systex | c8be2d58c39cf1b392c77d6a159b55a8c4b811ccf3dc67e4060b7af7b01c6cac

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260703-xd722sev3t
SHA256 c8be2d58c39cf1b392c77d6a159b55a8c4b811ccf3dc67e4060b7af7b01c6cac
MD5 e4028b3596644c615a63d09f5e7c81e4
SHA1 dd9f04ae280a2ba6cda91b4afacc68c7d32b2df7
SHA512 0afd45a2780465b9cff141a9293697c297322a54471afe7a40face47f08f4ca4b90c0ff9d0657c0950a142c0eee9fcfb2b3b21b4aacaa7c07d124d905f655d64
SSDEEP 6144:TflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:TflfAsiVGjSGecvX
TLSH
T1F2747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5748	bwtomgeywqomjdbw.exe
2656	bwtomgeywqomjdbw.sys
932	CreateProcess.exe
5036	gbytojdbwr.exe
3980	CreateProcess.exe
6136	CreateProcess.exe
4180	i_gbytojdbwr.exe
4252	gbytqljdby.sys
2064	CreateProcess.exe
1260	daytqoigay.exe
1532	CreateProcess.exe
4600	CreateProcess.exe
6064	i_daytqoigay.exe
1340	fdyvqnlfdy.sys
5720	CreateProcess.exe
2768	vqnifaysqk.exe
4544	CreateProcess.exe
5256	CreateProcess.exe
5908	i_vqnifaysqk.exe
240	xvsnkigays.sys
6056	CreateProcess.exe
1752	yvqnigaysq.exe
4724	CreateProcess.exe
5604	CreateProcess.exe
4036	i_yvqnigaysq.exe
4364	usqkicausn.sys
3612	CreateProcess.exe
2732	snkfcxvpnk.exe
2764	CreateProcess.exe
3512	CreateProcess.exe
5832	i_snkfcxvpnk.exe
5764	uspcauspkh.sys
5916	CreateProcess.exe
4536	mkecxupmhe.exe
5944	CreateProcess.exe
5956	CreateProcess.exe
4152	i_mkecxupmhe.exe
3808	usmkecwupm.sys
3052	CreateProcess.exe
5292	pmkeromhez.exe
5024	CreateProcess.exe
5804	CreateProcess.exe
260	i_pmkeromhez.exe
3928	omgezwurpj.sys
252	CreateProcess.exe
5332	jeczxrojhb.exe
2416	CreateProcess.exe
2904	CreateProcess.exe
3736	i_jeczxrojhb.exe
2388	romgeywtro.sys
3412	CreateProcess.exe
1744	ljhbztrojh.exe
3656	CreateProcess.exe
5352	CreateProcess.exe
3444	i_ljhbztrojh.exe
4876	ebwqojgbyw.sys
4784	CreateProcess.exe
6064	oigbytroig.exe
4944	CreateProcess.exe
4120	CreateProcess.exe
908	i_oigbytroig.exe
3160	olgeywqoig.sys
4952	CreateProcess.exe
3096	jdbvtnlgdy.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ligayvqnli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytojdbwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jeczxrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbytroig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecxupmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvpnhfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcwusmkhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnifaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljhbztrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdavqnlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpnhfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_auspkhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcwusmkhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecxupmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljhbztrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljebztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnifaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfcxvpnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdavqnlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuomhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtomgeywqomjdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytojdbwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfcxvpnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkeromhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkeromhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jeczxrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbytroig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daytqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_daytqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	auspkhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljebztrmj.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
984	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2132	ipconfig.exe
996	ipconfig.exe
2276	ipconfig.exe
1772	ipconfig.exe
4744	ipconfig.exe
4604	ipconfig.exe
3780	ipconfig.exe
4408	ipconfig.exe
5652	ipconfig.exe
1160	ipconfig.exe
1340	ipconfig.exe
4816	ipconfig.exe
3004	ipconfig.exe
2688	ipconfig.exe
4744	ipconfig.exe
2100	ipconfig.exe
5372	ipconfig.exe
5708	ipconfig.exe
1944	ipconfig.exe
5704	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275779319527010"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{1B4C5D6F-DA9A-476B-B234-E01EB300207C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5748	bwtomgeywqomjdbw.exe
5748	bwtomgeywqomjdbw.exe
5748	bwtomgeywqomjdbw.exe
5748	bwtomgeywqomjdbw.exe
5748	bwtomgeywqomjdbw.exe
5748	bwtomgeywqomjdbw.exe
5748	bwtomgeywqomjdbw.exe
5748	bwtomgeywqomjdbw.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4180	i_gbytojdbwr.exe
Token: SeDebugPrivilege	6064	i_daytqoigay.exe
Token: SeDebugPrivilege	5908	i_vqnifaysqk.exe
Token: SeDebugPrivilege	4036	i_yvqnigaysq.exe
Token: SeDebugPrivilege	5832	i_snkfcxvpnk.exe
Token: SeDebugPrivilege	4152	i_mkecxupmhe.exe
Token: SeDebugPrivilege	260	i_pmkeromhez.exe
Token: SeDebugPrivilege	3736	i_jeczxrojhb.exe
Token: SeDebugPrivilege	3444	i_ljhbztrojh.exe
Token: SeDebugPrivilege	908	i_oigbytroig.exe
Token: SeDebugPrivilege	5060	i_jdbvtnlgdy.exe
Token: SeDebugPrivilege	3736	i_fdavqnlida.exe
Token: SeDebugPrivilege	5832	i_dxvpnhfdxv.exe
Token: SeDebugPrivilege	1452	i_auspkhfzxs.exe
Token: SeDebugPrivilege	6024	i_fcwusmkhfz.exe
Token: SeDebugPrivilege	3276	i_cwuomhezxr.exe
Token: SeDebugPrivilege	5824	i_rljebztrmj.exe
Token: SeDebugPrivilege	2168	i_jgeywqojgb.exe
Token: SeDebugPrivilege	3116	i_wqoigbytrl.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2516	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 5748	1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 1320 wrote to memory of 4184	1320	2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4184 wrote to memory of 2516	4184	iexplore.exe	90
PID 2516 wrote to memory of 4752	2516	msedge.exe	91
PID 2516 wrote to memory of 6000	2516	msedge.exe	93
PID 2516 wrote to memory of 984	2516	msedge.exe	94
PID 2516 wrote to memory of 6000	2516	msedge.exe	93
PID 2516 wrote to memory of 6000	2516	msedge.exe	93
PID 2516 wrote to memory of 2696	2516	msedge.exe	95
PID 2516 wrote to memory of 2696	2516	msedge.exe	95
PID 2516 wrote to memory of 6136	2516	msedge.exe	118
PID 2516 wrote to memory of 5172	2516	msedge.exe	96
PID 2516 wrote to memory of 6136	2516	msedge.exe	118
PID 2516 wrote to memory of 6136	2516	msedge.exe	118
PID 2516 wrote to memory of 5172	2516	msedge.exe	96
PID 2516 wrote to memory of 5172	2516	msedge.exe	96
PID 2516 wrote to memory of 3844	2516	msedge.exe	98
PID 2516 wrote to memory of 5704	2516	msedge.exe	99
PID 2516 wrote to memory of 3844	2516	msedge.exe	98
PID 2516 wrote to memory of 3844	2516	msedge.exe	98
PID 2516 wrote to memory of 5704	2516	msedge.exe	99
PID 2516 wrote to memory of 5704	2516	msedge.exe	99
PID 2516 wrote to memory of 2108	2516	msedge.exe	100
PID 2516 wrote to memory of 2108	2516	msedge.exe	100
PID 2516 wrote to memory of 5476	2516	msedge.exe	104
PID 2516 wrote to memory of 5812	2516	msedge.exe	105
PID 2516 wrote to memory of 5476	2516	msedge.exe	104
PID 2516 wrote to memory of 5812	2516	msedge.exe	105
PID 2516 wrote to memory of 2908	2516	msedge.exe	107
PID 5748 wrote to memory of 932	5748	bwtomgeywqomjdbw.exe	108
PID 5036 wrote to memory of 3980	5036	gbytojdbwr.exe	112
PID 2516 wrote to memory of 2096	2516	msedge.exe	116
PID 2516 wrote to memory of 2096	2516	msedge.exe	116
PID 2516 wrote to memory of 4964	2516	msedge.exe	117
PID 2516 wrote to memory of 4964	2516	msedge.exe	117
PID 5748 wrote to memory of 6136	5748	bwtomgeywqomjdbw.exe	118
PID 5748 wrote to memory of 2064	5748	bwtomgeywqomjdbw.exe	122
