systex | c501ae02cdbe96920cdab4a5508d13a0c6860b4e6cdaa31df8cea75d8c5c5701

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 20:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260706-yryafagy2m
SHA256 c501ae02cdbe96920cdab4a5508d13a0c6860b4e6cdaa31df8cea75d8c5c5701
MD5 c9c92225e60b56661720c7e936455a5c
SHA1 f160e5e598c8d666a82ddffd3b53a0c68c1a0c88
SHA512 fa105d9846a9a765c3fee02cad2b5405ff92b0ef9b7491969c211967bc3e1017db4d69b1f7b8242e4c50e05c880f19614d91b7d68bfd104e64087b74190b3e29
SSDEEP 6144:9flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:9flfAsiVGjSGecvX
TLSH
T1CB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1428	gbytrljdbvtolgey.exe
2076	gbytrljdbvtolgey.sys
5520	CreateProcess.exe
5224	gbytrljgbv.exe
2672	CreateProcess.exe
5900	CreateProcess.exe
3864	i_gbytrljgbv.exe
4764	dbvtnljgav.sys
3492	CreateProcess.exe
1836	vtolgdywqo.exe
6128	CreateProcess.exe
1968	CreateProcess.exe
916	i_vtolgdywqo.exe
2480	tnlfdyvtol.sys
5220	CreateProcess.exe
2344	aysqkigayt.exe
3932	CreateProcess.exe
5188	CreateProcess.exe
1092	i_aysqkigayt.exe
2712	lfdxvqnifa.sys
4152	CreateProcess.exe
2464	avsqkicank.exe
5312	CreateProcess.exe
5472	CreateProcess.exe
800	i_avsqkicank.exe
3808	fcaupnhfzx.sys
5724	CreateProcess.exe
2596	vsmkfcxvpn.exe
2724	CreateProcess.exe
900	CreateProcess.exe
1712	i_vsmkfcxvpn.exe
4584	zxusmkecxr.sys
916	CreateProcess.exe
1976	spkecausmk.exe
876	CreateProcess.exe
3400	CreateProcess.exe
5580	i_spkecausmk.exe
5608	hecwuomhez.sys
4148	CreateProcess.exe
4816	zwrpmhezur.exe
6020	CreateProcess.exe
6124	CreateProcess.exe
2112	i_zwrpmhezur.exe
3956	ztrmkebwuo.sys
1540	CreateProcess.exe
3496	dbwtrljebw.exe
6056	CreateProcess.exe
1568	CreateProcess.exe
5812	i_dbwtrljebw.exe
2056	rojgeywqoj.sys
1500	CreateProcess.exe
1216	jdbztrljey.exe
5064	CreateProcess.exe
4924	CreateProcess.exe
4480	i_jdbztrljey.exe
2740	trljdbvtol.sys
4284	CreateProcess.exe
1136	igbytrlgdb.exe
2888	CreateProcess.exe
1944	CreateProcess.exe
5972	i_igbytrlgdb.exe
5476	yvqkigaysq.sys
2836	CreateProcess.exe
2432	nlfdyvqnlf.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping724_1311152259\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping724_1311152259\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping724_2060744003\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping724_2060744003\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping724_2060744003\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping724_2060744003\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping724_1454567615\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping724_1454567615\nav_config.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping724_1649220932\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkecausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igbytrlgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdyvqnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqkifayvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqlidyvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsmkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbztrljey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igbytrlgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytrljgbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsqkicank.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrpmhezur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbwtrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbztrljey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdyvqnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqkifayvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsqkicank.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbwtrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbolgdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtolgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkecausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrpmhezur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsmkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqlidyvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytrljgbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbolgdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytrljdbvtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtolgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecxupnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecxupnk.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1088	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4576	ipconfig.exe
3524	ipconfig.exe
3296	ipconfig.exe
4300	ipconfig.exe
204	ipconfig.exe
460	ipconfig.exe
4376	ipconfig.exe
4716	ipconfig.exe
5396	ipconfig.exe
5464	ipconfig.exe
3408	ipconfig.exe
5988	ipconfig.exe
1712	ipconfig.exe
1316	ipconfig.exe
1552	ipconfig.exe
2032	ipconfig.exe
4620	ipconfig.exe
4236	ipconfig.exe
