systex | fa26056575c54e6117a4acbe5ee1a0161fd381a3486ab7b7eb18578e9e5efbeb

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260714-pmd7bscw3m
SHA256 fa26056575c54e6117a4acbe5ee1a0161fd381a3486ab7b7eb18578e9e5efbeb
MD5 eb72fee084d59b44cb30a8dc8c88e871
SHA1 3f2738489ccea4df657ec486c4efa80616c0ee97
SHA512 daa0c2ea6a018dcb61eed5a7df4510bd3ea8d9a8eac0b23ff62fbd94339a687ce850fcd2c09d5c00c87efb75346fa140e11de6e331b427496ed17ab439354d05
SSDEEP 6144:eflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:eflfAsiVGjSGecvX
TLSH
T1BB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2496	rmjecwuomgezwrpm.exe
4968	rmjecwuomgezwrpm.sys
3808	CreateProcess.exe
700	wrojhbzwuo.exe
4672	CreateProcess.exe
3264	CreateProcess.exe
2336	i_wrojhbzwuo.exe
4220	trljdbvtrl.sys
2784	CreateProcess.exe
560	ljdbvtolje.exe
3500	CreateProcess.exe
2232	CreateProcess.exe
3168	i_ljdbvtolje.exe
5032	ywqoigdbvt.sys
1988	CreateProcess.exe
3144	qoigaysqoi.exe
5788	CreateProcess.exe
4248	CreateProcess.exe
4168	i_qoigaysqoi.exe
3548	olgdbvtnly.sys
4772	CreateProcess.exe
4492	vsqkigaysq.exe
4996	CreateProcess.exe
4364	CreateProcess.exe
4428	i_vsqkigaysq.exe
5772	faysqnigay.sys
5344	CreateProcess.exe
2424	nhfaxspkic.exe
5524	CreateProcess.exe
3064	CreateProcess.exe
300	i_nhfaxspkic.exe
6140	ausnkfdxvp.sys
3168	CreateProcess.exe
3684	qkicausnkf.exe
4544	CreateProcess.exe
484	CreateProcess.exe
5388	i_qkicausnkf.exe
4992	zxrpkhfzxr.sys
3408	CreateProcess.exe
3888	smkecxupnh.exe
628	CreateProcess.exe
4884	CreateProcess.exe
4360	i_smkecxupnh.exe
5336	zwupmhezwr.sys
5320	CreateProcess.exe
3460	uomhbzxomk.exe
3788	CreateProcess.exe
5384	CreateProcess.exe
2860	i_uomhbzxomk.exe
5484	zwrojhbztr.sys
4456	CreateProcess.exe
5640	jebwurmjez.exe
2532	CreateProcess.exe
4100	CreateProcess.exe
1368	i_jebwurmjez.exe
4256	bztrljebwu.sys
6028	CreateProcess.exe
3212	trljdbztrl.exe
2932	CreateProcess.exe
4656	CreateProcess.exe
2580	i_trljdbztrl.exe
5568	tqoigeywqo.sys
6052	CreateProcess.exe
4856	lgdyvqoiga.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4196_81243142\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4196_81243142\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4196_1885738262\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4196_1087140362\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4196_1087140362\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4196_81243142\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4196_81243142\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4196_1402831283\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4196_1885738262\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upnhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqojgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtolje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtolje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwurmjez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbzwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqkigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfaxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomhbzxomk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqojgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgebwtrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfaxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomhbzxomk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkigayvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojhbzwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaysqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqkigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwurmjez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkicausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjecwuomgezwrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkigayvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgebwtrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaysqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkicausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upnhfzxrpk.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5988	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 18 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2484	ipconfig.exe
4724	ipconfig.exe
1404	ipconfig.exe
4460	ipconfig.exe
5984	ipconfig.exe
2800	ipconfig.exe
3024	ipconfig.exe
4416	ipconfig.exe
5228	ipconfig.exe
2356	ipconfig.exe
1104	ipconfig.exe
3176	ipconfig.exe
3212	ipconfig.exe
2932	ipconfig.exe
5320	ipconfig.exe
1000	ipconfig.exe
2308	ipconfig.exe
4360	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285056705075031"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{C2106878-DFEB-43BB-9B34-0B473A565CE8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2496	rmjecwuomgezwrpm.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2496	rmjecwuomgezwrpm.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2496	rmjecwuomgezwrpm.exe