PID 1260 wrote to memory of 1532	1260	daytqoigay.exe	124
PID 5748 wrote to memory of 4600	5748	bwtomgeywqomjdbw.exe	127
PID 5748 wrote to memory of 5720	5748	bwtomgeywqomjdbw.exe	131
PID 2768 wrote to memory of 4544	2768	vqnifaysqk.exe	133
PID 5748 wrote to memory of 5256	5748	bwtomgeywqomjdbw.exe	136
PID 5748 wrote to memory of 6056	5748	bwtomgeywqomjdbw.exe	141
PID 1752 wrote to memory of 4724	1752	yvqnigaysq.exe	143
PID 5748 wrote to memory of 5604	5748	bwtomgeywqomjdbw.exe	146
PID 2516 wrote to memory of 5676	2516	msedge.exe	148
PID 2516 wrote to memory of 2824	2516	msedge.exe	149
PID 2516 wrote to memory of 2940	2516	msedge.exe	150
PID 5748 wrote to memory of 3612	5748	bwtomgeywqomjdbw.exe	153
PID 2732 wrote to memory of 2764	2732	snkfcxvpnk.exe	155
PID 5748 wrote to memory of 3512	5748	bwtomgeywqomjdbw.exe	158
PID 5748 wrote to memory of 5916	5748	bwtomgeywqomjdbw.exe	162
PID 4536 wrote to memory of 5944	4536	mkecxupmhe.exe	164
PID 5748 wrote to memory of 5956	5748	bwtomgeywqomjdbw.exe	167
PID 5748 wrote to memory of 3052	5748	bwtomgeywqomjdbw.exe	171
PID 5292 wrote to memory of 5024	5292	pmkeromhez.exe	173
PID 5748 wrote to memory of 5804	5748	bwtomgeywqomjdbw.exe	176
PID 5748 wrote to memory of 252	5748	bwtomgeywqomjdbw.exe	180
PID 5332 wrote to memory of 2416	5332	jeczxrojhb.exe	182
PID 5748 wrote to memory of 2904	5748	bwtomgeywqomjdbw.exe	185
PID 2516 wrote to memory of 1116	2516	msedge.exe	187
PID 2516 wrote to memory of 1116	2516	msedge.exe	187
PID 5748 wrote to memory of 3412	5748	bwtomgeywqomjdbw.exe	193
PID 1744 wrote to memory of 3656	1744	ljhbztrojh.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_e4028b3596644c615a63d09f5e7c81e4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Temp\bwtomgeywqomjdbw.exe
  C:\Temp\bwtomgeywqomjdbw.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbytojdbwr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:932
  - - C:\Temp\gbytojdbwr.exe
      C:\Temp\gbytojdbwr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5036
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3980
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gbytojdbwr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6136
  - - C:\Temp\i_gbytojdbwr.exe
      C:\Temp\i_gbytojdbwr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\daytqoigay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2064
  - - C:\Temp\daytqoigay.exe
      C:\Temp\daytqoigay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1260
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1532
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_daytqoigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4600
  - - C:\Temp\i_daytqoigay.exe
      C:\Temp\i_daytqoigay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vqnifaysqk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5720
  - - C:\Temp\vqnifaysqk.exe
      C:\Temp\vqnifaysqk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2768
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4544
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vqnifaysqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5256
  - - C:\Temp\i_vqnifaysqk.exe
      C:\Temp\i_vqnifaysqk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvqnigaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6056
  - - C:\Temp\yvqnigaysq.exe
      C:\Temp\yvqnigaysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1752
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4724
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvqnigaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5604
  - - C:\Temp\i_yvqnigaysq.exe
      C:\Temp\i_yvqnigaysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snkfcxvpnk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3612
  - - C:\Temp\snkfcxvpnk.exe
      C:\Temp\snkfcxvpnk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2732
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2764
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snkfcxvpnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3512
  - - C:\Temp\i_snkfcxvpnk.exe
      C:\Temp\i_snkfcxvpnk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkecxupmhe.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5916
  - - C:\Temp\mkecxupmhe.exe
      C:\Temp\mkecxupmhe.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4536
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5944
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkecxupmhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5956
  - - C:\Temp\i_mkecxupmhe.exe
      C:\Temp\i_mkecxupmhe.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmkeromhez.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3052
  - - C:\Temp\pmkeromhez.exe
      C:\Temp\pmkeromhez.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5292
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5024
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmkeromhez.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5804
  - - C:\Temp\i_pmkeromhez.exe
      C:\Temp\i_pmkeromhez.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jeczxrojhb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:252
  - - C:\Temp\jeczxrojhb.exe
      C:\Temp\jeczxrojhb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5332
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2416
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jeczxrojhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2904
  - - C:\Temp\i_jeczxrojhb.exe
      C:\Temp\i_jeczxrojhb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljhbztrojh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3412
  - - C:\Temp\ljhbztrojh.exe
      C:\Temp\ljhbztrojh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1744
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3656
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljhbztrojh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5352
  - - C:\Temp\i_ljhbztrojh.exe
      C:\Temp\i_ljhbztrojh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigbytroig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4784
  - - C:\Temp\oigbytroig.exe
      C:\Temp\oigbytroig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6064
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4944
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigbytroig.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4120
  - - C:\Temp\i_oigbytroig.exe
      C:\Temp\i_oigbytroig.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbvtnlgdy.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4952
  - - C:\Temp\jdbvtnlgdy.exe
      C:\Temp\jdbvtnlgdy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3096
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4524
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbvtnlgdy.exe ups_ins
    3⤵
    PID:2456
  - - C:\Temp\i_jdbvtnlgdy.exe
      C:\Temp\i_jdbvtnlgdy.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdavqnlida.exe ups_run
    3⤵
    PID:4964
  - - C:\Temp\fdavqnlida.exe
      C:\Temp\fdavqnlida.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1904
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5564
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdavqnlida.exe ups_ins
    3⤵
    PID:3464
  - - C:\Temp\i_fdavqnlida.exe
      C:\Temp\i_fdavqnlida.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvpnhfdxv.exe ups_run
    3⤵
    PID:1308
  - - C:\Temp\dxvpnhfdxv.exe
      C:\Temp\dxvpnhfdxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4424
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2120
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvpnhfdxv.exe ups_ins
    3⤵
    PID:4876
  - - C:\Temp\i_dxvpnhfdxv.exe