5412	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{39E3FD9C-78D8-4F43-8BFE-59766320CD7B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1428	gbytrljdbvtolgey.exe
1428	gbytrljdbvtolgey.exe
1428	gbytrljdbvtolgey.exe
1428	gbytrljdbvtolgey.exe
1428	gbytrljdbvtolgey.exe
1428	gbytrljdbvtolgey.exe
1428	gbytrljdbvtolgey.exe
1428	gbytrljdbvtolgey.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3864	i_gbytrljgbv.exe
Token: SeDebugPrivilege	916	i_vtolgdywqo.exe
Token: SeDebugPrivilege	1092	i_aysqkigayt.exe
Token: SeDebugPrivilege	800	i_avsqkicank.exe
Token: SeDebugPrivilege	1712	i_vsmkfcxvpn.exe
Token: SeDebugPrivilege	5580	i_spkecausmk.exe
Token: SeDebugPrivilege	2112	i_zwrpmhezur.exe
Token: SeDebugPrivilege	5812	i_dbwtrljebw.exe
Token: SeDebugPrivilege	4480	i_jdbztrljey.exe
Token: SeDebugPrivilege	5972	i_igbytrlgdb.exe
Token: SeDebugPrivilege	6052	i_nlfdyvqnlf.exe
Token: SeDebugPrivilege	3664	i_vqkifayvpn.exe
Token: SeDebugPrivilege	1288	i_kicausnkfc.exe
Token: SeDebugPrivilege	3056	i_smkecxupnk.exe
Token: SeDebugPrivilege	2840	i_xrpjhbzurm.exe
Token: SeDebugPrivilege	2208	i_bztrljebzt.exe
Token: SeDebugPrivilege	5808	i_ljdbolgdbw.exe
Token: SeDebugPrivilege	3056	i_trljdywqoi.exe
Token: SeDebugPrivilege	5872	i_vsqlidyvtn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
724	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 1428	1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 1284 wrote to memory of 3820	1284	2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 3820 wrote to memory of 724	3820	iexplore.exe	89
PID 724 wrote to memory of 5028	724	msedge.exe	90
PID 724 wrote to memory of 1088	724	msedge.exe	91
PID 724 wrote to memory of 4432	724	msedge.exe	92
PID 724 wrote to memory of 4432	724	msedge.exe	92
PID 724 wrote to memory of 4432	724	msedge.exe	92
PID 724 wrote to memory of 3816	724	msedge.exe	93
PID 724 wrote to memory of 3816	724	msedge.exe	93
PID 724 wrote to memory of 5724	724	msedge.exe	95
PID 724 wrote to memory of 5724	724	msedge.exe	95
PID 724 wrote to memory of 5724	724	msedge.exe	95
PID 724 wrote to memory of 2968	724	msedge.exe	96
PID 724 wrote to memory of 2968	724	msedge.exe	96
PID 724 wrote to memory of 2968	724	msedge.exe	96
PID 724 wrote to memory of 2752	724	msedge.exe	97
PID 724 wrote to memory of 2752	724	msedge.exe	97
PID 724 wrote to memory of 2752	724	msedge.exe	97
PID 724 wrote to memory of 4584	724	msedge.exe	98
PID 724 wrote to memory of 4584	724	msedge.exe	98
PID 724 wrote to memory of 4584	724	msedge.exe	98
PID 724 wrote to memory of 4956	724	msedge.exe	99
PID 724 wrote to memory of 4956	724	msedge.exe	99
PID 1428 wrote to memory of 5520	1428	gbytrljdbvtolgey.exe	103
PID 5224 wrote to memory of 2672	5224	gbytrljgbv.exe	106
PID 724 wrote to memory of 5824	724	msedge.exe	109
PID 724 wrote to memory of 6012	724	msedge.exe	110
PID 724 wrote to memory of 5824	724	msedge.exe	109
PID 724 wrote to memory of 6012	724	msedge.exe	110
PID 724 wrote to memory of 3620	724	msedge.exe	112
PID 724 wrote to memory of 5312	724	msedge.exe	113
PID 724 wrote to memory of 5312	724	msedge.exe	113
PID 724 wrote to memory of 2368	724	msedge.exe	114
PID 724 wrote to memory of 2368	724	msedge.exe	114
PID 1428 wrote to memory of 5900	1428	gbytrljdbvtolgey.exe	117
PID 1428 wrote to memory of 3492	1428	gbytrljdbvtolgey.exe	121
PID 1836 wrote to memory of 6128	1836	vtolgdywqo.exe	123
PID 1428 wrote to memory of 1968	1428	gbytrljdbvtolgey.exe	126
PID 1428 wrote to memory of 5220	1428	gbytrljdbvtolgey.exe	130
PID 2344 wrote to memory of 3932	2344	aysqkigayt.exe	132
PID 1428 wrote to memory of 5188	1428	gbytrljdbvtolgey.exe	135
PID 1428 wrote to memory of 4152	1428	gbytrljdbvtolgey.exe	139
PID 2464 wrote to memory of 5312	2464	avsqkicank.exe	141
PID 1428 wrote to memory of 5472	1428	gbytrljdbvtolgey.exe	144
PID 724 wrote to memory of 5840	724	msedge.exe	146
PID 724 wrote to memory of 6116	724	msedge.exe	147
PID 724 wrote to memory of 1440	724	msedge.exe	148
PID 1428 wrote to memory of 5724	1428	gbytrljdbvtolgey.exe	151
PID 2596 wrote to memory of 2724	2596	vsmkfcxvpn.exe	153
PID 1428 wrote to memory of 900	1428	gbytrljdbvtolgey.exe	156
PID 1428 wrote to memory of 916	1428	gbytrljdbvtolgey.exe	160
PID 1976 wrote to memory of 876	1976	spkecausmk.exe	162
PID 1428 wrote to memory of 3400	1428	gbytrljdbvtolgey.exe	165
PID 1428 wrote to memory of 4148	1428	gbytrljdbvtolgey.exe	169
PID 4816 wrote to memory of 6020	4816	zwrpmhezur.exe	171
PID 1428 wrote to memory of 6124	1428	gbytrljdbvtolgey.exe	174
PID 1428 wrote to memory of 1540	1428	gbytrljdbvtolgey.exe	178
PID 3496 wrote to memory of 6056	3496	dbwtrljebw.exe	180
PID 724 wrote to memory of 1196	724	msedge.exe	183
PID 724 wrote to memory of 1196	724	msedge.exe	183
PID 1428 wrote to memory of 1568	1428	gbytrljdbvtolgey.exe	187
PID 1428 wrote to memory of 1500	1428	gbytrljdbvtolgey.exe	191
PID 1216 wrote to memory of 5064	1216	jdbztrljey.exe	193