2496	rmjecwuomgezwrpm.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2496	rmjecwuomgezwrpm.exe
2496	rmjecwuomgezwrpm.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2496	rmjecwuomgezwrpm.exe
2496	rmjecwuomgezwrpm.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2496	rmjecwuomgezwrpm.exe
2496	rmjecwuomgezwrpm.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	2336	i_wrojhbzwuo.exe
Token: SeDebugPrivilege	3168	i_ljdbvtolje.exe
Token: SeDebugPrivilege	4168	i_qoigaysqoi.exe
Token: SeDebugPrivilege	4428	i_vsqkigaysq.exe
Token: SeDebugPrivilege	300	i_nhfaxspkic.exe
Token: SeDebugPrivilege	5388	i_qkicausnkf.exe
Token: SeDebugPrivilege	4360	i_smkecxupnh.exe
Token: SeDebugPrivilege	2860	i_uomhbzxomk.exe
Token: SeDebugPrivilege	1368	i_jebwurmjez.exe
Token: SeDebugPrivilege	2580	i_trljdbztrl.exe
Token: SeDebugPrivilege	5452	i_lgdyvqoiga.exe
Token: SeDebugPrivilege	5708	i_ysqkigayvq.exe
Token: SeDebugPrivilege	5336	i_mkicausmkf.exe
Token: SeDebugPrivilege	3476	i_upnhfzxrpk.exe
Token: SeDebugPrivilege	3784	i_rmkecwuomh.exe
Token: SeDebugPrivilege	3176	i_omgebwtrmj.exe
Token: SeDebugPrivilege	4640	i_geywqojgey.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4196	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2496	2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 2816 wrote to memory of 2884	2816	2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 2884 wrote to memory of 4196	2884	iexplore.exe	89
PID 4196 wrote to memory of 1108	4196	msedge.exe	90
PID 4196 wrote to memory of 5988	4196	msedge.exe	92
PID 4196 wrote to memory of 1852	4196	msedge.exe	93
PID 4196 wrote to memory of 1852	4196	msedge.exe	93
PID 4196 wrote to memory of 1852	4196	msedge.exe	93
PID 4196 wrote to memory of 4476	4196	msedge.exe	94
PID 4196 wrote to memory of 4476	4196	msedge.exe	94
PID 4196 wrote to memory of 2636	4196	msedge.exe	95
PID 4196 wrote to memory of 2636	4196	msedge.exe	95
PID 4196 wrote to memory of 1084	4196	msedge.exe	96
PID 4196 wrote to memory of 2636	4196	msedge.exe	95
PID 4196 wrote to memory of 1084	4196	msedge.exe	96
PID 4196 wrote to memory of 1084	4196	msedge.exe	96
PID 4196 wrote to memory of 5784	4196	msedge.exe	97
PID 4196 wrote to memory of 1584	4196	msedge.exe	98
PID 4196 wrote to memory of 5784	4196	msedge.exe	97
PID 4196 wrote to memory of 5784	4196	msedge.exe	97
PID 4196 wrote to memory of 1584	4196	msedge.exe	98
PID 4196 wrote to memory of 1584	4196	msedge.exe	98
PID 4196 wrote to memory of 2424	4196	msedge.exe	100
PID 4196 wrote to memory of 2424	4196	msedge.exe	100
PID 4196 wrote to memory of 2632	4196	msedge.exe	104
PID 4196 wrote to memory of 3320	4196	msedge.exe	103
PID 4196 wrote to memory of 2632	4196	msedge.exe	104
PID 4196 wrote to memory of 3320	4196	msedge.exe	103
PID 4196 wrote to memory of 5012	4196	msedge.exe	106
PID 2496 wrote to memory of 3808	2496	rmjecwuomgezwrpm.exe	107
PID 700 wrote to memory of 4672	700	wrojhbzwuo.exe	110
PID 4196 wrote to memory of 5940	4196	msedge.exe	115
PID 4196 wrote to memory of 5940	4196	msedge.exe	115
PID 4196 wrote to memory of 5184	4196	msedge.exe	116
PID 4196 wrote to memory of 5184	4196	msedge.exe	116
PID 2496 wrote to memory of 3264	2496	rmjecwuomgezwrpm.exe	117
PID 2496 wrote to memory of 2784	2496	rmjecwuomgezwrpm.exe	121
PID 560 wrote to memory of 3500	560	ljdbvtolje.exe	123
PID 2496 wrote to memory of 2232	2496	rmjecwuomgezwrpm.exe	126
PID 2496 wrote to memory of 1988	2496	rmjecwuomgezwrpm.exe	130
PID 3144 wrote to memory of 5788	3144	qoigaysqoi.exe	132
PID 2496 wrote to memory of 4248	2496	rmjecwuomgezwrpm.exe	135
PID 2496 wrote to memory of 4772	2496	rmjecwuomgezwrpm.exe	140
PID 4492 wrote to memory of 4996	4492	vsqkigaysq.exe	142
PID 4196 wrote to memory of 3780	4196	msedge.exe	145
PID 4196 wrote to memory of 4436	4196	msedge.exe	146
PID 4196 wrote to memory of 3908	4196	msedge.exe	147
PID 2496 wrote to memory of 4364	2496	rmjecwuomgezwrpm.exe	148
PID 2496 wrote to memory of 5344	2496	rmjecwuomgezwrpm.exe	152
PID 2424 wrote to memory of 5524	2424	nhfaxspkic.exe	154
PID 2496 wrote to memory of 3064	2496	rmjecwuomgezwrpm.exe	157
PID 2496 wrote to memory of 3168	2496	rmjecwuomgezwrpm.exe	161
PID 3684 wrote to memory of 4544	3684	qkicausnkf.exe	163
PID 2496 wrote to memory of 484	2496	rmjecwuomgezwrpm.exe	166
PID 2496 wrote to memory of 3408	2496	rmjecwuomgezwrpm.exe	170
PID 3888 wrote to memory of 628	3888	smkecxupnh.exe	172
PID 2496 wrote to memory of 4884	2496	rmjecwuomgezwrpm.exe	175
PID 2496 wrote to memory of 5320	2496	rmjecwuomgezwrpm.exe	179
PID 3460 wrote to memory of 3788	3460	uomhbzxomk.exe	181
PID 4196 wrote to memory of 3740	4196	msedge.exe	184
PID 4196 wrote to memory of 3740	4196	msedge.exe	184
PID 2496 wrote to memory of 5384	2496	rmjecwuomgezwrpm.exe	188
PID 2496 wrote to memory of 4456	2496	rmjecwuomgezwrpm.exe	192
PID 5640 wrote to memory of 2532	5640	jebwurmjez.exe	194