      C:\Temp\i_dxvpnhfdxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\auspkhfzxs.exe ups_run
    3⤵
    PID:1364
  - - C:\Temp\auspkhfzxs.exe
      C:\Temp\auspkhfzxs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1340
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6020
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_auspkhfzxs.exe ups_ins
    3⤵
    PID:5920
  - - C:\Temp\i_auspkhfzxs.exe
      C:\Temp\i_auspkhfzxs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcwusmkhfz.exe ups_run
    3⤵
    PID:4220
  - - C:\Temp\fcwusmkhfz.exe
      C:\Temp\fcwusmkhfz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2016
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5612
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcwusmkhfz.exe ups_ins
    3⤵
    PID:5252
  - - C:\Temp\i_fcwusmkhfz.exe
      C:\Temp\i_fcwusmkhfz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwuomhezxr.exe ups_run
    3⤵
    PID:4804
  - - C:\Temp\cwuomhezxr.exe
      C:\Temp\cwuomhezxr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2424
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4136
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwuomhezxr.exe ups_ins
    3⤵
    PID:5536
  - - C:\Temp\i_cwuomhezxr.exe
      C:\Temp\i_cwuomhezxr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljebztrmj.exe ups_run
    3⤵
    PID:5708
  - - C:\Temp\rljebztrmj.exe
      C:\Temp\rljebztrmj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5372
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1400
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljebztrmj.exe ups_ins
    3⤵
    PID:2044
  - - C:\Temp\i_rljebztrmj.exe
      C:\Temp\i_rljebztrmj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgeywqojgb.exe ups_run
    3⤵
    PID:1120
  - - C:\Temp\jgeywqojgb.exe
      C:\Temp\jgeywqojgb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:612
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4508
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgeywqojgb.exe ups_ins
    3⤵
    PID:2028
  - - C:\Temp\i_jgeywqojgb.exe
      C:\Temp\i_jgeywqojgb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqoigbytrl.exe ups_run
    3⤵
    PID:5168
  - - C:\Temp\wqoigbytrl.exe
      C:\Temp\wqoigbytrl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1824
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1968
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqoigbytrl.exe ups_ins
    3⤵
    PID:3176
  - - C:\Temp\i_wqoigbytrl.exe
      C:\Temp\i_wqoigbytrl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ligayvqnli.exe ups_run
    3⤵
    PID:5660
  - - C:\Temp\ligayvqnli.exe
      C:\Temp\ligayvqnli.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5652
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1944
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3004
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ffa2f0ec188,0x7ffa2f0ec194,0x7ffa2f0ec1a0
      4⤵
      PID:4752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1900,i,9558913568166185243,342118056278307712,262144 --field-trial-handle=2512,i,4546246407559136795,5655841167026673755,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:2
      4⤵
      PID:6000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2044,i,839308511549866560,13795373555692392700,524288 --field-trial-handle=2512,i,4546246407559136795,5655841167026673755,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:11
      4⤵
      System Time Discovery
      PID:984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2688,i,4754030155605660555,4669767446456994141,524288 --field-trial-handle=2512,i,4546246407559136795,5655841167026673755,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:13
      4⤵
      PID:2696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,2500827869641335161,11342033601328521219,2097152 --field-trial-handle=2512,i,4546246407559136795,5655841167026673755,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:5172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,16491125479492798821,12458427725570817230,2097152 --field-trial-handle=2512,i,4546246407559136795,5655841167026673755,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:6136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,12345717595967086503,9457907393236666934,2097152 --field-trial-handle=2512,i,4546246407559136795,5655841167026673755,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
      4⤵
      PID:3844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,5286775697502279135,7772383551984510566,2097152 --field-trial-handle=2512,i,4546246407559136795,5655841167026673755,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:9
      4⤵
      PID:5704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,4270867772345339810,1470926305254972831,524288 --field-trial-handle=2512,i,4546246407559136795,5655841167026673755,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
      4⤵
      PID:2108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,4615656287759771130,13999697474428461885,524288 --field-trial-handle=2512,i,4546246407559136795,5655841167026673755,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
      4⤵
      PID:5476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,15754258826667725670,539008429000769093,524288 --field-trial-handle=2512,i,4546246407559136795,5655841167026673755,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
      4⤵
      PID:5812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,4273568227709241273,6865477295373624047,524288 --field-trial-handle=2512,i,4546246407559136795,5655841167026673755,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
      4⤵
      PID:4536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,4273568227709241273,6865477295373624047,524288 --field-trial-handle=2512,i,4546246407559136795,5655841167026673755,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
      4⤵
      PID:2908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,15997971308422226180,4259373235884788686,524288 --field-trial-handle=2512,i,4546246407559136795,5655841167026673755,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:2096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,14999536685552894623,1065817296111286217,524288 --field-trial-handle=2512,i,4546246407559136795,5655841167026673755,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
      4⤵
      PID:4964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,5726074270893367749,14323124480625778890,524288 --field-trial-handle=2512,i,4546246407559136795,5655841167026673755,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:14
      4⤵
      PID:5676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,9287922230479673983,11155095734043602940,524288 --field-trial-handle=2512,i,4546246407559136795,5655841167026673755,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
      4⤵
      PID:2824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,6872667508378519635,10481647094065363730,524288 --field-trial-handle=2512,i,4546246407559136795,5655841167026673755,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
      4⤵
      PID:2940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,3767608184190140237,16426024361220520515,524288 --field-trial-handle=2512,i,4546246407559136795,5655841167026673755,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
      4⤵
      PID:1116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6660,i,12054631650536223475,17146686598645555558,262144 --field-trial-handle=2512,i,4546246407559136795,5655841167026673755,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:10
      4⤵
      PID:4356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:568

