systex | 7e3ea770bd10ac4dc31d93514b7552372a2317869b6040ccdfb917ef6c201242

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260715-e87ewsew6s
SHA256 7e3ea770bd10ac4dc31d93514b7552372a2317869b6040ccdfb917ef6c201242
MD5 8c6c7a2d4fca22dc342982fe46baa64f
SHA1 811ba5fedc7fdf09427a6d363d9419bc5d1e1645
SHA512 6afdafeb4f27f96f8d3d27e7380adfd7f785e5da63adcee599b8b9a37cf0a568f3921de835a0705e78ec4920bd39b4984d1aa1de27287f9d856b8e9736ed7305
SSDEEP 6144:AflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:AflfAsiVGjSGecvX
TLSH
T1CB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5316	wuomgezwrpjhbztr.exe
3408	wuomgezwrpjhbztr.sys
1400	CreateProcess.exe
5552	ztrjhbzumj.exe
4168	CreateProcess.exe
5908	CreateProcess.exe
5532	i_ztrjhbzumj.exe
1964	uomgebwuom.sys
1640	CreateProcess.exe
5088	bztomebwto.exe
4252	CreateProcess.exe
4432	CreateProcess.exe
1136	i_bztomebwto.exe
1844	bztrljdbwt.sys
4864	CreateProcess.exe
5804	roigbvtolg.exe
4100	CreateProcess.exe
4540	CreateProcess.exe
4332	i_roigbvtolg.exe
5708	gdbvtnlfdy.sys
4428	CreateProcess.exe
4596	igdywqoiga.exe
1728	CreateProcess.exe
4700	CreateProcess.exe
5812	i_igdywqoiga.exe
3664	gdxvqnlfdx.sys
4828	CreateProcess.exe
3592	cavsnlfdyv.exe
1356	CreateProcess.exe
968	CreateProcess.exe
680	i_cavsnlfdyv.exe
2108	dayvqnifax.sys
936	CreateProcess.exe
428	sqnhfaxsqk.exe
4532	CreateProcess.exe
1304	CreateProcess.exe
4156	i_sqnhfaxsqk.exe
2416	xspkicausm.sys
3388	CreateProcess.exe
1740	spkicausmk.exe
2564	CreateProcess.exe
4832	CreateProcess.exe
4844	i_spkicausmk.exe
4240	keczxupmkh.sys
4564	CreateProcess.exe
204	mjhczxupmh.exe
5820	CreateProcess.exe
4324	CreateProcess.exe
2364	i_mjhczxupmh.exe
1272	urmkecwupm.sys
5384	CreateProcess.exe
4476	mhecwuomhe.exe
2812	CreateProcess.exe
4316	CreateProcess.exe
6112	i_mhecwuomhe.exe
3780	uomhezwrom.sys
3088	CreateProcess.exe
1440	hbztrljebw.exe
2688	CreateProcess.exe
5764	CreateProcess.exe
3928	i_hbztrljebw.exe
2900	jgeywrojgb.sys
5540	CreateProcess.exe
5888	ljdbwtrljd.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2448_164388676\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2448_1135252823\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2448_1135252823\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrjhbzumj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqnhfaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfdayvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrpjztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_roigbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdywqolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuomjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrjhbzumj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cavsnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkhbzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	roigbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igdywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhczxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdywqolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspnhfaxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czusmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkhbzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztomebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igdywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czusmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cavsnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqnhfaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfdayvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwrpjztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwuomjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgezwrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbwtrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspnhfaxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytqoljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztomebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhczxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbwtrljd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5920	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1296	ipconfig.exe