C:\Users\Admin\AppData\Local\Temp\2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_c9c92225e60b56661720c7e936455a5c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Temp\gbytrljdbvtolgey.exe
  C:\Temp\gbytrljdbvtolgey.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbytrljgbv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5520
  - - C:\Temp\gbytrljgbv.exe
      C:\Temp\gbytrljgbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5224
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2672
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gbytrljgbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5900
  - - C:\Temp\i_gbytrljgbv.exe
      C:\Temp\i_gbytrljgbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtolgdywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3492
  - - C:\Temp\vtolgdywqo.exe
      C:\Temp\vtolgdywqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1836
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6128
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtolgdywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1968
  - - C:\Temp\i_vtolgdywqo.exe
      C:\Temp\i_vtolgdywqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqkigayt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5220
  - - C:\Temp\aysqkigayt.exe
      C:\Temp\aysqkigayt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2344
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3932
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqkigayt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5188
  - - C:\Temp\i_aysqkigayt.exe
      C:\Temp\i_aysqkigayt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\avsqkicank.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4152
  - - C:\Temp\avsqkicank.exe
      C:\Temp\avsqkicank.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_avsqkicank.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5472
  - - C:\Temp\i_avsqkicank.exe
      C:\Temp\i_avsqkicank.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsmkfcxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5724
  - - C:\Temp\vsmkfcxvpn.exe
      C:\Temp\vsmkfcxvpn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2596
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2724
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsmkfcxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:900
  - - C:\Temp\i_vsmkfcxvpn.exe
      C:\Temp\i_vsmkfcxvpn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkecausmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:916
  - - C:\Temp\spkecausmk.exe
      C:\Temp\spkecausmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1976
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:876
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkecausmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3400
  - - C:\Temp\i_spkecausmk.exe
      C:\Temp\i_spkecausmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwrpmhezur.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4148
  - - C:\Temp\zwrpmhezur.exe
      C:\Temp\zwrpmhezur.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4816
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6020
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwrpmhezur.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6124
  - - C:\Temp\i_zwrpmhezur.exe
      C:\Temp\i_zwrpmhezur.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbwtrljebw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1540
  - - C:\Temp\dbwtrljebw.exe
      C:\Temp\dbwtrljebw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3496
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6056
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbwtrljebw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1568
  - - C:\Temp\i_dbwtrljebw.exe
      C:\Temp\i_dbwtrljebw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbztrljey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1500
  - - C:\Temp\jdbztrljey.exe
      C:\Temp\jdbztrljey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1216
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5064
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbztrljey.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4924
  - - C:\Temp\i_jdbztrljey.exe
      C:\Temp\i_jdbztrljey.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igbytrlgdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4284
  - - C:\Temp\igbytrlgdb.exe
      C:\Temp\igbytrlgdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1136
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igbytrlgdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1944
  - - C:\Temp\i_igbytrlgdb.exe
      C:\Temp\i_igbytrlgdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfdyvqnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2836
  - - C:\Temp\nlfdyvqnlf.exe
      C:\Temp\nlfdyvqnlf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2432
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4256
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfdyvqnlf.exe ups_ins
    3⤵
    PID:704
  - - C:\Temp\i_nlfdyvqnlf.exe
      C:\Temp\i_nlfdyvqnlf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vqkifayvpn.exe ups_run
    3⤵
    PID:4356
  - - C:\Temp\vqkifayvpn.exe
      C:\Temp\vqkifayvpn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1304
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2228
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vqkifayvpn.exe ups_ins
    3⤵
    PID:4796
  - - C:\Temp\i_vqkifayvpn.exe
      C:\Temp\i_vqkifayvpn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicausnkfc.exe ups_run
    3⤵
    PID:1144
  - - C:\Temp\kicausnkfc.exe
      C:\Temp\kicausnkfc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2192
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1080
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kicausnkfc.exe ups_ins
    3⤵
    PID:5532
  - - C:\Temp\i_kicausnkfc.exe
      C:\Temp\i_kicausnkfc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkecxupnk.exe ups_run
    3⤵
    PID:5264
  - - C:\Temp\smkecxupnk.exe
      C:\Temp\smkecxupnk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2320
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1480
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkecxupnk.exe ups_ins
    3⤵
    PID:4972
  - - C:\Temp\i_smkecxupnk.exe
      C:\Temp\i_smkecxupnk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpjhbzurm.exe ups_run
    3⤵
    PID:960
  - - C:\Temp\xrpjhbzurm.exe
      C:\Temp\xrpjhbzurm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3844
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6016
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpjhbzurm.exe ups_ins
    3⤵
    PID:6000
  - - C:\Temp\i_xrpjhbzurm.exe
      C:\Temp\i_xrpjhbzurm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrljebzt.exe ups_run
    3⤵
    PID:3204
  - - C:\Temp\bztrljebzt.exe
      C:\Temp\bztrljebzt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrljebzt.exe ups_ins
    3⤵
    PID:2488
  - - C:\Temp\i_bztrljebzt.exe
      C:\Temp\i_bztrljebzt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbolgdbw.exe ups_run
    3⤵
    PID:204
  - - C:\Temp\ljdbolgdbw.exe
      C:\Temp\ljdbolgdbw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4720
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5388
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbolgdbw.exe ups_ins
    3⤵
    PID:1432
  - - C:\Temp\i_ljdbolgdbw.exe
      C:\Temp\i_ljdbolgdbw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljdywqoi.exe ups_run
    3⤵
    PID:3792
  - - C:\Temp\trljdywqoi.exe
      C:\Temp\trljdywqoi.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4316
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5936
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljdywqoi.exe ups_ins
    3⤵
    PID:5768
  - - C:\Temp\i_trljdywqoi.exe
      C:\Temp\i_trljdywqoi.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsqlidyvtn.exe ups_run
    3⤵
    PID:3620
  - - C:\Temp\vsqlidyvtn.exe
      C:\Temp\vsqlidyvtn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3092
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2188
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsqlidyvtn.exe ups_ins
    3⤵
    PID:5336
  - - C:\Temp\i_vsqlidyvtn.exe
      C:\Temp\i_vsqlidyvtn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5872
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x250,0x7ffa93e1c188,0x7ffa93e1c194,0x7ffa93e1c1a0
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,629083611413975254,11742121811875215200,524288 --field-trial-handle=2404,i,12123522666039892044,6231874509922178607,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:11
      4⤵
      System Time Discovery
      PID:1088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,328622107954004560,2272168185333153852,262144 --field-trial-handle=2404,i,12123522666039892044,6231874509922178607,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:2
      4⤵
      PID:4432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,9626417677414119856,16802881656989514371,524288 --field-trial-handle=2404,i,12123522666039892044,6231874509922178607,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:13
      4⤵
      PID:3816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3628,i,4000960873136027161,16870403080066525971,2097152 --field-trial-handle=2404,i,12123522666039892044,6231874509922178607,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
      4⤵
      PID:5724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3632,i,5945444210008417056,14139625099002938572,2097152 --field-trial-handle=2404,i,12123522666039892044,6231874509922178607,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
      4⤵
      PID:2968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,10532032003656542749,16259241202717415619,2097152 --field-trial-handle=2404,i,12123522666039892044,6231874509922178607,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:1
      4⤵
      PID:2752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,1551039665600881108,15234551346412051690,2097152 --field-trial-handle=2404,i,12123522666039892044,6231874509922178607,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:9
      4⤵
      PID:4584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,15954427249920696460,8350351828322023679,524288 --field-trial-handle=2404,i,12123522666039892044,6231874509922178607,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
      4⤵
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,17564330102973378448,13297454158540172931,524288 --field-trial-handle=2404,i,12123522666039892044,6231874509922178607,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:14
      4⤵
      PID:5824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,17275237641862588449,12506082073467323823,524288 --field-trial-handle=2404,i,12123522666039892044,6231874509922178607,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
      4⤵
      PID:6012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,4035293570724775081,11552509931024156375,524288 --field-trial-handle=2404,i,12123522666039892044,6231874509922178607,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
      4⤵
      PID:576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,4035293570724775081,11552509931024156375,524288 --field-trial-handle=2404,i,12123522666039892044,6231874509922178607,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
      4⤵
      PID:3620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,2327942179550951070,11210492676644163108,524288 --field-trial-handle=2404,i,12123522666039892044,6231874509922178607,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
      4⤵
      PID:5312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,8081142340160602,6472842949864320537,524288 --field-trial-handle=2404,i,12123522666039892044,6231874509922178607,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
      4⤵
      PID:2368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,11282273759477786565,14442531148072055584,524288 --field-trial-handle=2404,i,12123522666039892044,6231874509922178607,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
      4⤵
      PID:5840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,16053056348474074890,12607938139280073736,524288 --field-trial-handle=2404,i,12123522666039892044,6231874509922178607,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
      4⤵
      PID:6116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,18051886995255119551,231581294606819852,524288 --field-trial-handle=2404,i,12123522666039892044,6231874509922178607,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
      4⤵
      PID:1440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,14846194724334570986,13868813736555241551,524288 --field-trial-handle=2404,i,12123522666039892044,6231874509922178607,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
      4⤵
      PID:1196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,16692735515385924574,7987702400056965622,524288 --field-trial-handle=2404,i,12123522666039892044,6231874509922178607,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
      4⤵
      PID:1956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,1713702462312424996,432226087610170362,524288 --field-trial-handle=2404,i,12123522666039892044,6231874509922178607,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:14
      4⤵
      PID:4584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=916,i,9682767639202554109,1871159128164392512,524288 --field-trial-handle=2404,i,12123522666039892044,6231874509922178607,262144 --variations-seed-version --mojo-platform-channel-handle=912 /prefetch:14
      4⤵
      PID:3124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6900,i,12455758674669952438,2461003967170513463,262144 --field-trial-handle=2404,i,12123522666039892044,6231874509922178607,262144 --variations-seed-version --mojo-platform-channel-handle=916 /prefetch:10
      4⤵
      PID:1988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,17544458123263465206,14913480690709203515,524288 --field-trial-handle=2404,i,12123522666039892044,6231874509922178607,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
      4⤵
      PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4484