C:\Temp\bwtomgeywqomjdbw.sys
C:\Temp\bwtomgeywqomjdbw.sys
1⤵
- Executes dropped EXE
PID:2656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5944

C:\Temp\gbytqljdby.sys
C:\Temp\gbytqljdby.sys
1⤵
- Executes dropped EXE
PID:4252

C:\Temp\fdyvqnlfdy.sys
C:\Temp\fdyvqnlfdy.sys
1⤵
- Executes dropped EXE
PID:1340

C:\Temp\xvsnkigays.sys
C:\Temp\xvsnkigays.sys
1⤵
- Executes dropped EXE
PID:240

C:\Temp\usqkicausn.sys
C:\Temp\usqkicausn.sys
1⤵
- Executes dropped EXE
PID:4364

C:\Temp\uspcauspkh.sys
C:\Temp\uspcauspkh.sys
1⤵
- Executes dropped EXE
PID:5764

C:\Temp\usmkecwupm.sys
C:\Temp\usmkecwupm.sys
1⤵
- Executes dropped EXE
PID:3808

C:\Temp\omgezwurpj.sys
C:\Temp\omgezwurpj.sys
1⤵
- Executes dropped EXE
PID:3928

C:\Temp\romgeywtro.sys
C:\Temp\romgeywtro.sys
1⤵
- Executes dropped EXE
PID:2388

C:\Temp\ebwqojgbyw.sys
C:\Temp\ebwqojgbyw.sys
1⤵
- Executes dropped EXE
PID:4876

C:\Temp\olgeywqoig.sys
C:\Temp\olgeywqoig.sys
1⤵
- Executes dropped EXE
PID:3160

C:\Temp\kidavtnlfd.sys
C:\Temp\kidavtnlfd.sys
1⤵
PID:2096

C:\Temp\dxvsqnifax.sys
C:\Temp\dxvsqnifax.sys
1⤵
PID:1284

C:\Temp\kfcxvpnhfz.sys
C:\Temp\kfcxvpnhfz.sys
1⤵
PID:2996

C:\Temp\khfzxrpkhc.sys
C:\Temp\khfzxrpkhc.sys
1⤵
PID:4932

C:\Temp\ecwuomjhfz.sys
C:\Temp\ecwuomjhfz.sys
1⤵
PID:2528

C:\Temp\trpjhbztrm.sys
C:\Temp\trpjhbztrm.sys
1⤵
PID:4228

C:\Temp\ytrlgdywto.sys
C:\Temp\ytrlgdywto.sys
1⤵
PID:4348

C:\Temp\ligdyvtnlf.sys
C:\Temp\ligdyvtnlf.sys
1⤵
PID:3576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bwtomgeywqomjdbw.exe

Path C:\Temp\bwtomgeywqomjdbw.exe
Size 361KB
SHA256 b9f733737aa71e6af6f8ca7e6a0bf6718087dcca342b25d9c06bafa15f927f3d
MD5 bd9b4c7e1a17a2d1fe8586db15bc5f2a
SHA1 fe45f05748a08246bf6725c4b7267618ab5121f2
SHA512 d87e5b6e0594de56b69b034c2ec293653fc3e2bd316fe3a21d7948b926efb8ff496d62b4c3a70e1e6740f5dde4b79be2ba7171928b8e4572220d8bedd59f5b8a
SSDEEP 6144:yflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:yflfAsiVGjSGecvX
TLSH
T1BA747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwtomgeywqomjdbw.sys

