systex | 1eea44e9797275a82ff7d0db796ec35d98397bffbbe54d9c215f5181300c6f62

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260709-tmng8ac19m
SHA256 1eea44e9797275a82ff7d0db796ec35d98397bffbbe54d9c215f5181300c6f62
MD5 ed702e1d02423ae01e657616e5c25e35
SHA1 01690b65149e6ebee56f4e3de5597eed45e76d90
SHA512 c36587e62a767699eec97c32df607bcd5fe8aec1af13a6530ddbec3409f4c1c5c69d3b8ad0b2db6b9ab345af7a1f62507e11b71aa071409f8dd127eae99911eb
SSDEEP 6144:LflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:LflfAsiVGjSGecvX
TLSH
T1C9747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3372	qlidbvtqoigdyvtn.exe
4968	qlidbvtqoigdyvtn.sys
3928	CreateProcess.exe
3876	bvtnlgdbvt.exe
1680	CreateProcess.exe
424	CreateProcess.exe
5016	i_bvtnlgdbvt.exe
5476	fdxvqnifdy.sys
1960	CreateProcess.exe
5880	xvtnifdxsq.exe
1772	CreateProcess.exe
4792	CreateProcess.exe
5680	i_xvtnifdxsq.exe
4972	fdxnkfcays.sys
1056	CreateProcess.exe
2456	sqkicaxsnk.exe
3376	CreateProcess.exe
5608	CreateProcess.exe
3148	i_sqkicaxsnk.exe
1320	mkfcxusnkf.sys
2352	CreateProcess.exe
2696	rpkhczusmk.exe
3296	CreateProcess.exe
1884	CreateProcess.exe
3532	i_rpkhczusmk.exe
1408	jhfzxrpmhf.sys
3444	CreateProcess.exe
3900	zxrpjhczus.exe
5936	CreateProcess.exe
4976	CreateProcess.exe
1504	i_zxrpjhczus.exe
1492	kecwuomhez.sys
4912	CreateProcess.exe
3652	ztrmjebzxr.exe
4000	CreateProcess.exe
620	CreateProcess.exe
1368	i_ztrmjebzxr.exe
5808	mgeywqojgb.sys
3020	CreateProcess.exe
3748	bwtojgezwr.exe
5236	CreateProcess.exe
4784	CreateProcess.exe
4028	i_bwtojgezwr.exe
2780	bywrojhbzt.sys
2712	CreateProcess.exe
4488	trljdbvtol.exe
2216	CreateProcess.exe
5080	CreateProcess.exe
2948	i_trljdbvtol.exe
3388	igbywqoiga.sys
5136	CreateProcess.exe
2872	daytnljdbn.exe
4552	CreateProcess.exe
5508	CreateProcess.exe
2380	i_daytnljdbn.exe
1432	davsqoigay.sys
3536	CreateProcess.exe
4864	gaysqligay.exe
2392	CreateProcess.exe
3116	CreateProcess.exe
1524	i_gaysqligay.exe
1040	dayspnhfdx.sys
3912	CreateProcess.exe
5992	fdxvpnhfax.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_342331991\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_954603523\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_352444039\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_707788167\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_707788167\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_707788167\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_954603523\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_352444039\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_707788167\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvtnifdxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpkhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrmjebzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtojgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkfcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczxupmkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqligay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhecwupmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljgbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtojgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daytnljdbn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_daytnljdbn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlidbvtqoigdyvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicaxsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkfcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczxupmkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicavsnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgecwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qolfdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlgdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicaxsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpkhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhecwupmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgecwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljgbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qolfdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvtnifdxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqligay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicavsnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlgdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrmjebzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtolgeywqo.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
616	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5800	ipconfig.exe
5376	ipconfig.exe
2076	ipconfig.exe
5680	ipconfig.exe
1368	ipconfig.exe
3100	ipconfig.exe
4436	ipconfig.exe
716	ipconfig.exe
3684	ipconfig.exe
4148	ipconfig.exe
1360	ipconfig.exe
4464	ipconfig.exe
4396	ipconfig.exe
4760	ipconfig.exe
6076	ipconfig.exe
1136	ipconfig.exe
5108	ipconfig.exe
4024	ipconfig.exe
5068	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280870478687027"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3575702013-381963388-2545377694-1000\{14F05589-E592-48F2-A05B-88D136443924}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3372	qlidbvtqoigdyvtn.exe
3372	qlidbvtqoigdyvtn.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3372	qlidbvtqoigdyvtn.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3372	qlidbvtqoigdyvtn.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3372	qlidbvtqoigdyvtn.exe
3372	qlidbvtqoigdyvtn.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3372	qlidbvtqoigdyvtn.exe
3372	qlidbvtqoigdyvtn.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3372	qlidbvtqoigdyvtn.exe
3372	qlidbvtqoigdyvtn.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3372	qlidbvtqoigdyvtn.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3372	qlidbvtqoigdyvtn.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3372	qlidbvtqoigdyvtn.exe
3372	qlidbvtqoigdyvtn.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5016	i_bvtnlgdbvt.exe
Token: SeDebugPrivilege	5680	i_xvtnifdxsq.exe
Token: SeDebugPrivilege	3148	i_sqkicaxsnk.exe
Token: SeDebugPrivilege	3532	i_rpkhczusmk.exe
Token: SeDebugPrivilege	1504	i_zxrpjhczus.exe
Token: SeDebugPrivilege	1368	i_ztrmjebzxr.exe
Token: SeDebugPrivilege	4028	i_bwtojgezwr.exe
Token: SeDebugPrivilege	2948	i_trljdbvtol.exe
Token: SeDebugPrivilege	2380	i_daytnljdbn.exe
Token: SeDebugPrivilege	1524	i_gaysqligay.exe
Token: SeDebugPrivilege	2952	i_fdxvpnhfax.exe
Token: SeDebugPrivilege	1336	i_causmkfcxu.exe
Token: SeDebugPrivilege	3188	i_hczxupmkhf.exe
Token: SeDebugPrivilege	1880	i_mhecwupmhe.exe
Token: SeDebugPrivilege	3032	i_mgecwuomge.exe
Token: SeDebugPrivilege	4532	i_rljgbytrlj.exe
Token: SeDebugPrivilege	1360	i_vtolgeywqo.exe
Token: SeDebugPrivilege	716	i_qolfdyvqoi.exe
Token: SeDebugPrivilege	4464	i_qkicavsnkf.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3324	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 3372	1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 1108 wrote to memory of 2700	1108	2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 2700 wrote to memory of 3324	2700	iexplore.exe	90
PID 3324 wrote to memory of 5160	3324	msedge.exe	91
PID 3324 wrote to memory of 2676	3324	msedge.exe	93
PID 3324 wrote to memory of 616	3324	msedge.exe	94
PID 3324 wrote to memory of 2676	3324	msedge.exe	93
PID 3324 wrote to memory of 2676	3324	msedge.exe	93
PID 3324 wrote to memory of 4512	3324	msedge.exe	95
PID 3324 wrote to memory of 4512	3324	msedge.exe	95
PID 3324 wrote to memory of 832	3324	msedge.exe	96
PID 3324 wrote to memory of 832	3324	msedge.exe	96
PID 3324 wrote to memory of 832	3324	msedge.exe	96
PID 3324 wrote to memory of 3128	3324	msedge.exe	97
PID 3324 wrote to memory of 3128	3324	msedge.exe	97
PID 3324 wrote to memory of 3128	3324	msedge.exe	97
PID 3324 wrote to memory of 3000	3324	msedge.exe	98
PID 3324 wrote to memory of 3000	3324	msedge.exe	98
PID 3324 wrote to memory of 3000	3324	msedge.exe	98
PID 3324 wrote to memory of 5960	3324	msedge.exe	99
PID 3324 wrote to memory of 5960	3324	msedge.exe	99
PID 3324 wrote to memory of 5960	3324	msedge.exe	99
PID 3324 wrote to memory of 5916	3324	msedge.exe	100
PID 3324 wrote to memory of 5916	3324	msedge.exe	100
PID 3372 wrote to memory of 3928	3372	qlidbvtqoigdyvtn.exe	104
PID 3876 wrote to memory of 1680	3876	bvtnlgdbvt.exe	107
PID 3324 wrote to memory of 5376	3324	msedge.exe	110