C:\Temp\gbytrljdbvtolgey.sys
C:\Temp\gbytrljdbvtolgey.sys
1⤵
- Executes dropped EXE
PID:2076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5840

C:\Temp\dbvtnljgav.sys
C:\Temp\dbvtnljgav.sys
1⤵
- Executes dropped EXE
PID:4764

C:\Temp\tnlfdyvtol.sys
C:\Temp\tnlfdyvtol.sys
1⤵
- Executes dropped EXE
PID:2480

C:\Temp\lfdxvqnifa.sys
C:\Temp\lfdxvqnifa.sys
1⤵
- Executes dropped EXE
PID:2712

C:\Temp\fcaupnhfzx.sys
C:\Temp\fcaupnhfzx.sys
1⤵
- Executes dropped EXE
PID:3808

C:\Temp\zxusmkecxr.sys
C:\Temp\zxusmkecxr.sys
1⤵
- Executes dropped EXE
PID:4584

C:\Temp\hecwuomhez.sys
C:\Temp\hecwuomhez.sys
1⤵
- Executes dropped EXE
PID:5608

C:\Temp\ztrmkebwuo.sys
C:\Temp\ztrmkebwuo.sys
1⤵
- Executes dropped EXE
PID:3956

C:\Temp\rojgeywqoj.sys
C:\Temp\rojgeywqoj.sys
1⤵
- Executes dropped EXE
PID:2056

C:\Temp\trljdbvtol.sys
C:\Temp\trljdbvtol.sys
1⤵
- Executes dropped EXE
PID:2740

C:\Temp\yvqkigaysq.sys
C:\Temp\yvqkigaysq.sys
1⤵
- Executes dropped EXE
PID:5476

C:\Temp\licavsnlfd.sys
C:\Temp\licavsnlfd.sys
1⤵
PID:1180

C:\Temp\snkfcxusnk.sys
C:\Temp\snkfcxusnk.sys
1⤵
PID:6140

C:\Temp\axspkhcaxs.sys
C:\Temp\axspkhcaxs.sys
1⤵
PID:4316

C:\Temp\hfzxrpjecz.sys
C:\Temp\hfzxrpjecz.sys
1⤵
PID:5812

C:\Temp\xrpjhczurm.sys
C:\Temp\xrpjhczurm.sys
1⤵
PID:3096

C:\Temp\wrojhbztrl.sys
C:\Temp\wrojhbztrl.sys
1⤵
PID:576

C:\Temp\eywqojgbyt.sys
C:\Temp\eywqojgbyt.sys
1⤵
PID:4092

C:\Temp\gdyvqoigdy.sys
C:\Temp\gdyvqoigdy.sys
1⤵
PID:3684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avsqkicank.exe