Path C:\Temp\bwtomgeywqomjdbw.sys
Size 293KB
SHA256 1d8f939aaca7f8f2bac436587c13204a20156b73c667ec7ffd4778c9ac50b022
MD5 a1d748f23b8a7ae69d139996b7c6020b
SHA1 f73e55516c4caff70e593c781634ae1343c5f73f
SHA512 9700dc835eaf9cab5ac7fc5f7978fb6b10eb3d8512fcc7e65e39c7950ae46b7e0a003129906a676ca87bba0b0b1275f3ce77ce9f04b94196972a721bff7791d5
SSDEEP 3072:ktKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:kIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

daytqoigay.exe

Path C:\Temp\daytqoigay.exe
Size 361KB
SHA256 3b01ae1af49c9def012ed572b7202df852772fc90c8a0d00c645b4d650314360
MD5 07253bee0d8b14dd8bfaec400e536bdd
SHA1 b63f916de32deb8da6fc981d7b1dc49687845011
SHA512 7a33e71136892780b34d390b7a194f1adb1ec6417b79f22f92dc6d950386827ea94122005826c8899a66169477e71b9988f68a704e18238611e03607675bbb9b
SSDEEP 6144:5flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:5flfAsiVGjSGecvX
TLSH
T18B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdyvqnlfdy.sys

Path C:\Temp\fdyvqnlfdy.sys
Size 293KB
SHA256 d252f9f6c98321f3fde4d920b37a57248fff5f4c5959da425b43a9846ff3e8f0
MD5 d4dcbf42667573c66ecd0be61afc1997
SHA1 34b4d59ace4c8ac54f0c1c9c53037a2b1e442d00
SHA512 32c610f645a92024299e3dd4296395166ed76b5f99ddc9d2aab5f5d55bcf078fe48593a7fbd9caa575fd3946078aa0cac0e2a5d3e7698f2d0e16f5daac2db83d
SSDEEP 3072:MtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:MIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytojdbwr.exe

Path C:\Temp\gbytojdbwr.exe
Size 361KB
SHA256 18ae3fd70f0c7f1ebc5af52a8c4fb31ccf10bfdc1168ac4ed2b24ed36ccb0446
MD5 3fe5ed24327266a2b4c806d8a95d899f
SHA1 23e53041d790d9284c9a4f2bf1cf13910cb07cab
SHA512 0e2c0aa3da0fd5b761c8cd2362f89070f5f952cd2c6591afa580d3bc11bad4df61a1c28772e03fb28fab65743f66b4befcf9ebea184c00427ba293e4880eb13d
SSDEEP 6144:xflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:xflfAsiVGjSGecvX
TLSH
T1E9747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytqljdby.sys

Path C:\Temp\gbytqljdby.sys
Size 293KB
SHA256 3b2577609017531e64de7cd555720c3bdf9825c9b722cbcc16771091ef49b7f9
MD5 fc2dcaff333665ce4ba95394bf2d78cb
SHA1 4c51efc6edf01dbd73301063241508ad39a23f46
SHA512 af0b7b0306ecc293d7bb9ae3f8fe21484096cb9a36a59ac672a0b2f6606c0c79bee70ad0c2662949a9d437e433d221e9d75486b67b7577402dbb029f56c2c596
SSDEEP 3072:RtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:RIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_daytqoigay.exe

Path C:\Temp\i_daytqoigay.exe
Size 361KB
SHA256 79df49bb7bcf73fc4889c8904ec7e2521b5813aa9b8ebcd52a4b0f6ea5d962f1
MD5 320a7fb7ad9a51df9391c94152fde9e1
SHA1 b99191c878c8c3912791efc2cc902f110bfaf038
SHA512 9abd95660e1339f602ec76bbc69b92ab8136d84510b405e2b63c021b3867f9b180d93a5a7fd670d7d81f5df29e2eb6ca8b30c0d69d724218ec7e617fad85a502
SSDEEP 6144:5flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:5flfAsiVGjSGecvX
TLSH
T1A8747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbytojdbwr.exe

Path C:\Temp\i_gbytojdbwr.exe
Size 361KB
SHA256 a8a08bf2dc08662751c31207ecb16ba50e100cdd546ccb63fa69cbf6ed541935
MD5 652627741e87f8623a1145f9d05b917a
SHA1 7fb3f4199cd53dc7d470ba6d42f8d6a5c2b75e0d
SHA512 e40cfbc45e82502f7f902c7177cdbb546e4ac3870df0e61641f1c34d238ba24fa0c79daab128743315c91100fa2baa9b64a535e26ed9c0863e93bf9f596aaad0
SSDEEP 6144:YflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:YflfAsiVGjSGecvX
TLSH
T1BC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_snkfcxvpnk.exe

Path C:\Temp\i_snkfcxvpnk.exe
Size 361KB
SHA256 0b01eb41aa8052ff66c9be8e5f3871ae6a4f4fe844704c5489c57a1ecbae4e0d
MD5 3a00bf64d91b0a2eace0382bf549ef42
SHA1 83565e97729eba8b3092826e8861fc699fec1837
SHA512 1e54fd11ad0508a42b9b018b22baadc816c76237219f22308e1e32b250c4cb3e3d85a59e1311f5bafe878eeaed286ad5fba60669491ad46f9872f8cfd9747b7d
SSDEEP 6144:zflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:zflfAsiVGjSGecvX
TLSH
T155747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vqnifaysqk.exe

Path C:\Temp\i_vqnifaysqk.exe
Size 361KB
SHA256 870bb296ce82d0fdcc80ef7a3dbf54295678de4a21b0622a587319e208cdcbc6
MD5 31cca3fb12b6acfd049327f27dc9bcd8
SHA1 9d9bb18f44ea2b7ab10def4164e4c508890d2414
SHA512 10004aeea7b55ccd825a01195bdba65a5e23f823a4a3fe58957ad5b3784d86a2c74ceb02a4f6abf4ea8fe8ee5e059d61cde84ef72971c1c565dc9f151c1d5532
SSDEEP 6144:OflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:OflfAsiVGjSGecvX
TLSH
T175747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvqnigaysq.exe