PID 3324 wrote to memory of 1844	3324	msedge.exe	111
PID 3324 wrote to memory of 5376	3324	msedge.exe	110
PID 3324 wrote to memory of 1844	3324	msedge.exe	111
PID 3324 wrote to memory of 956	3324	msedge.exe	113
PID 3324 wrote to memory of 1488	3324	msedge.exe	114
PID 3324 wrote to memory of 1488	3324	msedge.exe	114
PID 3324 wrote to memory of 2636	3324	msedge.exe	117
PID 3324 wrote to memory of 2636	3324	msedge.exe	117
PID 3372 wrote to memory of 424	3372	qlidbvtqoigdyvtn.exe	119
PID 3372 wrote to memory of 1960	3372	qlidbvtqoigdyvtn.exe	123
PID 5880 wrote to memory of 1772	5880	xvtnifdxsq.exe	125
PID 3372 wrote to memory of 4792	3372	qlidbvtqoigdyvtn.exe	128
PID 3372 wrote to memory of 1056	3372	qlidbvtqoigdyvtn.exe	132
PID 2456 wrote to memory of 3376	2456	sqkicaxsnk.exe	134
PID 3372 wrote to memory of 5608	3372	qlidbvtqoigdyvtn.exe	137
PID 3372 wrote to memory of 2352	3372	qlidbvtqoigdyvtn.exe	142
PID 2696 wrote to memory of 3296	2696	rpkhczusmk.exe	144
PID 3372 wrote to memory of 1884	3372	qlidbvtqoigdyvtn.exe	147
PID 3324 wrote to memory of 2992	3324	msedge.exe	149
PID 3324 wrote to memory of 1204	3324	msedge.exe	150
PID 3324 wrote to memory of 3504	3324	msedge.exe	151
PID 3372 wrote to memory of 3444	3372	qlidbvtqoigdyvtn.exe	154
PID 3900 wrote to memory of 5936	3900	zxrpjhczus.exe	156
PID 3372 wrote to memory of 4976	3372	qlidbvtqoigdyvtn.exe	159
PID 3372 wrote to memory of 4912	3372	qlidbvtqoigdyvtn.exe	163
PID 3652 wrote to memory of 4000	3652	ztrmjebzxr.exe	165
PID 3372 wrote to memory of 620	3372	qlidbvtqoigdyvtn.exe	168
PID 3372 wrote to memory of 3020	3372	qlidbvtqoigdyvtn.exe	172
PID 3748 wrote to memory of 5236	3748	bwtojgezwr.exe	174
PID 3372 wrote to memory of 4784	3372	qlidbvtqoigdyvtn.exe	177
PID 3372 wrote to memory of 2712	3372	qlidbvtqoigdyvtn.exe	181
PID 4488 wrote to memory of 2216	4488	trljdbvtol.exe	183
PID 3324 wrote to memory of 2668	3324	msedge.exe	186
PID 3324 wrote to memory of 2668	3324	msedge.exe	186
PID 3372 wrote to memory of 5080	3372	qlidbvtqoigdyvtn.exe	190
PID 3372 wrote to memory of 5136	3372	qlidbvtqoigdyvtn.exe	194
PID 2872 wrote to memory of 4552	2872	daytnljdbn.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_ed702e1d02423ae01e657616e5c25e35_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Temp\qlidbvtqoigdyvtn.exe
  C:\Temp\qlidbvtqoigdyvtn.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtnlgdbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3928
  - - C:\Temp\bvtnlgdbvt.exe
      C:\Temp\bvtnlgdbvt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3876
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1680
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtnlgdbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:424
  - - C:\Temp\i_bvtnlgdbvt.exe
      C:\Temp\i_bvtnlgdbvt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvtnifdxsq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1960
  - - C:\Temp\xvtnifdxsq.exe
      C:\Temp\xvtnifdxsq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5880
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1772
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvtnifdxsq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4792
  - - C:\Temp\i_xvtnifdxsq.exe
      C:\Temp\i_xvtnifdxsq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkicaxsnk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1056
  - - C:\Temp\sqkicaxsnk.exe
      C:\Temp\sqkicaxsnk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2456
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3376
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkicaxsnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5608
  - - C:\Temp\i_sqkicaxsnk.exe
      C:\Temp\i_sqkicaxsnk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpkhczusmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2352
  - - C:\Temp\rpkhczusmk.exe
      C:\Temp\rpkhczusmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2696
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3296
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpkhczusmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1884
  - - C:\Temp\i_rpkhczusmk.exe
      C:\Temp\i_rpkhczusmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrpjhczus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3444
  - - C:\Temp\zxrpjhczus.exe
      C:\Temp\zxrpjhczus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3900
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5936
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrpjhczus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4976
  - - C:\Temp\i_zxrpjhczus.exe
      C:\Temp\i_zxrpjhczus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrmjebzxr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4912
  - - C:\Temp\ztrmjebzxr.exe
      C:\Temp\ztrmjebzxr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3652
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4000
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrmjebzxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:620
  - - C:\Temp\i_ztrmjebzxr.exe
      C:\Temp\i_ztrmjebzxr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtojgezwr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3020
  - - C:\Temp\bwtojgezwr.exe
      C:\Temp\bwtojgezwr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3748
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5236
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwtojgezwr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4784
  - - C:\Temp\i_bwtojgezwr.exe
      C:\Temp\i_bwtojgezwr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljdbvtol.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2712
  - - C:\Temp\trljdbvtol.exe
      C:\Temp\trljdbvtol.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4488
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2216
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljdbvtol.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5080
  - - C:\Temp\i_trljdbvtol.exe
      C:\Temp\i_trljdbvtol.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\daytnljdbn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5136
  - - C:\Temp\daytnljdbn.exe
      C:\Temp\daytnljdbn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2872
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4552
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_daytnljdbn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5508
  - - C:\Temp\i_daytnljdbn.exe
      C:\Temp\i_daytnljdbn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaysqligay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3536
  - - C:\Temp\gaysqligay.exe
      C:\Temp\gaysqligay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2392
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaysqligay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3116
  - - C:\Temp\i_gaysqligay.exe
      C:\Temp\i_gaysqligay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvpnhfax.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3912
  - - C:\Temp\fdxvpnhfax.exe
      C:\Temp\fdxvpnhfax.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5992
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5256
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxvpnhfax.exe ups_ins
    3⤵
    PID:3352
  - - C:\Temp\i_fdxvpnhfax.exe
      C:\Temp\i_fdxvpnhfax.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causmkfcxu.exe ups_run
    3⤵
    PID:4816
  - - C:\Temp\causmkfcxu.exe
      C:\Temp\causmkfcxu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5100
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2948
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causmkfcxu.exe ups_ins
    3⤵
    PID:4956
  - - C:\Temp\i_causmkfcxu.exe
      C:\Temp\i_causmkfcxu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczxupmkhf.exe ups_run
    3⤵
    PID:1792
  - - C:\Temp\hczxupmkhf.exe
      C:\Temp\hczxupmkhf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1604
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5240
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczxupmkhf.exe ups_ins
    3⤵
    PID:5480
  - - C:\Temp\i_hczxupmkhf.exe
      C:\Temp\i_hczxupmkhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3188
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhecwupmhe.exe ups_run