1476	ipconfig.exe
4288	ipconfig.exe
1956	ipconfig.exe
556	ipconfig.exe
3440	ipconfig.exe
4204	ipconfig.exe
3880	ipconfig.exe
996	ipconfig.exe
4504	ipconfig.exe
4184	ipconfig.exe
1204	ipconfig.exe
4856	ipconfig.exe
2136	ipconfig.exe
5192	ipconfig.exe
4892	ipconfig.exe
5132	ipconfig.exe
5528	ipconfig.exe
3336	ipconfig.exe
4712	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285638748496389"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{B4D7AD06-420E-447D-B180-8B0DE7314C5A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5316	wuomgezwrpjhbztr.exe
5316	wuomgezwrpjhbztr.exe
5316	wuomgezwrpjhbztr.exe
5316	wuomgezwrpjhbztr.exe
5316	wuomgezwrpjhbztr.exe
5316	wuomgezwrpjhbztr.exe
5316	wuomgezwrpjhbztr.exe
5316	wuomgezwrpjhbztr.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5532	i_ztrjhbzumj.exe
Token: SeDebugPrivilege	1136	i_bztomebwto.exe
Token: SeDebugPrivilege	4332	i_roigbvtolg.exe
Token: SeDebugPrivilege	5812	i_igdywqoiga.exe
Token: SeDebugPrivilege	680	i_cavsnlfdyv.exe
Token: SeDebugPrivilege	4156	i_sqnhfaxsqk.exe
Token: SeDebugPrivilege	4844	i_spkicausmk.exe
Token: SeDebugPrivilege	2364	i_mjhczxupmh.exe
Token: SeDebugPrivilege	6112	i_mhecwuomhe.exe
Token: SeDebugPrivilege	3928	i_hbztrljebw.exe
Token: SeDebugPrivilege	1028	i_ljdbwtrljd.exe
Token: SeDebugPrivilege	1384	i_lgdywqolge.exe
Token: SeDebugPrivilege	5672	i_bvtnlfdxvq.exe
Token: SeDebugPrivilege	1244	i_nkfdayvqni.exe
Token: SeDebugPrivilege	5944	i_xspnhfaxvp.exe
Token: SeDebugPrivilege	996	i_czusmkecxu.exe
Token: SeDebugPrivilege	4684	i_urmkhbzxrp.exe
Token: SeDebugPrivilege	2840	i_ezwrpjztrm.exe
Token: SeDebugPrivilege	5892	i_ebwuomjebw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2448	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 5316	4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 4300 wrote to memory of 1852	4300	2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 1852 wrote to memory of 2448	1852	iexplore.exe	89
PID 2448 wrote to memory of 2632	2448	msedge.exe	90
PID 2448 wrote to memory of 1656	2448	msedge.exe	92
PID 2448 wrote to memory of 5920	2448	msedge.exe	93
PID 2448 wrote to memory of 1656	2448	msedge.exe	92
PID 2448 wrote to memory of 1656	2448	msedge.exe	92
PID 2448 wrote to memory of 2032	2448	msedge.exe	94
PID 2448 wrote to memory of 2032	2448	msedge.exe	94
PID 2448 wrote to memory of 3128	2448	msedge.exe	95
PID 2448 wrote to memory of 3128	2448	msedge.exe	95
PID 2448 wrote to memory of 3128	2448	msedge.exe	95
PID 2448 wrote to memory of 3152	2448	msedge.exe	96
PID 2448 wrote to memory of 3152	2448	msedge.exe	96
PID 2448 wrote to memory of 3152	2448	msedge.exe	96
PID 2448 wrote to memory of 3284	2448	msedge.exe	97
PID 2448 wrote to memory of 3284	2448	msedge.exe	97
PID 2448 wrote to memory of 3284	2448	msedge.exe	97
PID 2448 wrote to memory of 1032	2448	msedge.exe	98
PID 2448 wrote to memory of 1032	2448	msedge.exe	98
PID 2448 wrote to memory of 1032	2448	msedge.exe	98
PID 2448 wrote to memory of 3876	2448	msedge.exe	99
PID 2448 wrote to memory of 3876	2448	msedge.exe	99
PID 5316 wrote to memory of 1400	5316	wuomgezwrpjhbztr.exe	103
PID 5552 wrote to memory of 4168	5552	ztrjhbzumj.exe	106
PID 2448 wrote to memory of 3296	2448	msedge.exe	109
PID 2448 wrote to memory of 4132	2448	msedge.exe	110
PID 2448 wrote to memory of 3296	2448	msedge.exe	109
PID 2448 wrote to memory of 4132	2448	msedge.exe	110
PID 2448 wrote to memory of 5476	2448	msedge.exe	112
PID 2448 wrote to memory of 3336	2448	msedge.exe	113
PID 2448 wrote to memory of 3336	2448	msedge.exe	113
PID 2448 wrote to memory of 2676	2448	msedge.exe	114
PID 2448 wrote to memory of 2676	2448	msedge.exe	114
PID 5316 wrote to memory of 5908	5316	wuomgezwrpjhbztr.exe	116
PID 5316 wrote to memory of 1640	5316	wuomgezwrpjhbztr.exe	121
PID 5088 wrote to memory of 4252	5088	bztomebwto.exe	123
PID 5316 wrote to memory of 4432	5316	wuomgezwrpjhbztr.exe	126
PID 5316 wrote to memory of 4864	5316	wuomgezwrpjhbztr.exe	130
PID 5804 wrote to memory of 4100	5804	roigbvtolg.exe	132
PID 5316 wrote to memory of 4540	5316	wuomgezwrpjhbztr.exe	135
PID 5316 wrote to memory of 4428	5316	wuomgezwrpjhbztr.exe	140