Path C:\Temp\avsqkicank.exe
Size 361KB
SHA256 58affb99bfd783f2d487c0df5634a1cce241facfe1278a7322c8fb68ee570f2f
MD5 87c50892eebea670dc557b9ef1d2d2a6
SHA1 63f39eaf93820813f04e0a44ce9435d0da9f3d42
SHA512 45d4d18cd016ea7b073cad5183aebd8852066a122372d079795c1f877a09fcf591cd1585629289ba546fabe2e7832006a8d085c715b4dffa53081d86ed01f56c
SSDEEP 6144:bflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:bflfAsiVGjSGecvX
TLSH
T1BF747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqkigayt.exe

Path C:\Temp\aysqkigayt.exe
Size 361KB
SHA256 5ea21c89baf2174593b98cae981d2fb7344d0051f65796b58bd7fb94ec674a3f
MD5 9bab842e28109fb0dd0220524564509f
SHA1 6ec1924c49f776ff93a198490646383c1232a748
SHA512 0eb91059b1a12bbce706b83affa0763940de75a7069939350084c7dcc36c370f5745baee381a79561c1b93e8a7a5e664475394338ca6b745e7cf8a84cc59f3a0
SSDEEP 6144:7flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:7flfAsiVGjSGecvX
TLSH
T1F9747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtnljgav.sys

Path C:\Temp\dbvtnljgav.sys
Size 293KB
SHA256 54dd06e0103e25276a7d7ca5248c5a28967bb4dfc46ef481716e5d5069a2e9a1
MD5 2525ae50b52f1d0246459edbf05230c8
SHA1 53aa381fbea686881bc7cbf4a38d209e466ed90f
SHA512 f434d79378fe0b45005bb6cb754e93a82a095e55d1996708c502baa13fc9343fb83108eb4d8dffea0327f795540340a0df52bc68d36517a9dbbe56143abdd599
SSDEEP 3072:8tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:8IJjiJcbI03GBc3ucY5DCSj
TLSH
T197545B44AAA4B0F6D9D5043C00EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcaupnhfzx.sys

Path C:\Temp\fcaupnhfzx.sys
Size 293KB
SHA256 f9b087e1c38e79233d988b281a54563a46ff68edf19104dcce078ad2b8c85716
MD5 0ed84b674b808e781cd027b456c8a6b2
SHA1 4c0186aeb274e0765983579bd1e2cc0796fa4f59
SHA512 01045e424b64f39a92f91a2cc9b36d19a673815ef1800e23c61c87bb0fc58a4f505b9b64344b943071a5ceb1895c6aff54aa3094a5c8e143b1c6a4474f83c417
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytrljdbvtolgey.exe

Path C:\Temp\gbytrljdbvtolgey.exe
Size 361KB
SHA256 a56ed6216b6ea6a4a56c9099f6a31614685872d7a64bdf0f0b971d7516e525d4
MD5 c2bf49c84d11f2a028a309d7f59d2415
SHA1 3f4fd0573f4a7fa841485869eab1eabfe501a9f3
SHA512 1970a71b85a97c9459ee3e49c63c061af9c2dc2a82dc115df13fdf2d26174d6125d22d7b897967e386f326b60e396f5b7cddd808410ba394f32ef7de65f23add
SSDEEP 6144:7flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:7flfAsiVGjSGecvX
TLSH
T133747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytrljdbvtolgey.sys

Path C:\Temp\gbytrljdbvtolgey.sys
Size 293KB
SHA256 938a291b3158dd33c59aca9ff9734ef8c2f4a86d09bc3e9e29a15a913a658fa0
MD5 5900f4015d88c0986c8a7bb4c1903d72
SHA1 565847cf0f2ebba3736e069457abda1298d79e0e
SHA512 79c784f33d9c847c1d4464bf47cb81577bc884e787ef2bf1947265379e66d09d66abb3faf3d3d983cc073d846d721443f017727bad2eccde87c3bbd1880d0533
SSDEEP 3072:+tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:+IJjiJcbI03GBc3ucY5DCSj
TLSH
T132545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytrljgbv.exe

Path C:\Temp\gbytrljgbv.exe
Size 361KB
SHA256 b947d389f8c0783a86e6192cea4e14def319c4ac22f01b16c4eb79c23a65c9e0
MD5 649c9d20dcc86a70634b721f59614712
SHA1 0e71d66176765a0c9e273c0e8b6fc358682e1403
SHA512 7d9723c79f6d9c7b6473e7838cb3b53bebd8dfa984ec0fc44f1a22e58fee1ed66a547e1e2959d666f78e236cbd47b9b5b0ba7f1cf12df01c1ab7961c09321ca4
SSDEEP 6144:WflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:WflfAsiVGjSGecvX
TLSH
T1F6747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_avsqkicank.exe

Path C:\Temp\i_avsqkicank.exe
Size 361KB
SHA256 99c2839cc782bbcdb9e81a8c26b8813846ec73d5c83690a18af660ed7a7b8463
MD5 3c6b19f56e6cc3dd8c47f777c0584187
SHA1 824b1fd3a95750bea0c61e52fab38cbe300753a0
SHA512 cef1e714561c9e636d0b59cf8e04acbc90879683a29f1ff38cdbbef29cbcb553a738a6f6c97a8a3057b65dcee6e247196e8304814f139f8bfe058221dcdb5018
SSDEEP 6144:lflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:lflfAsiVGjSGecvX
TLSH
T11C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aysqkigayt.exe

Path C:\Temp\i_aysqkigayt.exe
Size 361KB
SHA256 740139eb88df3154c6ecaadcc12e7f979edac2449bbe6ce9caa303949642be0d
MD5 796a91c9e0d8869cd4616131b0b0f9c4
SHA1 0f2ea24ae1df99b3cb983c53dc5720cb2064ef77
SHA512 f92622cef8d57e3b64794ab458c5a499363f1590249435b1f15d0fdaaf20c043897971561b519db0870cb5d0bf05c2383e24d563d81df841b468ff9ca0d5d2a6
SSDEEP 6144:6flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:6flfAsiVGjSGecvX
TLSH
T1CB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbytrljgbv.exe