    3⤵
    PID:4564
  - - C:\Temp\mhecwupmhe.exe
      C:\Temp\mhecwupmhe.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4780
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5856
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhecwupmhe.exe ups_ins
    3⤵
    PID:6080
  - - C:\Temp\i_mhecwupmhe.exe
      C:\Temp\i_mhecwupmhe.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgecwuomge.exe ups_run
    3⤵
    PID:2432
  - - C:\Temp\mgecwuomge.exe
      C:\Temp\mgecwuomge.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4040
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5108
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgecwuomge.exe ups_ins
    3⤵
    PID:1488
  - - C:\Temp\i_mgecwuomge.exe
      C:\Temp\i_mgecwuomge.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljgbytrlj.exe ups_run
    3⤵
    PID:2636
  - - C:\Temp\rljgbytrlj.exe
      C:\Temp\rljgbytrlj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2660
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4020
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljgbytrlj.exe ups_ins
    3⤵
    PID:3592
  - - C:\Temp\i_rljgbytrlj.exe
      C:\Temp\i_rljgbytrlj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtolgeywqo.exe ups_run
    3⤵
    PID:4180
  - - C:\Temp\vtolgeywqo.exe
      C:\Temp\vtolgeywqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:572
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2576
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtolgeywqo.exe ups_ins
    3⤵
    PID:1852
  - - C:\Temp\i_vtolgeywqo.exe
      C:\Temp\i_vtolgeywqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qolfdyvqoi.exe ups_run
    3⤵
    PID:4368
  - - C:\Temp\qolfdyvqoi.exe
      C:\Temp\qolfdyvqoi.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3028
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qolfdyvqoi.exe ups_ins
    3⤵
    PID:3076
  - - C:\Temp\i_qolfdyvqoi.exe
      C:\Temp\i_qolfdyvqoi.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkicavsnkf.exe ups_run
    3⤵
    PID:2932
  - - C:\Temp\qkicavsnkf.exe
      C:\Temp\qkicavsnkf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5244
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkicavsnkf.exe ups_ins
    3⤵
    PID:3428
  - - C:\Temp\i_qkicavsnkf.exe
      C:\Temp\i_qkicavsnkf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4464
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x300,0x304,0x308,0x2fc,0x1e8,0x7ffb16ddc188,0x7ffb16ddc194,0x7ffb16ddc1a0
      4⤵
      PID:5160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2004,i,17188350308093517424,14245868679792305656,262144 --field-trial-handle=2592,i,15175209312488848214,1547881782237615493,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:2
      4⤵
      PID:2676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,13098558087973218566,482897494133454209,524288 --field-trial-handle=2592,i,15175209312488848214,1547881782237615493,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:11
      4⤵
      System Time Discovery
      PID:616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2672,i,18150864043389570445,7759380517294470277,524288 --field-trial-handle=2592,i,15175209312488848214,1547881782237615493,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:13
      4⤵
      PID:4512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,5070064699735920110,9086671200081702169,2097152 --field-trial-handle=2592,i,15175209312488848214,1547881782237615493,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
      4⤵
      PID:832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,838542444714502411,17732802455507207954,2097152 --field-trial-handle=2592,i,15175209312488848214,1547881782237615493,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      PID:3128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,5333841144472311593,4434831456312160879,2097152 --field-trial-handle=2592,i,15175209312488848214,1547881782237615493,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:1
      4⤵
      PID:3000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,6825490092913534866,9104685614517040694,2097152 --field-trial-handle=2592,i,15175209312488848214,1547881782237615493,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:9
      4⤵
      PID:5960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,7964377443706221360,8395094084523757413,524288 --field-trial-handle=2592,i,15175209312488848214,1547881782237615493,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14
      4⤵
      PID:5916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,15311708412106147053,3660101852356343742,524288 --field-trial-handle=2592,i,15175209312488848214,1547881782237615493,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
      4⤵
      PID:5376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,12100710924459201507,2132461091559617335,524288 --field-trial-handle=2592,i,15175209312488848214,1547881782237615493,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:14
      4⤵
      PID:1844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,14361453952510220218,10835545683565658587,524288 --field-trial-handle=2592,i,15175209312488848214,1547881782237615493,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
      4⤵
      PID:3432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,14361453952510220218,10835545683565658587,524288 --field-trial-handle=2592,i,15175209312488848214,1547881782237615493,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
      4⤵
      PID:956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,16097373114684672234,4423361713202750802,524288 --field-trial-handle=2592,i,15175209312488848214,1547881782237615493,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
      4⤵
      PID:1488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,10643913449114280526,5625149515387604144,524288 --field-trial-handle=2592,i,15175209312488848214,1547881782237615493,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
      4⤵
      PID:2636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,12484735516485821102,17516990465434941374,524288 --field-trial-handle=2592,i,15175209312488848214,1547881782237615493,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
      4⤵
      PID:2992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,128048502689364317,15751946029656676032,524288 --field-trial-handle=2592,i,15175209312488848214,1547881782237615493,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:14
      4⤵
      PID:1204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,6239863197765392155,15245865507093032052,524288 --field-trial-handle=2592,i,15175209312488848214,1547881782237615493,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
      4⤵
      PID:3504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,8593807618562782034,3325991731926329911,524288 --field-trial-handle=2592,i,15175209312488848214,1547881782237615493,262144 --variations-seed-version --mojo-platform-channel-handle=1312 /prefetch:14
      4⤵
      PID:2668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,12055849095788680037,7156084251867128822,524288 --field-trial-handle=2592,i,15175209312488848214,1547881782237615493,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
      4⤵
      PID:5832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,16028896129384139206,16415643622019481969,524288 --field-trial-handle=2592,i,15175209312488848214,1547881782237615493,262144 --variations-seed-version --mojo-platform-channel-handle=916 /prefetch:14
      4⤵
      PID:2384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,14415571585129011220,4211509246865059176,524288 --field-trial-handle=2592,i,15175209312488848214,1547881782237615493,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:14
      4⤵
      PID:1512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6000,i,13834238649954913138,6759613934394637145,262144 --field-trial-handle=2592,i,15175209312488848214,1547881782237615493,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:10
      4⤵
      PID:2988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,17019723686550859446,13156647414080417358,524288 --field-trial-handle=2592,i,15175209312488848214,1547881782237615493,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
      4⤵
      PID:964