Path C:\Temp\i_yvqnigaysq.exe
Size 361KB
SHA256 0db643e8854446def4e56fc08d88f7c67aa4739ec45aa063dd3f5946ea5ba7da
MD5 5085feb4b1ff56ae3a941c6f1f1e221d
SHA1 610f8c2412b2d82d67d1f71b5b6b11cc20e3bfcd
SHA512 4c009c63cd01644629a370e1cbbbf1393568677a08c183ee12a32a73913d1d50054f0fab5162d9020e128cd011b4852aff95f79578dd21be4d9ff98e1914169f
SSDEEP 6144:bflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:bflfAsiVGjSGecvX
TLSH
T1EF747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecxupmhe.exe

Path C:\Temp\mkecxupmhe.exe
Size 361KB
SHA256 ea1b4ee93867cdc90b80aa3b6bd45dcf43707a883120b0e269a1dfe634c16f44
MD5 f977f80775d40428cd246b6ed3169ebb
SHA1 807d9b9bd6a9305f60ed957a192847bd62daec13
SHA512 b82d2b5ad589a6460f49d19da8239c1b359a7c3a7f1c2c17effe9293d5f4f4280af9b58f918a73981266a3b33721e1a1de0f6b0e2e04d44d8b1b2dd76b56861b
SSDEEP 6144:tflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:tflfAsiVGjSGecvX
TLSH
T1F6747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkfcxvpnk.exe

Path C:\Temp\snkfcxvpnk.exe
Size 361KB
SHA256 40985212f573875e1e439e017129da938ccbd8bed1282a7014837de054a71959
MD5 fd958d9894290c491b8bd90eb02dc532
SHA1 ae096d7c66f69c1647a2830bd51f19311b1debc3
SHA512 93ce32479c2f8c673fbd817a1bf97311602da196acaed956edbab9949c7c6b734b14d4d80bf970a1d3fa68ff10bf6853912d5bd51821baf2c4941eab350ff0af
SSDEEP 6144:cflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:cflfAsiVGjSGecvX
TLSH
T1FC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uspcauspkh.sys

Path C:\Temp\uspcauspkh.sys
Size 293KB
SHA256 d996619e993b045a11cd4907f53fb9a3a3d5681f4c9f275467f54720ad5b9de0
MD5 4414236b221df3b4f58270ef9080cfd2
SHA1 08e4dbd1382c1cf832757f019f00ec1f43eeba32
SHA512 6e1d381f0cac19476584994d8c0db9653f13805f1c5d136eac5ab9d509c2bcdbe9dfb447c2f73c7eede03e2ce3984f2fc8492ba79600f9cbccd0181e3987a784
SSDEEP 3072:2tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:2IJjiJcbI03GBc3ucY5DCSj
TLSH
T133545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usqkicausn.sys

Path C:\Temp\usqkicausn.sys
Size 293KB
SHA256 2b03b54174ca38bf09f60f1fad16d9853c77cfd3a15cbd3d4215bf2dd8c8a957
MD5 75c582d65b742e2d55f7d2b2b4ad1672
SHA1 6f4f150a0076b40cf46f88ebea18363102560dd9
SHA512 3825394c46e5faae7c9599a2f895110159804dc9fcc349706651c649c3be2aae11488e708a7217af5f887a408781e19eee2c691acf4f5062a29b431efaa360c6
SSDEEP 3072:ztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:zIJjiJcbI03GBc3ucY5DCSj
TLSH
T144545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqnifaysqk.exe

Path C:\Temp\vqnifaysqk.exe
Size 361KB
SHA256 1964e0677d4e940804aa540135ae06a9031bf8ff498a62e37c3873197c911871
MD5 05ee0ec3dfce8ad270d3b681b3fc685a
SHA1 322c283c2df0d52a2176a5d027fffd82bcbbfa0b
SHA512 19776cde510b648fb92c38e4802198efdd95f27889d8fd9d4a95c58fbee578c048d14400e53ce99438bd13aadf3be9e3f47f854700d619d270bdd6f69008c63f
SSDEEP 6144:HflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:HflfAsiVGjSGecvX
TLSH
T1C7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvsnkigays.sys

Path C:\Temp\xvsnkigays.sys
Size 293KB
SHA256 f2f5a8374395d32775e4bb48f6691aec9b209cb46c1475588b1ed6b55599a33b
MD5 eb72ef977e5fe15be501c1fac5467034
SHA1 88c967129d8fe25c804c3e7bdac4170bd9acf707
SHA512 d4a33dc557efefc4234ca95d3bcee3bce2706c3670c50f478e5bae69a97afa3bb23934464a766cd95db135288fefded5d9aea4ac86f7d6676e88af396694f1f5
SSDEEP 3072:LtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:LIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqnigaysq.exe

