D9D5043C00EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwrlgdbwqo.exe

Path C:\Temp\zwrlgdbwqo.exe
Size 361KB
SHA256 b8dee584da204371d4f3aa2a3adfedbb25552f6ee3d61b56f85bd566fe2f0c3a
MD5 5d1495a42ec596c09da50c7c6510ceac
SHA1 a9a544d72b6c8e754c07edcc18698f7f64fd535c
SHA512 a62a659f0cb347331559a71ca741e62c80f9c7e83ceffd0d363d7b38132c716d7f21939aa2c62e45c3fb829db653a21bb88a0f4add38fdb8e11d0786eb8c98cf
SSDEEP 6144:XflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:XflfAsiVGjSGecvX
TLSH
T121747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwrpmhezwr.sys

Path C:\Temp\zwrpmhezwr.sys
Size 293KB
SHA256 ee1a7c4295eba17c74cca1a221c5364c7ba0627494394cb05ba32f872c2a9f5d
MD5 1fefb820cda0fbec0738b780f86ec5e1
SHA1 76244e969a74ff453eb51407393aacb038736528
SHA512 4407ed206e4fed618e31bbeb88801f9b6273cc704e5fcb7508ce69a00c36aa0d5cd86ebdd0612838ef7e38d39d4426a047d171e287ae600673cb0f6a12170809
SSDEEP 3072:YtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9Eds:YIJjiJcbI03GBc3ucY5DCSj
TLSH
T108545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

80709e83-aeb0-41e8-9391-a5348f35326f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\80709e83-aeb0-41e8-9391-a5348f35326f.tmp
Size 649B
SHA256 54663af31d76330608d7c280eb818c2ca0ee704fee230ae9fb07da904fcd6fc4
MD5 5aec6389c11c6930128b2ec49bd0d1da
SHA1 726b4bba165ef33621258138d9fd46e7ea8e25ad
SHA512 42cc78bb8ec5cd94c4c837aa6539ac8ae0eaa9a7b9b66e048f7f016e4d2bc05b33788f1192666ae3fef13526871f102904158bed5711d77eeebfd9d5cdbe7312
TLSH
T17BF0F9A6D921BC3729FC1B1870A40B47F750132B3B51984B3B3C920C4FB463B4646C1C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