C:\Users\Admin\AppData\Local\Temp\2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_eb72fee084d59b44cb30a8dc8c88e871_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Temp\rmjecwuomgezwrpm.exe
  C:\Temp\rmjecwuomgezwrpm.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrojhbzwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3808
  - - C:\Temp\wrojhbzwuo.exe
      C:\Temp\wrojhbzwuo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:700
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4672
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3212
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrojhbzwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3264
  - - C:\Temp\i_wrojhbzwuo.exe
      C:\Temp\i_wrojhbzwuo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbvtolje.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2784
  - - C:\Temp\ljdbvtolje.exe
      C:\Temp\ljdbvtolje.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:560
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3500
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbvtolje.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2232
  - - C:\Temp\i_ljdbvtolje.exe
      C:\Temp\i_ljdbvtolje.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigaysqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1988
  - - C:\Temp\qoigaysqoi.exe
      C:\Temp\qoigaysqoi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3144
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5788
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigaysqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4248
  - - C:\Temp\i_qoigaysqoi.exe
      C:\Temp\i_qoigaysqoi.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsqkigaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4772
  - - C:\Temp\vsqkigaysq.exe
      C:\Temp\vsqkigaysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4492
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4996
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsqkigaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4364
  - - C:\Temp\i_vsqkigaysq.exe
      C:\Temp\i_vsqkigaysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfaxspkic.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5344
  - - C:\Temp\nhfaxspkic.exe
      C:\Temp\nhfaxspkic.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2424
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5524
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfaxspkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3064
  - - C:\Temp\i_nhfaxspkic.exe
      C:\Temp\i_nhfaxspkic.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkicausnkf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3168
  - - C:\Temp\qkicausnkf.exe
      C:\Temp\qkicausnkf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3684
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4544
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkicausnkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:484
  - - C:\Temp\i_qkicausnkf.exe
      C:\Temp\i_qkicausnkf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5388
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkecxupnh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3408
  - - C:\Temp\smkecxupnh.exe
      C:\Temp\smkecxupnh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3888
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:628
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkecxupnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4884
  - - C:\Temp\i_smkecxupnh.exe
      C:\Temp\i_smkecxupnh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomhbzxomk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5320
  - - C:\Temp\uomhbzxomk.exe
      C:\Temp\uomhbzxomk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3460
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3788
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomhbzxomk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5384
  - - C:\Temp\i_uomhbzxomk.exe
      C:\Temp\i_uomhbzxomk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jebwurmjez.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4456
  - - C:\Temp\jebwurmjez.exe
      C:\Temp\jebwurmjez.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5640
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2532
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jebwurmjez.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4100
  - - C:\Temp\i_jebwurmjez.exe
      C:\Temp\i_jebwurmjez.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljdbztrl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6028
  - - C:\Temp\trljdbztrl.exe
      C:\Temp\trljdbztrl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3212
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2932
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljdbztrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4656
  - - C:\Temp\i_trljdbztrl.exe
      C:\Temp\i_trljdbztrl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdyvqoiga.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6052
  - - C:\Temp\lgdyvqoiga.exe
      C:\Temp\lgdyvqoiga.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4856
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5816
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgdyvqoiga.exe ups_ins
    3⤵
    PID:4420
  - - C:\Temp\i_lgdyvqoiga.exe
      C:\Temp\i_lgdyvqoiga.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqkigayvq.exe ups_run
    3⤵
    PID:3236
  - - C:\Temp\ysqkigayvq.exe
      C:\Temp\ysqkigayvq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4152
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4636
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqkigayvq.exe ups_ins
    3⤵
    PID:2080
  - - C:\Temp\i_ysqkigayvq.exe
      C:\Temp\i_ysqkigayvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnhfaxsq.exe ups_run
    3⤵
    PID:3224
  - - C:\Temp\xvpnhfaxsq.exe
      C:\Temp\xvpnhfaxsq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5840
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2512
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnhfaxsq.exe ups_ins
    3⤵
    PID:4976
  - - C:\Temp\i_xvpnhfaxsq.exe
      C:\Temp\i_xvpnhfaxsq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      PID:4788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkicausmkf.exe ups_run
    3⤵
    PID:4764
  - - C:\Temp\mkicausmkf.exe
      C:\Temp\mkicausmkf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2580
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2680
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkicausmkf.exe ups_ins
    3⤵
    PID:5128
  - - C:\Temp\i_mkicausmkf.exe
      C:\Temp\i_mkicausmkf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upnhfzxrpk.exe ups_run
    3⤵
    PID:3268
  - - C:\Temp\upnhfzxrpk.exe
      C:\Temp\upnhfzxrpk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4600
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4116
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upnhfzxrpk.exe ups_ins
    3⤵
    PID:3884
  - - C:\Temp\i_upnhfzxrpk.exe
      C:\Temp\i_upnhfzxrpk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmkecwuomh.exe ups_run
    3⤵
    PID:2412
  - - C:\Temp\rmkecwuomh.exe
      C:\Temp\rmkecwuomh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5068
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4624
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmkecwuomh.exe ups_ins
    3⤵
    PID:3048
  - - C:\Temp\i_rmkecwuomh.exe
      C:\Temp\i_rmkecwuomh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgebwtrmj.exe ups_run
    3⤵
    PID:1664
  - - C:\Temp\omgebwtrmj.exe
      C:\Temp\omgebwtrmj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3404
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgebwtrmj.exe ups_ins
    3⤵
    PID:4896
  - - C:\Temp\i_omgebwtrmj.exe
      C:\Temp\i_omgebwtrmj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywqojgey.exe ups_run
    3⤵
    PID:2376
  - - C:\Temp\geywqojgey.exe
      C:\Temp\geywqojgey.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2148
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:476
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywqojgey.exe ups_ins
    3⤵
    PID:1000
  - - C:\Temp\i_geywqojgey.exe
      C:\Temp\i_geywqojgey.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4640
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x304,0x7ffdeebec188,0x7ffdeebec194,0x7ffdeebec1a0
      4⤵
      PID:1108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2100,i,8976846704911185091,12234406528252797766,524288 --field-trial-handle=2676,i,16149136721344415940,4251690761126889145,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:11
      4⤵
      System Time Discovery
      PID:5988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1864,i,9990082079387653152,8473166906613413581,262144 --field-trial-handle=2676,i,16149136721344415940,4251690761126889145,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:2
      4⤵
      PID:1852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,6044929809333633479,7700608632622773233,524288 --field-trial-handle=2676,i,16149136721344415940,4251690761126889145,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:13
      4⤵
      PID:4476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,12768494574892506796,16157180704532672272,2097152 --field-trial-handle=2676,i,16149136721344415940,4251690761126889145,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
      4⤵
      PID:2636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,2527953412522782549,13595285221316377046,2097152 --field-trial-handle=2676,i,16149136721344415940,4251690761126889145,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:1084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,10766833779582576951,2323348774961984478,2097152 --field-trial-handle=2676,i,16149136721344415940,4251690761126889145,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:9
      4⤵
      PID:5784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,6645492400410444854,7759219263883935332,2097152 --field-trial-handle=2676,i,16149136721344415940,4251690761126889145,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
      4⤵
      PID:1584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,15914030780835670932,9100073966791468525,524288 --field-trial-handle=2676,i,16149136721344415940,4251690761126889145,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:14
      4⤵
      PID:2424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,3482674659325199604,5079299706308033558,524288 --field-trial-handle=2676,i,16149136721344415940,4251690761126889145,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
      4⤵
      PID:3320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,6384623379166146936,2350484708814723582,524288 --field-trial-handle=2676,i,16149136721344415940,4251690761126889145,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
      4⤵
      PID:2632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,4154416976780547752,9177955348505012291,524288 --field-trial-handle=2676,i,16149136721344415940,4251690761126889145,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
      4⤵
      PID:5132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,4154416976780547752,9177955348505012291,524288 --field-trial-handle=2676,i,16149136721344415940,4251690761126889145,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,16524162291328846823,13664443097056935275,524288 --field-trial-handle=2676,i,16149136721344415940,4251690761126889145,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
      4⤵
      PID:5940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,13626809816927098553,9698593622637248225,524288 --field-trial-handle=2676,i,16149136721344415940,4251690761126889145,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
      4⤵
      PID:5184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,14779424957332562285,18218718065120452123,524288 --field-trial-handle=2676,i,16149136721344415940,4251690761126889145,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:14
      4⤵
      PID:3780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,8367603973468747189,7042451514960857263,524288 --field-trial-handle=2676,i,16149136721344415940,4251690761126889145,262144 --variations-seed-version --mojo-platform-channel-handle=1412 /prefetch:14
      4⤵
      PID:4436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,1462228620179911894,2177061361962081945,524288 --field-trial-handle=2676,i,16149136721344415940,4251690761126889145,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
      4⤵
      PID:3908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,14367988030995044812,15668835360112482610,524288 --field-trial-handle=2676,i,16149136721344415940,4251690761126889145,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:14
      4⤵
      PID:3740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,10912853798731530120,2396208280374512344,524288 --field-trial-handle=2676,i,16149136721344415940,4251690761126889145,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
      4⤵
      PID:4132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,2561559806817880171,15692627115356784610,524288 --field-trial-handle=2676,i,16149136721344415940,4251690761126889145,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
      4⤵
      PID:760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,1022061631843743773,13795813701614136766,524288 --field-trial-handle=2676,i,16149136721344415940,4251690761126889145,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
      4⤵
      PID:404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5944,i,18296885554088267385,1323311402104074696,262144 --field-trial-handle=2676,i,16149136721344415940,4251690761126889145,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:10
      4⤵
      PID:4920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,16749411927185977354,2975831525043254813,524288 --field-trial-handle=2676,i,16149136721344415940,4251690761126889145,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
      4⤵
      PID:1944