Path C:\Temp\i_gbytrljgbv.exe
Size 361KB
SHA256 9432f0a62959e1eb5af2a6d71f6d561053b2a054fb1a6e1a1d9ea22ea1b6e086
MD5 6be8de9cda2ee5fccef03a974a276416
SHA1 8781f5c49752c63ff7738b3d91e43bfa2db25e7e
SHA512 166bb56a44d6c1a4123405c4f59ad528de0efc2041e71106d70734fa2a548740ee78d68a6a5d5ea701069d0d58c29d3c991106a28d3b305fb375df5f84e1037d
SSDEEP 6144:/flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:/flfAsiVGjSGecvX
TLSH
T12F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsmkfcxvpn.exe

Path C:\Temp\i_vsmkfcxvpn.exe
Size 361KB
SHA256 67cbd69962d6d491778cb5a8c257dc2c44af02e1da270c0260005c9138ac9fd1
MD5 0288c5fa07c6d4aa2e3545eb77c0e346
SHA1 433d7964f51e14fcf32a2fb5317c0865d759ffcd
SHA512 b1eec37a52d240e5466994dddd5375412763d374aa8a44499df89bf413d3c94a9a2c7de627cc1aef1f338529a5f39801217fbe98f23551674b280c0f4eeab494
SSDEEP 6144:JflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:JflfAsiVGjSGecvX
TLSH
T1F4747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtolgdywqo.exe

Path C:\Temp\i_vtolgdywqo.exe
Size 361KB
SHA256 0b3e36029147ecef4fca448c0160f414ef9c4199a5bd0087397de091cd2b04b2
MD5 1ed6929b6d3c590c7628f22521b8b886
SHA1 9627d4986a220db01af8d406cb1034c8157260d2
SHA512 2636183f703085b799585a0fbaae16f8e6daf4f5d2613bd8ad17b877b172f1ee95e15c752215afe9c617cc665f35996568981ccf7df213bdaf204b9413941652
SSDEEP 6144:8flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:8flfAsiVGjSGecvX
TLSH
T10D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvqnifa.sys

Path C:\Temp\lfdxvqnifa.sys
Size 293KB
SHA256 e4a466736c5bb775cf5b3809adbbe0f77da8063369419eefe7de119ec48c25e1
MD5 8a1e03ff63ffc132c3304bb01b0a6a4b
SHA1 ac0b41c97ced3d3756d5a9d23aca5516408c0135
SHA512 59ca19a0fb7a96b777f7659ac0c0baeecbb890eaa6fcb1b432d3c0775b4439a7a14388e6618f2c05734f0ce369024d78af079ca9701eca70d5b9812fdb7f7393
SSDEEP 3072:MtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:MIJjiJcbI03GBc3ucY5DCSj
TLSH
T15E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkecausmk.exe

Path C:\Temp\spkecausmk.exe
Size 361KB
SHA256 e40758e2e95323368f4ff78870d95640bb4803cd6653584b58f3ba12f7dc6a1b
MD5 734935d98aa89c3e1b6a188da039b4c2
SHA1 85c40ce56f666871c215df674b718776eb8e6ac7
SHA512 bee94485adb19f5ce527a54302be9055651dd5eab7a36508415f2bd934924a83e35479d04e25ef4322f9a88a0cdcd1ef74655a79026dd29eb2c359587ee376f7
SSDEEP 6144:KflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:KflfAsiVGjSGecvX
TLSH
T1BC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdyvtol.sys

Path C:\Temp\tnlfdyvtol.sys
Size 293KB
SHA256 fd4211d876523bfea745f63630f9b3f36a41415d218644a01c811c23862b280b
MD5 6af092cb97db549fa75b992646182e7c
SHA1 248eeead1ca3c817e3a49dd1b7cc47aa2a30022b
SHA512 bfa5a9349f414b2f301148d5f0e4f39f7d42b2b1da16ea990f28bd592a2edeb712364da8f750c00ef10ab4ad33265afa675b9cfdb2b6313f796219459a977eaa
SSDEEP 3072:/tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:/IJjiJcbI03GBc3ucY5DCSj
TLSH
T157545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsmkfcxvpn.exe

Path C:\Temp\vsmkfcxvpn.exe
Size 361KB
SHA256 cfc190a156eb2dd4eafbf7da9affdf5d5e4ed922238213b709c08ee714c7bef9
MD5 895f042e26b34666c38318b057ce96fc
SHA1 a992135f687bc57180692712796136fb90d91ee7
SHA512 d53633190073e29b77763ae9bf1592281cdbbc4a184fdf5f47df3d0e01fb79966f4f7d7fbc079a499a271612d3d1d514c3f272e80826d6482a7e58682643d051
SSDEEP 6144:oflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:oflfAsiVGjSGecvX
TLSH
T1E9747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtolgdywqo.exe

Path C:\Temp\vtolgdywqo.exe
Size 361KB
SHA256 2c518d758431dd709109ccd632b3e3fe42ce9792a1fc539bf5c2aaab4a9de95f
MD5 e99cc3bce7afeeb1140f3d8e3af8c294
SHA1 f9dbedbbe8a89c62735b6e37dd87a1ff530d62d8
SHA512 bdde51426b8c57bf2f8a920dfd7d74843a201f4c5180d0c10e8dc4d9572c624f9968610ba202bb25e16a457aa79adff3b93b75cf132f9b117293bd64658942ab
SSDEEP 6144:qflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:qflfAsiVGjSGecvX
TLSH
T1D2747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxusmkecxr.sys