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4088

C:\Temp\qlidbvtqoigdyvtn.sys
C:\Temp\qlidbvtqoigdyvtn.sys
1⤵
- Executes dropped EXE
PID:4968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5392

C:\Temp\fdxvqnifdy.sys
C:\Temp\fdxvqnifdy.sys
1⤵
- Executes dropped EXE
PID:5476

C:\Temp\fdxnkfcays.sys
C:\Temp\fdxnkfcays.sys
1⤵
- Executes dropped EXE
PID:4972

C:\Temp\mkfcxusnkf.sys
C:\Temp\mkfcxusnkf.sys
1⤵
- Executes dropped EXE
PID:1320

C:\Temp\jhfzxrpmhf.sys
C:\Temp\jhfzxrpmhf.sys
1⤵
- Executes dropped EXE
PID:1408

C:\Temp\kecwuomhez.sys
C:\Temp\kecwuomhez.sys
1⤵
- Executes dropped EXE
PID:1492

C:\Temp\mgeywqojgb.sys
C:\Temp\mgeywqojgb.sys
1⤵
- Executes dropped EXE
PID:5808

C:\Temp\bywrojhbzt.sys
C:\Temp\bywrojhbzt.sys
1⤵
- Executes dropped EXE
PID:2780

C:\Temp\igbywqoiga.sys
C:\Temp\igbywqoiga.sys
1⤵
- Executes dropped EXE
PID:3388

C:\Temp\davsqoigay.sys
C:\Temp\davsqoigay.sys
1⤵
- Executes dropped EXE
PID:1432

C:\Temp\dayspnhfdx.sys
C:\Temp\dayspnhfdx.sys
1⤵
- Executes dropped EXE
PID:1040

C:\Temp\nhcausnkfc.sys
C:\Temp\nhcausnkfc.sys
1⤵
PID:3380

C:\Temp\nhfzxrpnhf.sys
C:\Temp\nhfzxrpnhf.sys
1⤵
PID:2876

C:\Temp\mkecwuomhe.sys
C:\Temp\mkecwuomhe.sys
1⤵
PID:5348

C:\Temp\mjecwuomje.sys
C:\Temp\mjecwuomje.sys
1⤵
PID:2132

C:\Temp\tromjdbywr.sys
C:\Temp\tromjdbywr.sys
1⤵
PID:6092

C:\Temp\bztrljdbwt.sys
C:\Temp\bztrljdbwt.sys
1⤵
PID:4244

C:\Temp\qoigaysqli.sys
C:\Temp\qoigaysqli.sys
1⤵
PID:5348

C:\Temp\vtqkidavtn.sys
C:\Temp\vtqkidavtn.sys
1⤵
PID:1412

C:\Temp\sqkidausqn.sys
C:\Temp\sqkidausqn.sys
1⤵
PID:1160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtnlgdbvt.exe