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5732

C:\Temp\rmjecwuomgezwrpm.sys
C:\Temp\rmjecwuomgezwrpm.sys
1⤵
- Executes dropped EXE
PID:4968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1648

C:\Temp\trljdbvtrl.sys
C:\Temp\trljdbvtrl.sys
1⤵
- Executes dropped EXE
PID:4220

C:\Temp\ywqoigdbvt.sys
C:\Temp\ywqoigdbvt.sys
1⤵
- Executes dropped EXE
PID:5032

C:\Temp\olgdbvtnly.sys
C:\Temp\olgdbvtnly.sys
1⤵
- Executes dropped EXE
PID:3548

C:\Temp\faysqnigay.sys
C:\Temp\faysqnigay.sys
1⤵
- Executes dropped EXE
PID:5772

C:\Temp\ausnkfdxvp.sys
C:\Temp\ausnkfdxvp.sys
1⤵
- Executes dropped EXE
PID:6140

C:\Temp\zxrpkhfzxr.sys
C:\Temp\zxrpkhfzxr.sys
1⤵
- Executes dropped EXE
PID:4992

C:\Temp\zwupmhezwr.sys
C:\Temp\zwupmhezwr.sys
1⤵
- Executes dropped EXE
PID:5336

C:\Temp\zwrojhbztr.sys
C:\Temp\zwrojhbztr.sys
1⤵
- Executes dropped EXE
PID:5484

C:\Temp\bztrljebwu.sys
C:\Temp\bztrljebwu.sys
1⤵
- Executes dropped EXE
PID:4256

C:\Temp\tqoigeywqo.sys
C:\Temp\tqoigeywqo.sys
1⤵
- Executes dropped EXE
PID:5568

C:\Temp\igaysqkida.sys
C:\Temp\igaysqkida.sys
1⤵
PID:4552

C:\Temp\caysqnifax.sys
C:\Temp\caysqnifax.sys
1⤵
PID:5564

C:\Temp\cxupnhfzxv.sys
C:\Temp\cxupnhfzxv.sys
1⤵
PID:4220

C:\Temp\cwuomhezxu.sys
C:\Temp\cwuomhezxu.sys
1⤵
PID:2292

C:\Temp\wuomgeywro.sys
C:\Temp\wuomgeywro.sys
1⤵
PID:6012

C:\Temp\ztrljebomg.sys
C:\Temp\ztrljebomg.sys
1⤵
PID:6044

C:\Temp\roigeywqoj.sys
C:\Temp\roigeywqoj.sys
1⤵
PID:4252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ausnkfdxvp.sys