Path C:\Temp\zxusmkecxr.sys
Size 293KB
SHA256 dacc23afb57810d096cf9b754c3ce3a69eae43189ffd6ef8ede8ea2ab6785421
MD5 ae0800379705cd8a9747143748b7198a
SHA1 fe0bfa92ea18215f431e63186af20a396adc6971
SHA512 2f1def1164ad69d046468add43af249dd0942b8356e2ddb43342bfcda640068eefb880824f005064c34c434603faa3dbb91f6e19098352b56814c4e3279e50b4
SSDEEP 3072:YtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:YIJjiJcbI03GBc3ucY5DCSj
TLSH
T13A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b2d903efec8d558eba6ee4ac12873ce1439014705e9d819ff4dfcffa10c4b270
MD5 d9964ad138b9b56ea7891b8576b8a6ce
SHA1 e8153c0a553b8b81a07f1bbc77037f1700b79956
SHA512 7028c8597edeb715bb44be72ae48ceb181161e73b5380897f449df22a8c2b5302f664d632f2373c4c7a712d85a4b0ca70a4a062d6af265eefcac45dd99a660f1
TLSH
T1FCD092A4BB40EC0ECA91287B25B69A19B6409831BC56061A8966B0F88C517831A1B0EE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d0eccd9de1dbbf6cbedcb541fa52903c78d66d4d260136bc73243b056beb74
MD5 12c06f300a4b88646d6fda378a48455e
SHA1 86d58840d0666ad8999198dad1983a8cfd61fd18
SHA512 76e813720fc8cd4d829570b1b32d711d2d751540dea1fcac581dd9a5963c4e3161cffa07350cc8d5477fa02d0eb7b1c29b8ffb567f85b5a94259654ff2af3928
TLSH
T118D092A8BB40ED0ECA91287B25B59A19B6509831FC56061A8866B0E88C517831A1B0FE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 31d029dd171d82a39f42efd86358c3c8055ca8a76cb124f8e7b6290b5545f4a2
MD5 b6b69e97fd67d58e12a87a0d5717d2bd
SHA1 a11e69024663bdc40f314e8655ce71ffe67f9d55
SHA512 3cbf40b467f1bf7f241a5a0010aa27a8b9163a14fa3074e99adc2892e3fe9de942af13b088b403cd02521da176f80148c69bac51363b9791dc9c9570a4749219
TLSH
T1EB418920337A76C3CF94A1BE6BE232C97A3D545976CB6E04D270A13C1E7AB14781B501
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 04de1dce3b9e129beaac12b9df90e282181b344b5b67c2f2c25c1d510fa53613
MD5 80580ccc1fe3907b49e63202c4fdee65
SHA1 f57e72f768997d91705fc398fdd7c014d8e423d1
SHA512 318a946adedfadc884f5e3b4787c9517b7f49d1808fea6cacf595b8e6462e8923d7d558eab29424bf7448c2079b5e0b30de46a26f3b3f6069e9e3262ee812ca9
TLSH
T15251CDF383E5866EC91196F0AA14AE1BCE1C0955432C3C1A89E4EF5B93F3471E142A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d03455cbc607eae5904c1ee4743e53fbe49ff7ff11849f24faee55fed8a3e520
MD5 3a7e9d1123331b7caa2375d7e89bbc8c
SHA1 b55d014956ede097c156a292c971f882f21bea3b
SHA512 64ac3c8ce1fdb01e24127940d72c4f6428cf6ef722fb8180b53b6b9aa9293a213e00af77d4966e49aafb28f225bcd3f082a8b69fcc9c14b466b339d5980c1905
SSDEEP 192:sxRtRmyM/jK1Ml8wCs/fqs8re3ZGdbpzoA8pi/g6+WNIYnDt9GEIgtJ:sxRtg8s/fqs8aJGV0i/5Iu/3
TLSH
T12B52DA16AA285977CCDBD20DFA557F53D6F81473A2901E44AAFCCA0C05E7ADC621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2711d9d80d11906ae1d07c413d4a0fc9dccf06027214a6a35dbcf6770aa1d6fb
MD5 c7c2a06d9b1a1dcce8dc1e67e6aadf73
SHA1 3da856ba58ac5f7e4e155e1ea1d364cfc53f531e
SHA512 f47759ed08f3d5012bfc1aae6e0a028b5462dae733989a1a8b9779536d378af2e10c0d2add75bd45009a21f97167e1ae0fda11df1aa63f1e23b389a27e4677c4
SSDEEP 192:sxR+RmyM/jK1Ml8UQyCs/fqsfre3ZGdbpzoA8pw/g6+WNIYnvt9GEIgDAJ:sxR+gqFs/fqsfaJGV0w/5Is/o
TLSH
T15C62C816AA289977CCDBD20DFA557F53D6F81463A2901E44AAFCCA0C05E7ADC521382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b71740fc82d766812f67095334d52171755f08cc44efbde8f4c6d69e4c935b93
MD5 4d242d789186af7ff26adfc2245eba7c
SHA1 0bc0ee14b54db6432bf025629091460b4b64d278
SHA512 65eec6196a7ea62d53ceb0c6ae5651a1395c83b7d4db31cc449e306821a117077d6ad49f71859a30ebb111508609fc093463a2c308617ca9baca52ef467b575f
SSDEEP 192:sxR+RmyM/jK1Ml8wCs/fqsfre3ZGdbpzoA8pi/g6+WNIYnDt9GEIgDAJ:sxR+g8s/fqsfaJGV0i/5Iu/o
TLSH
T16052C816AA285977CCDBD20DFA557F53D6F81463A2901E44AAFCCA0C05E7ADC621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 836354fc5dc4600ac4000c4ce9fc5383fe1b1a65ee69291535aeba7a209da6db
MD5 aae1dc4ce47d47c3867e0ee4efb3a5ad
SHA1 06133d973ed920b3ee0f04aa5c7231ef08ba1126
SHA512 48d56e7a7f395df3d92cd65b8d001d6847edb663707469d58f2b77a7d8ed47e64627c5659a2b5062968871e1dd85b86fe9ede9778dcf8f579b52b9a73ff15bb7
SSDEEP 768:Jl6hhs7pLuL7b2WgqcfHw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfVcXguWroM1s8J:Jl6hhQE7b2WgqcfHwu1jaYVcQutM1b
TLSH
T178E2DC7B780CCB7F4F804A9CEC29798A6DE801CB96D8CD5447FA894C03C66EB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 05a0531602c0569138eba8ff5f1b7b864af006c3821866e8ad5e5a1fe327c553
MD5 59e7ee53ddd7fd4bbfd17bdf1643bad3
SHA1 5444591ef3170557b5759e166c207fac7217d462
SHA512 78629749bbea66de6e126d8771f436d738c219d442ebf0544c02da7081a42f28e1b1a544118558f476203bc1da37292be9aa194a732e807dbf05d50cd2489f22
SSDEEP 96:KRqP2qc8cKWkB5gaKK4/ggKcKiJ46jHgRkQiOCYWm7LgYYK49gKYcY4rKQv4dZva:CqP2qc8c1kBKay/ggRKiJ46jHgRkQiOY
TLSH
T1EB91970C71B70651397E2598815D9D5682D2B0B7712AE52BB7B802E21F2BD01DFFE4EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a80892bb-8633-42f4-ab57-df55668d8a1a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a80892bb-8633-42f4-ab57-df55668d8a1a.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