Path C:\Temp\bvtnlgdbvt.exe
Size 361KB
SHA256 4124b688b123fa7a80fb78a93b11fac577e0b46aa56a8086e8662f5f556d5eac
MD5 678f467c58e3b97b5e0e60b5a77b84fa
SHA1 86b8705e4ac8e2dcf6dab2d7de215587202a3aca
SHA512 92faaee9602b1906601d7c81e6e6b3f4360bbbf8a530ff31dc24ba814575424d61a3e04406793c70afca6198d110df2b0ecd33c092a29affc57591f3cbff7f9c
SSDEEP 6144:lflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:lflfAsiVGjSGecvX
TLSH
T1C3747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxnkfcays.sys

Path C:\Temp\fdxnkfcays.sys
Size 293KB
SHA256 c5227b5b3a5a51511d997da4146e22bdfa9cd0422248afa58d5275d73ecda800
MD5 7963c0191650c8809e7ad3b37f7ca33e
SHA1 3b35895b077efb422a791d2ece784d8a925cad24
SHA512 3a273b20b18b508bafe52accdbd5c2a2b2d3662587d1bbbda3b35ed8abd9db6a8262281d17241abf25b7764b500f6288cd9c8b1242159a98efe2b5f8467269f1
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T138545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvqnifdy.sys

Path C:\Temp\fdxvqnifdy.sys
Size 293KB
SHA256 ea4c4a13661ae6554b916633e377128dcec5ec41c266ffdb54fd66af32fedeaa
MD5 f1ac816ee856e626f3d730920e66aab1
SHA1 b92758bb34ac1e28ae31b970727c422da17bd4ee
SHA512 a7984610d59f485468a9e63e15551f7f806774f78157be32ab1d7f64709601ddf2937bf79744139aafbe24d5863e8310ea1bb2c8bee9afabe0cb5ea729651713
SSDEEP 3072:UtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:UIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtnlgdbvt.exe

Path C:\Temp\i_bvtnlgdbvt.exe
Size 361KB
SHA256 53ceff100c047df28ba21e798f74b420f1ca57e1465ccc859ffa79ce8f577d04
MD5 3547f3623ce876e89d6c7ce385dd18ae
SHA1 e0de87e622c5c6c26d7e65a568519dfa509dc4ed
SHA512 65f105b999a8cb03d1db43ee3cf41e9c985a1e08616c2e2df64dd8aad7e7d445570c17dfc55022c0553a83fefec3a5ab0c13f7614a782d2253137172200d992e
SSDEEP 6144:EflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:EflfAsiVGjSGecvX
TLSH
T195747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpkhczusmk.exe

Path C:\Temp\i_rpkhczusmk.exe
Size 361KB
SHA256 d0bc6ba188d3c1b7c280852de582c2db9580c8512859ec96f6ed302a4b6e78e1
MD5 01e2684a48068d0872ebb1a2be95fba5
SHA1 272ad44e70697df0611b932a880892145ede1db8
SHA512 59a774e260217c0799d13214a5214c192cd1198808987da40221af0801ef62ebce178eb0c361d46b17df91818e2b9afd7db1519e096b56ac979014252d0903d9
SSDEEP 6144:QflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:QflfAsiVGjSGecvX
TLSH
T10A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqkicaxsnk.exe

Path C:\Temp\i_sqkicaxsnk.exe
Size 361KB
SHA256 90c00755a12e497d5f1168d2836dbff5b5fcff0deac4cc00920f6f35556aa41f
MD5 aef5849eaffaeb17a282e15c1db30da4
SHA1 a2e2b6d45d8e71be80fb64eaa709a5523525ba0a
SHA512 70eeabcb995df7fac615480f03f7e40b1d04400cc28a5b7e92312e0077a60aa0085972558a7e05e8fbc23e56c8bbe646afedf310a772699058a3007a327105fc
SSDEEP 6144:JflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:JflfAsiVGjSGecvX
TLSH
T105747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvtnifdxsq.exe

Path C:\Temp\i_xvtnifdxsq.exe
Size 361KB
SHA256 01d5bda7685e4772329b6c0b16c3b7d77e0f92d040929648c81bde8d8c0fc5c7
MD5 2ed3a088cab334ed50d294ba868a7a88
SHA1 662371b7767ba85928d91073e3bbbe14c89d204d
SHA512 e5395521ade377fb138486209690fc357dd59a27297c1b55a3efdaa261df109df49444a9e067d8fb1e600ca0bf0a57d06868af7fba93839afaa5124621de1cce
SSDEEP 6144:gflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:gflfAsiVGjSGecvX
TLSH
T1A7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztrmjebzxr.exe

Path C:\Temp\i_ztrmjebzxr.exe
Size 361KB
SHA256 4e3db1c69dd39f07470978b63a198e572dda52cdba13f1e3951f219af1e45aa2
MD5 851bf1a6e1b1bab2723ee3d9ffe54e4d
SHA1 d5ffcfd3bdccfc68c743b2f1b4a51c99f95dbe30
SHA512 332dac30e6015eac55e8825f4ce27309e9fe5659c95165ada3bb11847f124ff32393d0fd1d6bc25920203a6365573bbfb18c9278c801cc7ee5b0a6c1422de53e
SSDEEP 6144:3flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:3flfAsiVGjSGecvX
TLSH
T16E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxrpjhczus.exe

Path C:\Temp\i_zxrpjhczus.exe
Size 361KB
SHA256 99f23332777b4d6dbe971d16df3851f3419e6ccf44bcaa800f7e1125a04515a6
MD5 229e2100222d28b661f4e4898aa20414
SHA1 63cc877b5a401ab9da3ea0bfe26309c3d9238d52
SHA512 c1a048cdb092339da4bafa4d9b4df208cbb2add031a4ba28dfbd10b10b4f3ef76234e7779f47b774e5a78981a3e44d719c039e8f67540894a911f45453337fa1
SSDEEP 6144:FflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:FflfAsiVGjSGecvX
TLSH
T1A6747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhfzxrpmhf.sys

Path C:\Temp\jhfzxrpmhf.sys
Size 293KB
SHA256 a207f9781d28db4ac02f2c128f6adc3a99473482d27ebbbddeeb2b3e0783adf6
MD5 5cdb3dd2ec86939062d1c9176d1796ee
SHA1 e0694ea40da5c4e0cbd76c0afc89be68e2bca0a3
SHA512 b1b7fee08a334bce17dbb7633e18827ac168bf46d36e882dff5ee3dbe8eb8ef057d4664da01fdb41821516e4b73bb8aeb0d59ab4dceb135cdbbcc836ed791ec9
SSDEEP 3072:vtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:vIJjiJcbI03GBc3ucY5DCSj
TLSH
T17F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwuomhez.sys