Path C:\Temp\ausnkfdxvp.sys
Size 293KB
SHA256 b267f42f96c30cec6bb5b7cbe79f737cb844ad60447197c3f70156ca8fa6a3f7
MD5 ebf0ba4cd1c1633ef2a2447839ef5a08
SHA1 4f9945f34692bc77b7ce861a259310f3829fca5d
SHA512 24156b26f21d08a81ef291491cd6dbaee52ee1fc9f3ace006e2567d765cda37c38649f0a8f809ad4df641a3188cb0de8b713ab3bb9c5da6ee6c107460fb60594
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faysqnigay.sys

Path C:\Temp\faysqnigay.sys
Size 293KB
SHA256 3113e067e80b6f17f33d00455a0147f62082fa0b83deb058a6e3d4a739d02fa3
MD5 42ced735929530e352ab94fdaccb414c
SHA1 8c86bc8e99694f618ede0a19a30eb0135aac20de
SHA512 3aa67d6ed333d5b3fd16e033b2679dce3750a451ab6a41d15fdeb8df96f0d35ee53e2ff0e5ad7dedbfeff040245e4558054ce184cc53de705c6e5dccfac77f53
SSDEEP 3072:KtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:KIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljdbvtolje.exe

Path C:\Temp\i_ljdbvtolje.exe
Size 361KB
SHA256 d3fc76240893e28b8b0c17e90c5da62ef80d09cb555805fa76b0fe6b56c9c615
MD5 2c346d1224aedb9d0fb53eb62a7f38b2
SHA1 ef3e3f44b7dced4a43ca5690b5ce06bf1f954e3f
SHA512 0ead77442e789491517c3169661bfa0ecb1b41ff2fef51b4dfb54de7fac7f00c10fd29e351a58cc33b6aad02d205ca1b0ba1debb5af3f1664bf0f1ff2426a40c
SSDEEP 6144:MflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:MflfAsiVGjSGecvX
TLSH
T1BB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nhfaxspkic.exe

Path C:\Temp\i_nhfaxspkic.exe
Size 361KB
SHA256 e6cd7c97b1b38f22f380c7f30edfee00af904e66ed0ae002163cbab602908e85
MD5 97ce3b4a6ba7e5fc8a390b13b2476900
SHA1 b6fe691b06d81e5e939166f80504962b347ab770
SHA512 cdf393902b6eea2ca7d85cf0ff207f2a7ff9af673dbb1c840b2f510a2dd2a89ba400b4443c6caeb13eb846a9450c6429d0b59b139bcc87ef093ae7acd465f267
SSDEEP 6144:uflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:uflfAsiVGjSGecvX
TLSH
T137747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoigaysqoi.exe

Path C:\Temp\i_qoigaysqoi.exe
Size 361KB
SHA256 25c1c05462e8fbf3e8e541072f9bd70e9d993ced6088dcb08aaf5c6ca75aae7e
MD5 b2d730e21dfd72c68221d1e1f8604641
SHA1 69673dd7bddceeba44df52401fed4d0b6326159a
SHA512 273a740861e8a4f6fa979c16570e11e83365a407c3ddaece8dcedb4b34a27f5710226babdebf0ed83b406c4e4bef22c31986e7049c5be6fa7929fa056b5cffca
SSDEEP 6144:wflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:wflfAsiVGjSGecvX
TLSH
T1B0747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsqkigaysq.exe

Path C:\Temp\i_vsqkigaysq.exe
Size 361KB
SHA256 57de59cac63d4f9aa90591791c5694aa1592db110c01ff69e0c8b1d63315f876
MD5 0bcf001dd3fc5df8bed6343922c55415
SHA1 6291ebae44760e1c4e25778ab34ad6834cc2e5ff
SHA512 ec1711c2950b8ff9a72a2f19d35c4002d08b40c57c33684ba3de37b8f5f59a723f98ffc9bbd6140558a98f6e8a427b808967ceeac27baa1c7d8db2cd3f80c753
SSDEEP 6144:CflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:CflfAsiVGjSGecvX
TLSH
T106747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrojhbzwuo.exe

Path C:\Temp\i_wrojhbzwuo.exe
Size 361KB
SHA256 380c991afecdec07b711e78d20b632c0fd08c1322f6eb09df82aadf46542028a
MD5 e1c4af9deca77295d66d302828e6d3db
SHA1 a2cb9d8f4e260909db7b35be454de64156dc8345
SHA512 ffe02544af7091739a3feafab6635374e778a2132e748de0f95b109c2ac8a2a825ef99e8e9be72d0a87554d7ac55d203b4700270968f48d48ed4c54dccf9b113
SSDEEP 6144:jflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:jflfAsiVGjSGecvX
TLSH
T133747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbvtolje.exe

Path C:\Temp\ljdbvtolje.exe
Size 361KB
SHA256 3da088455b03caa94555e9691d55fd0571d52ef7b365755b05497a84c8c2d969
MD5 774d86622967c3d82cbe49ff48bf0f0d
SHA1 a4cc5472b629b33559ec8e8dab6633e553300bde
SHA512 143a48b3b92c779e43694c4e702cfb134ad502760781579f659b925d34ed27b7f270ba6a1cee35d47d796637a3789c0ff483341da9cf91c1159c21297032d71b
SSDEEP 6144:hflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:hflfAsiVGjSGecvX
TLSH
T112747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfaxspkic.exe

Path C:\Temp\nhfaxspkic.exe
Size 361KB
SHA256 ba65f57c1655a2d1bcc7439e85cb5239f8e4dabaf9364f5c52002e6de32a54b6
MD5 f825b889bbe94a837a2bc4705d3c9ece
SHA1 0af6af32ccf47d0594f8313b0d3be4084490ad99
SHA512 d8340c555ad95ad44f96c32dc13478dd9d97bfadb3d9b7e6c598973a529d7d71c57ea773dce2be4d9cd495b089a4434259e5d470afae167f2c5377e67b87bc5f
SSDEEP 6144:EflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:EflfAsiVGjSGecvX
TLSH
T1A9747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgdbvtnly.sys