PID 4596 wrote to memory of 1728	4596	igdywqoiga.exe	142
PID 5316 wrote to memory of 4700	5316	wuomgezwrpjhbztr.exe	145
PID 2448 wrote to memory of 2884	2448	msedge.exe	147
PID 2448 wrote to memory of 4852	2448	msedge.exe	148
PID 2448 wrote to memory of 4164	2448	msedge.exe	149
PID 5316 wrote to memory of 4828	5316	wuomgezwrpjhbztr.exe	152
PID 3592 wrote to memory of 1356	3592	cavsnlfdyv.exe	154
PID 5316 wrote to memory of 968	5316	wuomgezwrpjhbztr.exe	157
PID 5316 wrote to memory of 936	5316	wuomgezwrpjhbztr.exe	161
PID 428 wrote to memory of 4532	428	sqnhfaxsqk.exe	163
PID 5316 wrote to memory of 1304	5316	wuomgezwrpjhbztr.exe	166
PID 5316 wrote to memory of 3388	5316	wuomgezwrpjhbztr.exe	170
PID 1740 wrote to memory of 2564	1740	spkicausmk.exe	172
PID 5316 wrote to memory of 4832	5316	wuomgezwrpjhbztr.exe	175
PID 5316 wrote to memory of 4564	5316	wuomgezwrpjhbztr.exe	179
PID 204 wrote to memory of 5820	204	mjhczxupmh.exe	181
PID 5316 wrote to memory of 4324	5316	wuomgezwrpjhbztr.exe	184
PID 2448 wrote to memory of 2132	2448	msedge.exe	186
PID 2448 wrote to memory of 2132	2448	msedge.exe	186
PID 5316 wrote to memory of 5384	5316	wuomgezwrpjhbztr.exe	192
PID 4476 wrote to memory of 2812	4476	mhecwuomhe.exe	194

C:\Users\Admin\AppData\Local\Temp\2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_8c6c7a2d4fca22dc342982fe46baa64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Temp\wuomgezwrpjhbztr.exe
  C:\Temp\wuomgezwrpjhbztr.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrjhbzumj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1400
  - - C:\Temp\ztrjhbzumj.exe
      C:\Temp\ztrjhbzumj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5552
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4168
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:556
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrjhbzumj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5908
  - - C:\Temp\i_ztrjhbzumj.exe
      C:\Temp\i_ztrjhbzumj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztomebwto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1640
  - - C:\Temp\bztomebwto.exe
      C:\Temp\bztomebwto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5088
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4252
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztomebwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4432
  - - C:\Temp\i_bztomebwto.exe
      C:\Temp\i_bztomebwto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\roigbvtolg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4864
  - - C:\Temp\roigbvtolg.exe
      C:\Temp\roigbvtolg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5804
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4100
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_roigbvtolg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4540
  - - C:\Temp\i_roigbvtolg.exe
      C:\Temp\i_roigbvtolg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igdywqoiga.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4428
  - - C:\Temp\igdywqoiga.exe
      C:\Temp\igdywqoiga.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4596
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1728
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igdywqoiga.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4700
  - - C:\Temp\i_igdywqoiga.exe
      C:\Temp\i_igdywqoiga.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cavsnlfdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4828
  - - C:\Temp\cavsnlfdyv.exe
      C:\Temp\cavsnlfdyv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3592
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1356
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cavsnlfdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:968
  - - C:\Temp\i_cavsnlfdyv.exe
      C:\Temp\i_cavsnlfdyv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqnhfaxsqk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:936
  - - C:\Temp\sqnhfaxsqk.exe
      C:\Temp\sqnhfaxsqk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:428
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4532