Path C:\Temp\kecwuomhez.sys
Size 293KB
SHA256 b9b05e9c3672ca2ee165afcc33a3dbbfcc9ec79ade67898b04f3acf036f69b08
MD5 d4c7e1ff8ec76fe0f9de94f0dc5d385e
SHA1 d5f7d014c829a9f0f26eba8264b32069046cd2db
SHA512 e8bbe07091ce11822447a6a85bd6ed95c8b11da807d3427fe9b3b51d9e8786a109bbfb68fa4fefff2351daac2f237f40428fa092c9ecfc9ac02d35988ff744fe
SSDEEP 3072:QtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:QIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkfcxusnkf.sys

Path C:\Temp\mkfcxusnkf.sys
Size 293KB
SHA256 c008babfeda7c7a7070eacdea3a369559351161354728272d2a2d4238573683c
MD5 defa98d0920c935377009da2a08bbd6e
SHA1 2e8cac205045d812f2cc5fb398a56c9e847cb666
SHA512 078f303c3b36798f7e78100d55ab727695945aa725da0013355b1cbfd006dc4668801492e41fe45fffd8c764ea5552d51b7bb75d06c2a69ca3938688c58866a0
SSDEEP 3072:vtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:vIJjiJcbI03GBc3ucY5DCSj
TLSH
T16B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qlidbvtqoigdyvtn.exe

Path C:\Temp\qlidbvtqoigdyvtn.exe
Size 361KB
SHA256 717b24365095f2c763a4b0d91fce83fac882ded45467d2181fb4a9c1b97659dc
MD5 6a252dcc326cf35f5fa22a874dfd9216
SHA1 012b2db26589efdab97f05fb3e286de69029ea96
SHA512 65b6a988f9391a264e85e5c0b8b45bc7baf4d2e1ec448d46bad43ab1a9c0c112d9612b132627ef4169dcbe2a4ccd85d0875ecd8d0987360a14005708d11b7bd5
SSDEEP 6144:VflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:VflfAsiVGjSGecvX
TLSH
T115747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qlidbvtqoigdyvtn.sys

Path C:\Temp\qlidbvtqoigdyvtn.sys
Size 293KB
SHA256 6e545e48d7cc688e6f7c569cef21f92dafc8748eb279585a2a707676ddc41efa
MD5 4bda2adf35ebbd4cdd043ad3467f67d2
SHA1 a30372f4179a2103df45308ad6dbe6495b257c1b
SHA512 cf2ff5aded5a108bc411b8d3707da2a147efa577feea896b189cb34ab8e48f3f61ecd9e49ea65389bc70d79bdd0c00fcd0965b825dddaf27e5d77134625fbfd4
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T142545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpkhczusmk.exe

Path C:\Temp\rpkhczusmk.exe
Size 361KB
SHA256 302bd0db2dcb03fea59dfe8cc53e769c7f21ad8b666576e539ebedd3f0d07924
MD5 b9c3bd068a41b73a2e45e541fec03b3a
SHA1 7c1282b8e03e9bd1bb6b0f9cce3c7dfb0724d3f3
SHA512 ed2dd0315559af8d30f900fd2025c577f634c85aa2cfdd32c668ef96bc50848744dd932ed1e29026db8113f8c11ba4c884822b4d43960d7845e0ead386896897
SSDEEP 6144:vflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:vflfAsiVGjSGecvX
TLSH
T1E0747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkicaxsnk.exe

Path C:\Temp\sqkicaxsnk.exe
Size 361KB
SHA256 819796beea5ad978b3ecfaa4a2d7f0752e9f8fe187af1445b557f200a3f08b67
MD5 ca705a99263138daf95821d93f568c51
SHA1 579682ff8d16d74465681ab64fd2e51ffc2676b0
SHA512 c1831f9edd174fd958e695119865f66163d9c48b230e6aa695002eb1c0a741e24beff0be2c8a2d849b1e28b3245d49c28d07d77fb6349c5d8109e976b97a7663
SSDEEP 6144:WflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:WflfAsiVGjSGecvX
TLSH
T187747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvtnifdxsq.exe

Path C:\Temp\xvtnifdxsq.exe
Size 361KB
SHA256 6559195f63d1e4a12950329f7bfa6656374a3a7e247fe2d867548440468415ee
MD5 5e9e7ee569a9896f10165de6c5da9cb9
SHA1 66b7329946238df6c7b90f1ce7dac10525e9304f
SHA512 591633543e2f4ff7532753775ee51b58cc59210ac376831520654c1effb05d49ce3218eb1ed6dd1e0ed5587f37d06ef950da3e200801dcf88d5febef6e5e34f3
SSDEEP 6144:TflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:TflfAsiVGjSGecvX
TLSH
T111747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrmjebzxr.exe

Path C:\Temp\ztrmjebzxr.exe
Size 361KB
SHA256 1669d23412638af7acc357aa58542407cde4f70ed7c94390bff8ce37eb97c90f
MD5 d062b1883534730351b33007e078ffb0
SHA1 e29f668a5d8ae25dc751169a62ddfce95b6817bd
SHA512 88a0ea9c629822c8299b183a0dba544aa2aba625ee5aa5d17333a9692f87d04d9be963b8d5c3bc815cf1acad6396f72c97fdf61078453430c561448b0d9075d2
SSDEEP 6144:2flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:2flfAsiVGjSGecvX
TLSH
T104747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpjhczus.exe