Path C:\Temp\yvqnigaysq.exe
Size 361KB
SHA256 79eacb05e53c77a3bb560699e034c1980cb21fb3ad702f91da7e49bcfeac8114
MD5 8e0b951817effc42d842dab4213f1a01
SHA1 49c50b8d7072ab5b6f4adff8c412200904e4294b
SHA512 3521585e605dd0048a948e3c00e9c4433289ff9206da23732ab7e4e428a1eb6dd6c86a528bdcdb6c357569a1d07d483975c12cbb7fae7216b87a0ed290c8aba0
SSDEEP 6144:eflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:eflfAsiVGjSGecvX
TLSH
T1FC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 233c07bfff48b5fbad30cd7d90579abd0886400017cd6e7fb037e5626abb1a4d
MD5 71fa6328268340b183c55defa643c474
SHA1 7c004defb21dc2981b3091495c900e02b34e3a86
SHA512 e5b634d358633981cd343c3da26ee18738fb6c54b2334814637e0a9a45343d14770fed7a09c63d55dd190bf7ef111664ba5872f5d5ce925e6bee783e166c75b7
TLSH
T1D4D080F437A5F505C786617357D0574173650872101647095151D02CCC645DD63DB1DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2fd9384e79508a77111bb6310e9414898358885ca508610502ff6f1a15ad704f
MD5 714e68787bb5a6d2fd82139f833a5d0d
SHA1 f7a22adc92641d05515b3ae096da910924f11c1a
SHA512 b133f27abfa4ed5bdbd3eaf997e0664f0627537d4882fdaa63c0b1b301219d07f8ba46857db9a196b1210c29ed9f79e6cfd8c688d502b118a21640805665f762
TLSH
T16DD080F43795F605C786617357D0574173750872241647095051D01CCC645DD63DB1EF
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 05025762315617fe2f55c5c77ec8407698e931a9e40cb42e557a44572cf55e20
MD5 13b6a3a7c5aa4c710defdd371698f68a
SHA1 fb6265a523a2e69f057b7f1a634ea7fdbf4cec95
SHA512 0cf13268a0a026382cc9af216fa33571580baa402e099b75a1ac9d6341c71fbee4d42a69af5a093500a1ad04eb3d52f3386577b9da4284267077363db5c50cea
TLSH
T141611BA618624926CB2F51B61BFE7098B770C1A6762B3E2611B4B4F4D46E30CB0E2535
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b1f1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b1f1.TMP
Size 3KB
SHA256 872a7723ae5efa1e5dc3063c4835063ec9e2854b3937d5a7002bd616c4b23481
MD5 52d7be2131da04d82bb5783b57af8802
SHA1 0fddc6974f68e03606cca7ce9d84ef5bc7fa3f4e
SHA512 6237249892df428207b1d56b9476fd6d1c7b27cf80707207eb20c9d71a2eaba1f565210d9dd4388182929886e12d609b93924533aae57740d6d94b8d4c7a303d
TLSH
T1CB611BA619624926CB2F50B61BFE70987770C0A7762B3E2611B4B5F4D47E34CB0E2535
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

684c2e04-3c43-42c4-95e8-9cdbf07ece58.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\684c2e04-3c43-42c4-95e8-9cdbf07ece58.tmp
Size 2KB
SHA256 a769d7c871535f24ce8e4f26f6f686593bdf4ac764422fd8ec7117259351fa6b
MD5 f61ce9cc283f8392b6b20f1163f79209
SHA1 e9de0b5cb5d31c3d911e027e7e396714797e9a8a
SHA512 c6020a87e221c2c61f07421e10226eafc240b838b2994afdf87d8c57b135442216f0162e31ae6a765f4f027d9b2bb7632631972eef70eff02094d0b54e4e2b3f
TLSH
T1A051CDF7C3E8856E891146F0BA147E2BCE1D0914832C3D5AC9E4AF5B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