35ae0665-7a98-41e1-adcc-a77f66c828d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\35ae0665-7a98-41e1-adcc-a77f66c828d3.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 958a5b2de5117db734274aae966f7b4ed6095e48ed47055e26d9b95daf14fcf0
MD5 50c1d06fa5e5bb1187381a516ef6dc5f
SHA1 b12906516549e3dbb55b401830352f3579b37041
SHA512 4ca49b81b87fe450909bfd74722b0c0799ba1c67fb50689fcc6be2f0d0135ae290836adc486297374c025c98dd5e39ad51a524aca4dc02d83da618af117b03a7
TLSH
T15F51BFF7C3E4856EC90195F0AA187E2BCE1C0914832C7D5AC9E0AE1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b729a7b25432cf746c5689057b2dbe9ecf4099aca9bdebc8f5f80f85afdf0ea9
MD5 aadb73a1886a12da9d6ed33501ca9298
SHA1 19245857fc24e4a17833cac91e92823ba88b4591
SHA512 3169004204865328986cb2ca8370fd6ad12a3cb34a37de511a26f3b46b833af9a57b1562b24ae8c20418fb12b638654c8c6c5acc9078b34c0acd46ab7031309e
SSDEEP 384:sxRjt8u/fgsUUN/RI9fp/5O/WFgsGQhjtD:svCu/fYeWL/50WFgsGQH
TLSH
T11B72EA06AA249D7BCDDBD209FA957F53D2F8156391905E44AAFC8B0C04D67EC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 645cc1bd293d6bb8dce94fb0179ac25bec366af60fec2e26ff06edde565bcbd0
MD5 3cc9fd554db5d8152b22148f62bd223f
SHA1 0e6a0bf1587d7d4c92a8566166123432f04910fd
SHA512 768ddf33cf41d22af5a527fb14929c0be20eef8b673b51474f4abc6b7aa1145e920dd9d175ac7b070a612baae599bac449f22ebbcbb86d9e58e65f9e443d63dc
SSDEEP 384:sxRjtqFu/fgsyFN/RI9fp/5O/WF3sGQhite:svcFu/f+3WL/50WF3sGQIY
TLSH
T1BD72E91AA9249D77DDDBD219FA957F53D2F8116391915E44AAFCCB0C00EA7DC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 4434b1c0e757b46af8ff7b530947c006b89bb8ec19e97eee63669abb6442fb50
MD5 6ff9e3e97e7423e9cef78aaaf8f37818
SHA1 74a9cd65396bd168a47840f0c9a0b4ebd1e47d0f
SHA512 799f80a9b390b3ebe5ab967aff918700ccabbc5fccc65d96f2eb9d74661a85183d173b779457bfe869ba357423cb7ccf802ac8bac75932d96ca22186e9163b2a
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnobbDwzroa4E:Ob4YZnE7yTWg1NfwBu1ja4obHwAlE
TLSH
T12FE2FB3B280CCB7E4F804ADDEC29BD9B6DA801CF5AD8C95447EA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 749d4184f8b98d9f5641ff0327658bce53a0933dec8876dea6573ad190b42e66
MD5 c4a8ba4448e8075c6dd6f307f83bec10
SHA1 e4316fb23bf8fbf5123fe28ea4475fddd4732eb9
SHA512 b26c891735e6da3f83608466c366dcc0f954d8692451627c9c9df6a1275a9563e725bfd6a9d570592ae09aff413c04c8ee517cb533cd136fab2b84b93a8c2815
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9/54:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRv
TLSH
T159B25D51713F4680383EA50C91B8D81E86C2B4A37519F52F7BAC06A65F67E039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 2b49ec6a859ae2c4534bdd4529f9ec489bdf929929ca656e303c3a438490c2d9
MD5 2ac63b4a8c54c5378b0d2f1d9ed22bb9
SHA1 6d4101b15adde4057a190cd51913d04c69b15526
SHA512 6ee6baac4f843816c331d059420c6b52cfbd0a0e93b07969ed5dd4b27cd5fb6928c271d49ea7be4a79596e9f49b40d0027f22c6bcc0590fed9c2171aaca8ef5d
SSDEEP 768:oF1j+9iQiwgwuVLGexe1lXDvNZoewMDVcLCO7w/z:F9iQpuVe1lXDsguCt/z
TLSH
T188E2B2F598D78977E89E4B87A33D2E469AFCD063B4895984B7C81D0CCC862BFC706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 7d6e8a6f65c483f1c01dab56db419f62577fa5504ce758f5ddb583af9368c7f3
MD5 4807447101c5077376895828361441b2
SHA1 7b1ddaa0bd66794448cda044ad5f5c28641fc8dc
SHA512 abb860646361063ec81a9fd08406457fce2728c3af2a16ee3c283bf0b6705750643e77b3a3253317adec1ff57d2b7102126608f9df0c289e5a101e443d94add4
SSDEEP 768:fF1j+9SX6wgUu66Gexe1lXDvNVEFTAV5X5i:W9SXbupe1lXDwFTkpi
TLSH
T169C25B31AC55DABBEDE68FD9B70A7A06EFE0519384D86DD4DAD81E0D00C72AD0707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 850cdfce4235d96163749d59661ee81a00a4c137c9a11acde637a5d75a1a5889
MD5 f53ddedbdb326087e60f3f010d0cab22
SHA1 df0da7ec0eee4f6ee7a6080ae962b86ce7413504