Path C:\Temp\olgdbvtnly.sys
Size 293KB
SHA256 170f0fd0c72a4c3c2e312838f8c6ab9552de34e20a9726b993c9bbb5c0018931
MD5 f7a5718c61de31b9f09d91164d928b80
SHA1 d481aac5e6af0c2076e16ec72801446f4b07ca97
SHA512 74308d45422e759a87c61e2319907a093b58a7a5424d1a8080877a8f337b0fe8e016d607adbdb17009440b8bd61902506e2177bdb2f12f919c1afd78927e6971
SSDEEP 3072:DtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:DIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkicausnkf.exe

Path C:\Temp\qkicausnkf.exe
Size 361KB
SHA256 0939c1df3eabde91964acec469fbe5dc656a42cfd11dc5f51f2b44e2904d083b
MD5 507dbb6699ca7c5e6e6e6ba79fb59e30
SHA1 7e67233cacb7436f5fc5f72a2d5f06da4ab25db3
SHA512 df758c2dbee7ca35b97ca5af66a28f0aa2408266c5d28b5d07487535ae6d64cc90c82be5adafc9932c13c81a297235b1e502b3091a9af2a3aa4b2009f65be81d
SSDEEP 6144:EflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:EflfAsiVGjSGecvX
TLSH
T186747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigaysqoi.exe

Path C:\Temp\qoigaysqoi.exe
Size 361KB
SHA256 20582a1e6d3206e1e09719e7343e120aa9a8adbf7f30026a7023937780fe3d23
MD5 bf7da0d2fa1a0848a11b702b4b146404
SHA1 64511e7a3d30b335158e79d2ef1eb0b8cd525b58
SHA512 f6c0438ca52db2b3e33a88218f3523c43bc7a17ab02f4da580bd6220ee47af5406b5ad497756f0d6bf637520e276822b1eeb1bfb434f727d324c8e3d52770a03
SSDEEP 6144:pflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:pflfAsiVGjSGecvX
TLSH
T1AF747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmjecwuomgezwrpm.exe

Path C:\Temp\rmjecwuomgezwrpm.exe
Size 361KB
SHA256 4594af10c85833a8b695fab5529267c233dbd2fea3639236f319199656a18c02
MD5 b5dd0a00de1e4a74b889d0a70c12de10
SHA1 bc4997f95430ab0bfb09368023de8fc85c915d04
SHA512 485fe0dcf191eae75398f07d4bbdfc1f34c77760b0f59b471b7f44ccb3e342d9b088c757a75f85310f8694cd81e5f897de72056126c1ca1e1762d122c7816ea9
SSDEEP 6144:3flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:3flfAsiVGjSGecvX
TLSH
T109747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmjecwuomgezwrpm.sys

Path C:\Temp\rmjecwuomgezwrpm.sys
Size 293KB
SHA256 effb443315962943cf2860fd5f363530058925cbe24b92b0a61e54cfb683c013
MD5 f8a6993dbce2145835cc71270aff9164
SHA1 8001992a6d2b55f93e6c199eec2f36b13c46465e
SHA512 4bb880809582f5816476e351614b92fd16bb63f8c78fd666d386ee04cd29bfbd93a36804517d8d289a6195a38b3d186f00a2fe4bbe1cc7d0454a926a2ca79b85
SSDEEP 3072:otKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:oIJjiJcbI03GBc3ucY5DCSj
TLSH
T19A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbvtrl.sys

Path C:\Temp\trljdbvtrl.sys
Size 293KB
SHA256 85aa6dac477f1a3a3c134a2ba821d60518fe4bfdb25bbf033ad1b525bb28d1e0
MD5 38c0b96e4f04a9f51f00a4de13b0fbc8
SHA1 4a78bb04307955550d83d2e6296e7a8c92119419
SHA512 ff5ee14a45dd5575a0f7f871a2e5677ae7b615b03429b4c6b6632cf6ee6c57cff594bf49d40d756915e5dbad343a683ffa2bd6b3c37800a9d3a1dc321a1037b8
SSDEEP 3072:rtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:rIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsqkigaysq.exe

Path C:\Temp\vsqkigaysq.exe
Size 361KB
SHA256 e50eb6814c65ebbd5c29b6d1c289ac0daf2c4a4e31465a32d76ef56322e72897
MD5 660bf92ca6f255314a3460f602b5240a
SHA1 3fc8407d2a95d8e7aca4e5d5f8b424255a95e0ee
SHA512 ec13de5708b7cd295897d51dca2abfa42ecbdcd65de2ccf1cfc7402e2061d2928d243f5e1cc00a5ac9c60ab8cc3e5cb9b2d253ebc1b149305fac6a3233f5e430
SSDEEP 6144:3DflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXs:3DflfAsiVGjSGecvXs
TLSH
T102747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrojhbzwuo.exe

Path C:\Temp\wrojhbzwuo.exe
Size 361KB
SHA256 340b526404f2fc9846b86b08a6b6209b2763b1ea17d632cf333774c298640656
MD5 d1758a01518f2a8cc35618029224333f
SHA1 6806df39d00fef103ca9e0bdbcd685da3c97c681
SHA512 b3b3d7e7f5f0f9dbb3442ca3d5d1dc8da832b1460151e14c514009783d90e3098fa9d9f1fef7970872ed64c4821f6f54703526b53be63c3352ec7e2695f06a1d
SSDEEP 6144:+flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:+flfAsiVGjSGecvX
TLSH
T118747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqoigdbvt.sys

Path C:\Temp\ywqoigdbvt.sys
Size 293KB
SHA256 bc31cd34b33c2168a055553e6efef54e348df79c075411c717b6e8fcb9270435
MD5 407f82a6cbbf0f18bee539a7e906bb11
SHA1 e1c2ccccb3cafb8b9e29c4360f725ed7026c9709
SHA512 dfbe492e5a7c8f4092c6dee9a42dd46e804f1418fb2098e6338942709d541caa675524024ca67d83ad8e7296680ac89776179154676264909b019d28d81e47f3
SSDEEP 3072:StKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdT:SIJjiJcbI03GBc3ucY5DCSj
TLSH
T117545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