00b4875b-e929-470d-b9d9-232b494b5ca2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\00b4875b-e929-470d-b9d9-232b494b5ca2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a51bb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a51bb.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 694f8a2145a12794b7bac49219a59371810a53a0650baca2fad71e88f6c609b8
MD5 a6ac3bbc676b1780473c42f8e29d2daa
SHA1 d83ca1275a4aa5f7af52101a17807bbda1398719
SHA512 e4535f9d2b96f07a1508e070947752eca4c2464148eb2269f2f00d9c2ff23ee0a208067f5cebc7a0d1fafddf15d7bbba207a9199329fdb097f87e2463bae4406
SSDEEP 768:Cj+9I3QjQYreNSLfXfNffX7DGFzoqPcNMCNF9b9MG:x9I3QDpfXfNff3WkqPaHb+G
TLSH
T159F2BFB4AC655D274CA7C289B72B3B5BEFF006A746841F44D8ED5F0E468B7AD030781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4fc998f5cf27086bf69eff19deaa9338023ea7cfe077224a365fcf51a414208a
MD5 a600c7313ecf4a2fe0a6b3567a76f8a4
SHA1 3deb139a4ca7eeed81ba1109b8c90daacc89ffde
SHA512 1d5739b6747d827e62d0205f41f777f69b53c1c3bc41553b4ea3b41b1a0e7b31b286c641368208c622c91361076b33c5f091cff8361616930cf36a6d9d95c694
SSDEEP 768:EFKj+9I3Qwg7jzVfXfNfsX7DGFzoqPcNMCNF9b9MG:E9I3+VfXfNfs3WkqPaHb+G
TLSH
T12D037DB5DCA4CE2B9DE3C7C9B71A3A4BEEE001A786885DC4D9D95E4D41CB2AD030B815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b6147ee61425b4811e1483e3382b4f7a541ea08d686e87d95e085c619ae86f09
MD5 ea15fc311fcb41db57e8afb89133a981
SHA1 459f5baefbdd581dabf35cc05392fd21e9b62218
SHA512 1bdcd9a952f130d760f2ce5ce31af329704cd9adc0d95af54715372ae39ca6ce869f9514385a74df9784c0c6df21b192834be1e46b06fc0dfafe896599f080cd
SSDEEP 768:tj+9I3J12QYreNSLfXfNfHX7DGFzoqPcNMCNF9b9MG:I9I3J1ApfXfNfH3WkqPaHb+G
TLSH
T1B6F2BFB4AC645D274CA7C689B71B3B5BEFF006A742841F48D8ED5F0E468B7AD030781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9864162dcd80bb06ddbb18c2bbe5d96bfaa298135e27dc5ffdb07424bef92bae
MD5 353f539e073f9eb86041f0da9b8844b8
SHA1 8fa9401122cfb1e1a0432d50b60be68ae4f71fa4
SHA512 3509645bb0c49761328fa85adc71c4a4846ce8547021ac16801773a619d564eafa7e4d1c9597f1400db9b7ccad1861894716e0599257ef508bb323a8c3e71082
SSDEEP 768:Vrv+4UNbda3SmYreNSLfXfoX7DGFzoqPcNMCNZGeVH1SkM:Vbsb43upfXfo3WkqPaIEH1Y
TLSH
T17F03BFB5ACA849374CE3C689B75B36077FF4015746840B94D8EE2F0E479F5AD130B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a2bf5746a072616f2aa16696a0ca62e8755d46833d94823568a8da41cb5fd045
MD5 42247a7520cd8a9d5684ddb645bfc247
SHA1 1cf2fbdd0a43a4b9f4ef293fcf07b4d3d50e553d
SHA512 0e717ea2e58db427936b28b1f67787df64704fcce80aec82b579790aa943b68ee678c1e57fe49b8490736a80ff1775fade4a58ad48e5d97936253108b0e9806a
SSDEEP 768:2j+9I3112QYreNSLfXfNfHX7DGFzoqPcNMCNF9b9MG:l9I311ApfXfNfH3WkqPaHb+G
TLSH
T1AFF2BFB4AC655D274CA7C289B72B3B5BEFF006A746841F44D8ED5F0E468B7AD030781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

0cc68b99-c875-4090-af3e-401f33b204ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0cc68b99-c875-4090-af3e-401f33b204ab.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir724_1092894493\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 755b6697c3e114fb00bc311fc795995c7e63baa9b4562a4d5f1628ae9ef4ea7c
MD5 15bcf2b0e0d9c40fd8bd568ee427811c
SHA1 f186a5a1fc1295d456cbdbb6049dd97039536a6d
SHA512 8dea95ab486900b0b9eaf07644c9dfbb59947d3d06de1265c0c791b1034db08f3a69a978bcae1674bd491d66ec4b8252b483f2386d2a8655eaaa5be95f0f9844
TLSH
T1B571238357B8D9B3C1DE9BF003835604F6FB223C0B2370640BA15946AB30A7A64B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/576-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/576-465-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1180-388-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2056-335-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2076-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2480-234-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2712-267-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2740-360-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3096-444-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3684-495-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3808-279-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3956-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4092-469-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4316-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4316-428-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4584-308-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4764-195-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5476-376-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5608-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5812-432-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6140-408-0x0000000000010000-0x00000000000AB000-memory.dmp

Download