Path C:\Temp\zxrpjhczus.exe
Size 361KB
SHA256 a9ebbf901c64d65d734a380672a11ee63d7527c77365d8ec247159e81aaf4403
MD5 6186574112e6b0d606ae8385d0078af2
SHA1 72f17c94cc7dbe7f751d0d94084290af9915a805
SHA512 09e8078c4eb643657087ac73d97792b5af5d237cde60e108bc74091f45341994d9d44013e18447804e4ee3eb24ca109f7daccbdf16115d05521e9eae00b960c3
SSDEEP 6144:vflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:vflfAsiVGjSGecvX
TLSH
T15E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fff4f5462f00db2197bad3d5dba44e0ed82332400e95ccd8e5aacbd03ea21ee9
MD5 5de064ddd4c36dfd1714ea6c60646443
SHA1 48976457417008f63c629290b82b7fcabfe4a7d6
SHA512 7cceae45d0afd44ac6288bfcc0bb9265585ec202aeed97194d26f5a717e32b99e16c516c465e3a99e12146fb39abc1e5707717e4ab27a4263928a6eadc9da500
TLSH
T1D6D09B747671D508DB40267265E55767F2015D35541D010C4041F17948557D106574AB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5373dba236158f8b47a5d7b664d171a8c47fe1fccd7b9ce0e1bd4afa2951d836
MD5 94a2023674c565156f1a36186c104810
SHA1 86e289a50e37125a5f15b949883b1e7188e31934
SHA512 d74a13f710bdf2137189f88217902762a3207a2efa776e19c74d44824ac997d398c4d0995f1b45894fe98d29700bf2a4ab26ab89b59bd32b83e714bdb7d03691
TLSH
T115D09B747661D508DB40267265E55767F2115D35681D010C4041F16948557D106574BF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f10e4d052ebcd1e12bae365f5853f13354991c147dc8be9efff0dfb1cdc6af0e
MD5 52a8530c74cc2304dce4592401adcefa
SHA1 433af2c960da9aad202a4869449dac00a6bb81ca
SHA512 1acc3dafc6fb150bfdf95d2f19017d3d0adcae3409e24d10ae6b06f8003c7e18148092a5ce1ac775ade6c056f3912e922ab62cbf454efe3b77671ff001d97ce1
TLSH
T13E6194981F764BF2D7255DBE21E59CB8FA30765E0377AD10498374B8381B72491234EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e12f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59e12f.TMP
Size 3KB
SHA256 50c64cc8e59875600f5e86a6b063a221cfaa44fb32cf3ff4fb9cfd2d33692be5
MD5 4fe883c726c050b85058cb09781c5541
SHA1 291903693b7ee3538e3469bb094376b4df334147
SHA512 f824b301e3f0c58533fb14cf0009fc8533000eaf05f338e4a2eb3c9a67e637959b50672a0156f3a935450190a2df2a8b08609cc739c17398a5318dbe21409fa3
TLSH
T11B6194881F764BF2D7255DBE21E59CB8FA30B65E03779D10498374B8381B724A1231EC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6f63f25b1743329fa693cad3768ccb4b7eca44b3e9eba51237907458ea6d5363
MD5 19d958d9dae0e111e86347591c1fd094
SHA1 e092a2d03a17d94b15f43c74f23c2a6f2b58618b
SHA512 b820ad327a85bdf4ec81e1990359bde9b492b0772eaaa3e5895273ee5db8ba7ebb3eda807e47eaaa6aa0d8cf5878a25de4c50b0782a98448480718d26a59eed9
TLSH
T12C419EF3C3E8866D890196F0AA187E2BCE1D0915832C3D5AC9E4EE5B93E3475E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6a05f28af16ce2133fe2d57a83f6fdc483e74e400a1c2410f2ef3d4cd12c19c5
MD5 1b692ebf794b6d928572c8b5626ab13a
SHA1 b57aeb33a9fa361cb0d73871c7d6c3e32fc7afee
SHA512 8c9b2828f9d0260f22cdbc7930805507313bcd1f6f14bc33e4bee62a6ce2e77b78dcd96d82d851b30cbd6a735e52395979e6724a77afa95ff4ff2ad185d6dfac
SSDEEP 192:sxR/RYyM/jK1Ml8wCz/f/sqLKTZWXlozoA8pi/g6+WNIYPY7ti+GLIgtJ:sxR/S8z/f/sqmdW7i/5IBJO3
TLSH
T1D352C9156A24997BCCDBD20DFA557F53D6F81563A2901E04AAFCCA0C05E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5fd532ea7ae3e4233856bfb9c9ac7d4487fe1205a3e0bb81d83683b66251b067
MD5 2ed6e76af9b29d31a922d06bd2beba44
SHA1 269840e1be4770989754927d71b9577ba7abbd6d
SHA512 c4b12f219b515a5894112940f3289eb61a537540b7cbb8cff012d158b4a782d8dd6eef7f36fef7ccb40d5b5f0dd12414974524c412634546abfd1a903da4aead
SSDEEP 192:sxRgRYyM/jK1Ml8UQOCz/f/s/LfTZWXNozoA8prZw/g6+WNCZztb/YPrB7ti+GLW:sxRgaq5z/f/s/zdWzNw/5iZb/EBJOW
TLSH
T1F462C916A9249D779CDBD20DFA517F53D6F81562A2901E08AAFCCB0C05E6ADD2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 be287661b061b6c31e68b8e7a5c585a1e517cfc113fdb519f524d0400a43c273
MD5 73868579abe04b3657c45181f50dee2c
SHA1 f8846efaca733e93f82caea556f65a8002f04316
SHA512 0c39bc04b135dfedebc62726aa959f406add5d2c659e3116d5ed3425cbf35d936eb3dfa6048a00578ad058c55f6ca7b7ffd71891fd5b4cbf4ad2acdb68088bc2
SSDEEP 192:sxRgRYyM/jK1Ml8wCz/f/s/LKTZWXlozoA8pi/g6+WNIYPY7ti+GLIgDwJ:sxRgS8z/f/s/mdW7i/5IBJO4
TLSH
T12852D915AA2499778CDBD20DFA557F53D6F81563A2901E04AAFCCB0C05E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 473dcd5e7240c803747dcdece51ef862c3259cb75a6e1e95680d352a6c50e23f
MD5 013352c90a81a0d498624d44be086c76
SHA1 954d207e6e6c76ef0c084275ba32f6401b421fc5
SHA512 6cd8b298c02f74ecaa4b5dd1958ef29fe0cdee339a09ab9aab806390b062e3c93db3425bd608f48f77251e3ddb040dd2323e8a71634f818ec62e63139113f9c1
SSDEEP 192:sxRgRYyM/jK1Ml8wCz/f/s/LfTZWXNozoA8p9Zw/g6+WNCZztb/YPrB7ti+GLIgW:sxRga8z/f/s/zdWzrw/5iZb/EBJOW
TLSH
T10A62CA16AA249D779CDBD20DFA517F53D6F81563A2901E08AAFCCB0C05E6ADD2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 392b5b078bb8572f0189ca6cebff8c8f4792003420ac61d31ef85b8d9cb30f9f
MD5 01edc93e9263caa01358befcdf915343
SHA1 1fb717e7ffebc0c7670e23900f5b52ab5c36bb32
SHA512 813c0208ec515ad03a5d0beb0b92920dad8ccc1181da82aaf43ae5658f91f0becc0ebf3f63ff504d2870694e9cea02ef4a3a552ec881fe9cd1c2df8b4932c879