2df412a6-27e0-49eb-bfd6-2f263e12e00f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2df412a6-27e0-49eb-bfd6-2f263e12e00f.tmp
Size 14KB
SHA256 cb0b36301c0345826c7e72e427c3ff17645b1838d34d3231e0b3435f9ef9cb8f
MD5 33c6f7bb6889b463a29139b072e63f37
SHA1 d311698a3573871d638f91a837187d45268b6b48
SHA512 de60798ad70d6acd11c63f63409af99de12f7df135e45b3fe418db5ef795fc11b54af631af79ca390bd51e3cc5d9301d2368253f1f96d406db31e9ed899a6ad7
SSDEEP 192:sxRTRPyM/jK1Ml8UQaCe/f6ssNOIZdzoA8pw/g6+WNIYxmJQGfIgDpJ:sxRT/qde/f6scO2Qw/5IzjX
TLSH
T10162C715AA28993BDCDBD20DFA457F93D6F85573A2940E44AAFC8B0C00E76DD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7b20838787138839257edf140d9423087bb2d63394db8bfded6a0badf5b574ee
MD5 22dc28593301183c67c4b2cb0d19acf8
SHA1 22b75456a977fe16516056a5fe5c882e95a779ce
SHA512 2333cfeb7f1a0def97be7427b2b5c23dc1e4f64c70247de9f134d9d8a3d2d675d514ec69ba08aa13ab1e7f65badb9c63dcb0d11130d1b1962d1c07dc626d4586
TLSH
T1006173A803AD3DE1DF644AB392FE84C831F48869C51F6F334575AE789B5AF44A740312
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599512.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599512.TMP
Size 3KB
SHA256 ab0fe783b62e01d07bca5ef6e3007a744703209b4c50961435ea2259873c33d2
MD5 64da7627f416c61f3aa77731d19cd0e6
SHA1 a4c93ef16992101c2d44e89be306634bea756aab
SHA512 b67b708bd113e6e695a81268dc23b16ec88ed3a78bdb4efd53e8a4f140684ef92d441f1d6af0a9e6e737528065c81589a01f4a7cbae272a7468fb870e83ec010
TLSH
T13F61716807AD3DE1DF244AB382FE84C831F08869C51F2F334175AE789B1AF44A740312
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8d9dddbe3e2ac77be1e31ee9fd02355e5326dca090d55dbe0f6d2e76dff82f35
MD5 9fad39b8b1289b6ad2ad1f4eb4cc53b6
SHA1 9b93eccd157faec8f346798ff0051d7b271b8510
SHA512 6d13b15a62d9eade6287935075807bd2541a89eed8561cc37428632fa7fd3b458e5d73a4e281540e52a8093857a4f8527df304509c05fb7bbc1b4239ad2dcd15
TLSH
T104217FF3C3E5856E891156F06A24AE2BCE1D0905831C3D5AC5D8EF2B93E3475E10159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e75c23a8069e89a69593edeca6684a9b0ac8e05f5da64a48e273c0a67700cc05
MD5 fd2a26f61748e738c06d1a8658763108
SHA1 43387f357c1db94a4c449054d2eae8e91a500401
SHA512 65f8dd2fb1abfaf67424a56c79b26f2415d6162c12ec35332e7168414e95093fb62e24b9f2e46b92c41d226adf1616ca6b0a160735ef91c2c36f63d133217bc4
SSDEEP 192:sxRoRPyM/jK1Ml8wCe/f6snNcIZdzoA8pi/g6+WNIYxvJQGfIgtJ:sxRo/8e/f6sNc2Qi/5I4j3
TLSH
T18E52E915AA24993BCCDBD20DFA457F93D6F81573A2941E44AAFC8B0C44E76ED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b911f405be035ce550e85b17fdb2edd69497104180869b67545587ad8cd6abfe
MD5 a5847e713442909a128448f9f4d90ca3
SHA1 35b502599f3fa2b4fac0d180160d5bd853141d5e
SHA512 61862eb669a3717d13d3208c6af9a1d6bed0b4dc826f114f22e80896bef7f7dfef45b348b252bbf9321ce3be46d1cfd7106d7ab0240f86c20c8f85e2f841ca26
SSDEEP 192:sxRTRPyM/jK1Ml8wCe/f6ssNcIZdzoA8pi/g6+WNIYxvJQGfIgDjJ:sxRT/8e/f6scc2Qi/5I4j5
TLSH
T12F52EA15AA28593BCCDBD20DFA457F93D6F81573A2941E44AAFC8B0C44E76DD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 90984fcb7a33e2e09086b16c9d315de0fbb17bec4312692255b5ee5a626a07e7
MD5 060acaef12175275635efb9798dcee50
SHA1 084ccaed70fa4708a3f2be1850cc3d49a0a98fbf
SHA512 6c3ecc2243dcab93af212fe33ee0906e6b064e438aad05efbdd4d1becc5ef73cece0f43bdea3e2eb4cf0f0f482f9edbc900f36804babaa17a4212199077b9b67
SSDEEP 768:0xCyDs7pLuL7ijWgbrfM18F1+UoAYDCx9Tuqh0VfUC9xbog/OVMq4rVApxroJqE0:0xCyDQE7ijWgbrfM1u1jaHq4pApKJqfX
TLSH
T10AE2EC7B680CCB7E4F404A9DEC297EDEADE802CB96D8C95447EA480C03C67EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a69efe7aa7798f6c76305a65ca0c071b2cde94141d799662f50258cf3c703414
MD5 e94e90a897bb7ff8d5ccb1a2c5d8c53c
SHA1 22474b8b099c2f45b3ab2cde41f8a3ec02678a9f
SHA512 d99c2c4db535a6c037db5c37b94412e20860bba05bab9a47d6aace033373755f03364e5c244eeca75e45d00aa2636bdb86d9b4bc0279c2311829ed60f2221b21
SSDEEP 24:KSiSEiqiDivPikSi1iRiA1iticDiZEihiEiGPiDSigiMiP1iEijDiGI4ioiPKXiS:KIeOIXKzKI7ytrIpK8AUYYIfKxWM5
TLSH
T1AC912186F17A029028FE6A0D84A1E657D6C1B0773128E56B37E851730F6BF421EFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a2ee1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a2ee1.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 03b7fa1eab8c9e63cb8740c812853f65538288b42a7e55f02a6d640af6779824
MD5 763c18f08a6015bdba6e85f9d9281e63
SHA1 37c16c1d2595ddf68cdbadef310130cdb16f077e
SHA512 bfe62da7dc635852dac50ed7cad153922759fec147ed66492af0cff13f55f766147bd91a2bcf9c1db5b462cf3f9ef9bb411d54a01a802b94050d98252dc65bc9
SSDEEP 768:lF1j+9E35wg/0ItnF669yrqUjWiIwwxMtFb9MA:s9E3pnF66INWZTMXb+A
TLSH
T10F037C35EC55CBBB99E68B86B31277C6EEE001E785CC4ED8DAC8AE0D00875DD1747829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bb3f12eb1306d53764c666af9b3766f52a3092f3ad823328c27270b6b3ce753b
MD5 cc749976334164a6316a0e192b3a822d
SHA1 5c6484dcdda985ec7fef706cb02de619ac835ca8
SHA512 5a639511aa9469e702c65e0f59eb3e3a4688685c4f37223a23845dc3f5de8543f5c66b8e5bd31ff0f570fce3bab5baf76789471a379408c289853f87a2552b56
SSDEEP 768:arv+4UNbdl38PkKL22jF669yrqUjWiIwwxMRgUiler:absbX3DujF66INWZTMmUsQ
TLSH
T1F203CE30A8589AB7CCF2D68672437783BFB4109396C50B88CADC670D469B0CD2747A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 fc7d88a5511980df3cb83ccf2cd8807f30b026b1c0c5dd0e1a8d90a7a87fee88
MD5 82c429c1855f8089fa6c40cf58cd94d5
SHA1 656cc3e5d8cc3e515145e4fcb373514c7ce9ffbc
SHA512 753421edc5d61af17c96b399fbaca76dfb0f29287a15814641dbff4e1017b108358f1fdb147d57188a45a18bdd3fe39f5a388f8d7149ad8c1a58ed839a875b27
SSDEEP 768:7rv+4UNbd+3s0BkKL2njF669yrqUjWiIwwxMtFBe:7bsb43CvjF66INWZTMXBe
TLSH
T11503BE70B8689AB7C8F6D685B21377C3BF7410A385C90F98CAC9A70D454B4DD278B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7d5be3381991a9189b1ccf82d2be1c6636c081b1d65fded48fd37ee1338ae7e6
MD5 d5e1dfe90c667154854f135ea3c8d50e
SHA1 fcfa836e9a7df3d1729fcb1403973efcabaa87c4
SHA512 4b072ec760c513c9b2bbec599f7b0e616fa53d386eb71d20af09c2f68b7bfefc662eb638cc4655a7784717df0a862086753433002f1da6603073ac34ebcae463
SSDEEP 768:Fj+9E3Z0BkKL2njF669yrqUjWiIwwxMtFb9MA:w9E3rvjF66INWZTMXb+A
TLSH
T181F2AE30AC655EB788E6D785B21337C6EEA011E781C90F8CD6DCAB0D05875DC2A8792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