7f2cd608-318a-45a8-9568-b296019853e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7f2cd608-318a-45a8-9568-b296019853e0.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 bba8323682b7d033c557fe3aae8171b721a5855c9d0804ccf6efcdce60dd2079
MD5 949e3d8809ee7d58c9b1be414f945819
SHA1 044133bc44a6bf964f09d8e2528b77750e456b8e
SHA512 e8873a28beb7461fe6d9fcd74bdb9b1a71e73cac4a77434080b8c24eae68959fafe152e2be1196943774bcda30b2f4d186eaf11887e006457bf6645c311c3a77
SSDEEP 192:sxR4RbyM/jK1Ml8wcf/fKsG0KdJZ5gzoA8p9R/g6+WNC6I/YyZJZGdIgtJ:sxR43Cf/fKsGHH5Z7/5g/hS3
TLSH
T16862DA15A938597B8CDBD309FA557F53D6F81473A2501E48AAFCCA1C01E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b2d5807ea618cdbaf31b065ac52bb538d196c31a4a5d056ee1e2c62bc3e674ea
MD5 00277e30b450289be8a38d3a6d3da486
SHA1 c0acab63cefc72e1045f2986245585b0276235a7
SHA512 2aca318c6ce3593eaf8d452bf4c3418a38680baa83ddd385109133e86655b557160f864fdd7b4c3e142e8cf27cee70bd506844185aec7c0bdbe8911bd5acc1ca
SSDEEP 192:sxRXRbyM/jK1Ml8wcf/fKss0KdJZ5gzoA8p9R/g6+WNC6I/YyZJZGdIgDbJ:sxRX3Cf/fKssHH5Z7/5g/hSJ
TLSH
T16862D915AA38597B8CDBD319FA557F53D6F81473A2901E48AAFC8A0C01E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 af867c7089ec7b1afdf526caf222305a6342d40cac4bf39b50a80d3695f1674c
MD5 dc1a2319df624f7868c0f1cd1f8cd383
SHA1 c926b1a40f6de4985736e61f9436abf4d5c53d7b
SHA512 ea0f7298934304dfe9fb1cd6aa733d123000a529bfa1e7d140dd32dbe609c8c5562f06e19b8846082a237f7d529a97db2cbcd8779863e0cc302cc1c5d9f5ce2e
SSDEEP 192:sxRXRbyM/jK1Ml8UQecf/fKss0K+JZ5gzoA8prR/g6+WNC6I/YyCJZGdIgDRJ:sxRX3qdf/fKsssH5Zd/5g/+Sn
TLSH
T1B762D916A938597B8CDBD219F651BF53D6F85472A2901E48AAFCCB0C01E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 1b55665cf9502d4bfbe6be192c0c32398f5fcb05565781751b757eec121b39d4
MD5 4ef3545685746109da3d11324d553b10
SHA1 86c8275f1a98fe0c0e278acd449fa10b2a76a13d
SHA512 3fe6abb1ffa40074ce0121e9a6f7afb7b443fb7c39df97791f77a0bdf61b058b29470bb450001c41b4cf451c96ee8ab291fac7a90e03927f6872754cd2d51fd3
SSDEEP 768:AIox/O7pLuL7p0WguMfnA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVlTgcciLro5zlTf:AIox/OE7p0WguMfnAu1jaiTgXi45zR
TLSH
T1C4E2EB3B680CCB7F4F804A9CEC29BE8E6DA801CF96D8CD5447FA851C03C66EB55165DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e98b3a4403091d7836aa862af49852f2c7506c02173e535f471629219162d2d8
MD5 34fe13b20109fee549556e8fcd0809d7
SHA1 c89bc769b0917cd3b5875748231ffa7d0834015f
SHA512 d3718d9604e3f043f02b32e8eb83914d574ec40e8bcf302efcf26b3b8e50d2dc0af0eb43a1dc57af2a67b9b2362292015945e1796e2fef2c5d3c2da43fc194f0
SSDEEP 96:KwnaKgU+yagKLiV0VAE+imkWivPgMkK4BgGkckEP+k5HT8ZNbRW:M5/g0VAE+imbiv4MYBgGLkEP+k5HT8ZO
TLSH
T11D917414357F5780383E380E86E5991B428230B2759BB52B7FE891D65F27E018DFD9CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aaf4c1c2-8782-482f-ae3d-d62401e7a536.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aaf4c1c2-8782-482f-ae3d-d62401e7a536.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b2d14389a0a35a65c52a6949b0699ee1192d82096017e7eef13ed008adaa73ae
MD5 e6f29ae1301a18c086766127faf44330
SHA1 9592fb1b63627b9b4db64e1b8a683a710c40ec7d
SHA512 bf84f585eece1c7c410a63373cafc3e54dd19112cc0f16a2135bcd2590575b67b21eb32f2411872dd5ac320313e6d2e37d923bbecb43dd1863d311d91bc3211f
SSDEEP 768:9rv+4UNbdF3301QOJIYU/hUAFjQIMyOV3N5E9Mm6+8r0mL:9bsbf3dhNFUIpONNmODrv
TLSH
T18703BF32F8A4DAB39CEBE6C5760A72437FF441A355C50A84C9DE2B0D824B5DD231BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0aad0b18239f9966a6ca1c3ec4e4634c60b7fca7feb370bb2eab2d02149387ee
MD5 afd51bccb2835c491b34a8e6c33f325a
SHA1 6029d83da6b2c445793654e354d15b0a387f62d6
SHA512 2df8eaf5df5c8f5020128d95229ba83892315fff735da35bf6f64ae6af07be84f10bb8b13f3b6b26b14491d7b9e04347264b2d70fa03c186eee6d2e6ff5d0146
SSDEEP 768:Zrv+4UNbdb3z6ziQOJIYshlo/hUAFjQIMyOV3N5E9E3RNo5:Zbsbx34lYhNFUIpONNmWe
TLSH
T10C03BE71F8A8DBA75CFBE385B21672877FB4106748C50A84CDDE6B0D424B29E174BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0aae536194aa64e082ccb575a8968a221be3019c81b511e9e678c9c1974abd64
MD5 fcb53dd68ed762bdb57c3e470121ac34
SHA1 9a60798085294aa221cb4c400e468a607e35e1cc
SHA512 7126fe2335c1b9e59e64d68b9ad5369d2823e7ef0ce4507a0152d8967cecb1f47387bc307ae65bb37fe6a42918adbfefed3b436066ac5d3c41bee6cf27436444
SSDEEP 768:tj+9V366AiQOJIYshlA/hUAFjQIMyOV3N5E9E3b9MH:I9V3olQhNFUIpONNmWb+H
TLSH
T188F2BF31B865DFA74CE7E3C5771632866FE4017B44850E88CADEAB0D028329D0757C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a62727ed04baea35a2513315a3e33efffd99d75e54b6c0e9390d3a1550d392a0
MD5 20243721dca6cd4564e16e88739d16f3
SHA1 5193d555441ad8860e805465f2766d346447cf46
SHA512 73f1ec2b688033185e516b948daaca22bd6181d4eb0e798fa1cd2324245da97fa8510023b63b45d26f62238ba4a19ce6b8792a7665407d05465424583ab17288
SSDEEP 768:ij+9V3z6AiQOJIYshlA/hUAFjQIMyOV3N5E9E3b9MH:R9V3PlQhNFUIpONNmWb+H
TLSH
T103F2BE31F8A5DFA74CEBE3C5771632866FE411BB44851E88CADEAB0D428329D0757C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 cbcecf92af465ba9f1ae0aaefc2782111069c7b57de792f7118ed350fe560594
MD5 f2decc09fee856d4a2904703c9a5ba10
SHA1 6d9fd6f372bef844386fa568dca865c38f205bd9
SHA512 f45d7847ebc730c9770ddb0c90692b6c64b9693860b885a3fccb6b80a891df373622dffbb391592c2286080d257afe5730c954b9d8fceae7e63fbaeb4a7c8e2f
SSDEEP 768:zF1j+9M3BwgQ6GfrOJIYshlr/hUAFjQIMyOV3N5E9E3b9MH:i9M3WlThNFUIpONNmWb+H
TLSH
T1911338F5A8D3CA76D8AE9383673D2E469AFCC06774885884FBD95D0CCD821BFC246815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ed4a3e1-2a79-4d66-9e78-16f98ee28d3c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9ed4a3e1-2a79-4d66-9e78-16f98ee28d3c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2516_1291928291\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 98f3113ce4090a2f6c4bf8578b81f4793cf6b99c83c854e877d6ba899aa4e780
MD5 b59d75fc774f2dad7ff6c511efbc3917
SHA1 856253eaffb65dd0136bf6e8c2617777dca770ae
SHA512 a41d05999395e052420cd1fa773e6be3f1ca63d20b6e4f8fd4641315a4265c9256ed4f93e124756dd61dc2bc9f50fd355ba1c10bfd71f383fee197f1e088fba4
TLSH
T1C871238357A8D6B3C1DE5BF502835244F5FB223C072330600B96598BEB30A7A64B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/240-266-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1284-383-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1340-238-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2096-370-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2388-329-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2528-395-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2656-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2996-387-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3160-358-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3576-419-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3808-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3928-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4228-400-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4252-191-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4348-415-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4364-278-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4876-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4932-391-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5764-294-0x0000000000010000-0x00000000000AB000-memory.dmp

Download