SSDEEP 768:+Pw4HY7pLuL7QBWg5tf+T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVNhcUx2VroJwS:+Pw4HEE7QBWg5tf+Tu1ja6hcW2uD
TLSH
T16CE2EC3B680CCB7E4F404A9CEC29BD9AADE801CF56D8C95447FE881C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6af0025b-f9e1-4c94-92f0-135b7aec4920.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6af0025b-f9e1-4c94-92f0-135b7aec4920.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a7ca3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a7ca3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 45ce1ef91210d8b9199fe1cd71c0341f9e3d89ed14cf18ffd80af19a8fa226fa
MD5 d1e3a36d8fcb26b4d047e59490ead6cd
SHA1 a2fddae47ad9c3dcb3d7a8df19db2c3c878b1254
SHA512 8f6c7fc3ead8ba0ed3b124b11b2ffda6694d5a16aab520548a788a6387b277123a24134324bb1ae594c6b3741765eb2038a5779fd77a4ff11d67f3d1b28b9f8c
SSDEEP 768:wj+9o3x0+pYL0UUcuyvKweY5PWu3N+pyFb9MNa:P9o3x0X0Mua4e/Pb+Na
TLSH
T18BF2AE31AC668E638CD79391F3577BD2EFF8216392840F48D5E86F0D4A8369C275681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 2425c1dbeeaaa18d9891c56e7e457f0784ff1658a30f682baa162a537a49e4a6
MD5 b89afa969cc5fbcee2a17247c03c1b0c
SHA1 c995c94821df2a323eb84adf601d6a5ff733eda8
SHA512 8435a5003a4e364c1303dd167790b026a73fd3896be233b880dec48bc08095b9e3929b0b6dbea41b8de56bea39e1db36715d09ef076f4577acb3f6c8aa56345b
SSDEEP 768:Yrv+4UNbd431RcYL0UycuyvKweY5PWu3N+pmly/UigCI:YbsbW31x0Kua4e/jMU53
TLSH
T1B703BF32ACA4D9778CE79281F24BB693BFBC2113D2840758C5E92B0D475759D2347D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 cd549b8118176ea953068faedaf3f641d74c3d5e7b4305cb54ab0d35985b6aab
MD5 97fadc80e2816c76e604ea651a9fe04e
SHA1 35e65b0ed548bad99e5c7352ae3b17708fa47f3d
SHA512 9a04592b4432fa6609b7654edc22321efd181b34fcffb1d02956476b7597d6acc6815f757409d2fb7370e8177a1c7310df9b90d44bad53e414b21dcd295a6b65
SSDEEP 768:brv+4UNbdu3x0zpYL0UHcuyvKweY5PWu3N+pyFb9MNZ:bbsbM3x060vua4e/Pb+NZ
TLSH
T12313CF31E869CE739CEB9290F25B7A93BFF82163C6840B48D5E56B0C4A5749D270BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d33efee29d54db9d7802540937ba76a20e0b1b4d384c8e7f8ca46e6b86e38ded
MD5 e9ea2f4e96f42afce9590b2a618eb1d8
SHA1 b63192f8a24a9c21ca4a9413c04ae1ed72a4773a
SHA512 b0e7be653502db6476068c67e436ae76f59d0e862c7f038f859e0a8888bfe390725d7e0115f6dc915915fdbe94fea7c9d7ee36fb4b2f141747140215710d6687
SSDEEP 768:oj+9o3y0+pYL0UUcuyvKweY5PWu3N+pyFb9MNa:39o3y0X0Mua4e/Pb+Na
TLSH
T13AF2AE31AC668E638CD79391F3577BD2EFF82163C2841F48D5E86F0D4A8369C275681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 a44c1eee993b4f775d5dabd28a2203b7b168b16fb8e02ddbf940bf5f8cca6ddd
MD5 15a5ccc20144357cd9a8684aaf8a5baf
SHA1 44751e90278c146ed9d60f54c92019615596456e
SHA512 b2ea8fd85645517a50bbd41b7a51080b713a19d96863cf1659aaf6a14dfc6dafce212d6e3666a1804278d3f5f74580cd1eeffb2c08e8320160aca4bc4661f46b
SSDEEP 768:UF1j+9V3Ewgr0N770U2cuyvKweY5PWu3N+pyFb9MNa:59V3g0Z0Kua4e/Pb+Na
TLSH
T1001328F298D38A76D89E4783A33E6E829EBCD163B1845984F7D41E0CCD821BFD706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

83a172a7-9637-4e92-8e52-27b932717838.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\83a172a7-9637-4e92-8e52-27b932717838.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3324_677717298\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 28e93e94c640cd8bc5e6282942e0ea8f08f3b4abf00ca8fd67720a32aa9effcd
MD5 bf9f5f756a6e15dfb0027929612a0afc
SHA1 e1097b206169ca72fef3830862f008b738becaa2
SHA512 57e5d15f1387f67b252b6c8787d667fc6bb059574f37f576635652a4b16ebed6e60473bb4ea4d3a17980a8b696058627d59fa66009726bf2261f89560be220da
TLSH
T13B71238356BDD5B2C6DE5FF103839644F2FF22380B63702007A55586AB30B3A54B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1040-385-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1040-407-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1160-517-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1320-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1408-284-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1412-512-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1432-377-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1492-313-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2132-450-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2780-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2876-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3380-405-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3388-350-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4244-482-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4244-488-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4968-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4972-244-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5348-446-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5348-513-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5348-486-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5476-197-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5808-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6092-461-0x0000000000010000-0x00000000000AB000-memory.dmp

Download