ea1d123c-69fd-4e78-9eda-f4a60bbd5e3a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ea1d123c-69fd-4e78-9eda-f4a60bbd5e3a.tmp
Size 35KB
SHA256 78407e2a7595af31bde09b0196d39cffeceaf881829ba20fceca6887a2ca8ffe
MD5 adcd49d3c5fd790749a4f188aa806870
SHA1 d6b92ddc66d2da977b1ef4e54b4acec4faf29e01
SHA512 66e2954e783811449d576bcba8d12305aab0e58e2e61d165a08142e9c5f7f3b32e75fcb4e509134d361d37be920aea8e9a037befebda90c6108f9b4f418f9d47
SSDEEP 768:Qj+9E3Q0BkKL2njF669yrqUjWiIwwxMtFb9MA:v9E3uvjF66INWZTMXb+A
TLSH
T16FF2AE30AC555FB788E6D785B21337C6EFA011E785C90F8CD6DCAB0D05875DC2A8752A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2fdcad2c-43f5-441c-a236-a359db2aba7b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2fdcad2c-43f5-441c-a236-a359db2aba7b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4196_1724006159\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 0b22b8f593b181f3389fd41cf4a91d2a1cb11530b42ab16de0adf7091336c103
MD5 57798238e5743262b06ee20e5bb62ca2
SHA1 f68eddc22b0081b70a780d28622af3a22564df56
SHA512 11cb13183b4a47b50592880275ac312f07c96a16f3cc70c69b8a36ac9cab41db26802334c6ab3d313e7edbb5532d562f164d6f4b92ecd284019ba7574433a513
TLSH
T1BD71E39357B9C5B3C1DE5FF502835648F5FF22380B6370350B956546AB30A7A68B8F48
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2292-456-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2496-441-0x0000000000E30000-0x0000000000E8F000-memory.dmp

Download

memory/3548-276-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4220-248-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4220-212-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4220-451-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4252-506-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4256-397-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4256-375-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4552-401-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4968-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4992-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5032-247-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5336-331-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5484-346-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5564-421-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5568-410-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5568-387-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5772-289-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6012-476-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6012-503-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6044-488-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6140-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6140-317-0x0000000000010000-0x00000000000AB000-memory.dmp

Download