SHA512 6ba91ad1a1054e3dd144041dc5d3603b1b6d77f8cab6c1d7ecffbf040e2ecdff9adf1b896677250dfd76ff9b9b3401c86d6ba38856334b9571d16f0fc36dd2aa
SSDEEP 768:ZF1j+9jQiwgWujLGexe1lXDvNZoetMDVcLCO7w/m:o9jQvufe1lXDsBuCt/m
TLSH
T173D26B32E895CD77ECEA8FD9B75A3647AEE0516388C95E94D6C81D0C00CB69D0B0BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 58887f7f299e12dbb46a2cc37ca6d280d78925cf8ef586fa96b95cb20a2995f7
MD5 2af6643351e6e78aec2a482b906df057
SHA1 7ea896e1446ad341d7c05ee907f87cf1bc36cd6e
SHA512 0959a13cab648febb7976469b7f2e205585fd14c6064d5cc5d7901fc167822b8f17e418ea76b6c501c6f4ea0585494907f088be014b4fdef5a9cb736bbd1785e
SSDEEP 768:HF1j+9jQiwgwuILGexe1lXDvNZoetMDVcLCO7w/z:u9jQpuIe1lXDsBuCt/z
TLSH
T166D26B32E895CD77ECEA9FD9B75A764BAEE0516388C95E94D6C81D0C00CB29D070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 c40019d6ae725cd6d9bbfc0d73d313ecceb70374636da2fd830eb3e9ea1f91bd
MD5 588504405c22fd1bfca9e69930b77762
SHA1 aa9113e990ac0892454e9096fa56bf80c36b7bfa
SHA512 15740e11c327e9fdb280f820fe641fcdf1e03f35d9410a49a0f27a34d2595011eb1d91468e3e96c9c39f806268b3b10aab7443797ff8dc2c635587d70ef684ce
TLSH
T1B44142E08C382AD2D4BE0D6F745734FC94E8D726F8A0343C6899EEA8967964D654087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 e5b28cc9cee381424a2fdb47f5daafd28e58ed26a6ad453b39932101c1de54ae
MD5 485fd9e9d5b3b909f2940669feef917a
SHA1 1790f825b1c60ccb3ff569749f6f5838a6387741
SHA512 b2c2f8388c7b3c47307941af936a562f9083fc7469831007b4b78e66dc55705904c02f30cd94bd459947e53db4d4ab3a9d929cca3c5cf487357a30236293cfe1
TLSH
T1874174E08C392AD2D4BE0E6F745734FC94ECD72AF8A0343C2898EE98467960D254083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 f512d0e0adab6d8a012d0db1ba103f61c4c3a1a0e541b4ef25f67b4e4e3eb79f
MD5 09db9e564b84b4744afa0f58cdc0cac4
SHA1 c70625805ad9519f84c025451f13ab5506a602e2
SHA512 0bf8170162eb41f138481c01afa11ba03e568e3ee7d00f9ef883c4dffffcce9ef0eb28842107fefe345e9080ff3aaa49b33cea4a6db0a8d2aab714fa57e2b8d9
TLSH
T1263142E08C392AD2D4BE0DAF745B35FC94D8D726F8D134386898EE68963961D254087F
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 8807416131aed8b178d72ae569ed3885b624cc35af28b49469044e7ab8d56448
MD5 59264de646256e8fbaa498972de8e0b8
SHA1 3b3ddb1d52b104d15aeab77942c9cc140a713a6a
SHA512 c15bc6a34d07377022abebca382a76099a29d0380a2f529a371121ea5c7abec47e582289cbf6a60f4b9c9ba5a11a2fe2cc092b1095ce785b30bb21ddab3f2329
TLSH
T15E7123835BB8CAF3C1DA5FF102835648F1FB22784763303447556546AB30ABA28B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/428-258-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/428-220-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2264-370-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2984-207-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2988-152-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3972-270-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4196-421-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4288-334-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4528-417-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4740-345-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4804-280-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4984-276-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5780-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5916-374-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6028-284-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6712-233-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6852-301-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6876-349-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6892-330-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6924-312-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6928-61-0x0000000000010000-0x00000000000AB000-memory.dmp

Download