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqnhfaxsqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1304
  - - C:\Temp\i_sqnhfaxsqk.exe
      C:\Temp\i_sqnhfaxsqk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkicausmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3388
  - - C:\Temp\spkicausmk.exe
      C:\Temp\spkicausmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1740
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2564
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkicausmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4832
  - - C:\Temp\i_spkicausmk.exe
      C:\Temp\i_spkicausmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjhczxupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4564
  - - C:\Temp\mjhczxupmh.exe
      C:\Temp\mjhczxupmh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:204
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5820
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjhczxupmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4324
  - - C:\Temp\i_mjhczxupmh.exe
      C:\Temp\i_mjhczxupmh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhecwuomhe.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5384
  - - C:\Temp\mhecwuomhe.exe
      C:\Temp\mhecwuomhe.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4476
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2812
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhecwuomhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4316
  - - C:\Temp\i_mhecwuomhe.exe
      C:\Temp\i_mhecwuomhe.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbztrljebw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3088
  - - C:\Temp\hbztrljebw.exe
      C:\Temp\hbztrljebw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1440
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2688
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbztrljebw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5764
  - - C:\Temp\i_hbztrljebw.exe
      C:\Temp\i_hbztrljebw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbwtrljd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5540
  - - C:\Temp\ljdbwtrljd.exe
      C:\Temp\ljdbwtrljd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5888
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4740
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbwtrljd.exe ups_ins
    3⤵
    PID:5020
  - - C:\Temp\i_ljdbwtrljd.exe
      C:\Temp\i_ljdbwtrljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdywqolge.exe ups_run
    3⤵
    PID:356
  - - C:\Temp\lgdywqolge.exe
      C:\Temp\lgdywqolge.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1272
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2012
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgdywqolge.exe ups_ins
    3⤵
    PID:5372
  - - C:\Temp\i_lgdywqolge.exe
      C:\Temp\i_lgdywqolge.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtnlfdxvq.exe ups_run
    3⤵
    PID:5928
  - - C:\Temp\bvtnlfdxvq.exe
      C:\Temp\bvtnlfdxvq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4592
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1260
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtnlfdxvq.exe ups_ins
    3⤵
    PID:2904
  - - C:\Temp\i_bvtnlfdxvq.exe
      C:\Temp\i_bvtnlfdxvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkfdayvqni.exe ups_run
    3⤵
    PID:2388
  - - C:\Temp\nkfdayvqni.exe
      C:\Temp\nkfdayvqni.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3000
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2940
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkfdayvqni.exe ups_ins
    3⤵
    PID:5636
  - - C:\Temp\i_nkfdayvqni.exe
      C:\Temp\i_nkfdayvqni.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xspnhfaxvp.exe ups_run
    3⤵
    PID:1828
  - - C:\Temp\xspnhfaxvp.exe
      C:\Temp\xspnhfaxvp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4856
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4704
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xspnhfaxvp.exe ups_ins
    3⤵
    PID:5084
  - - C:\Temp\i_xspnhfaxvp.exe
      C:\Temp\i_xspnhfaxvp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czusmkecxu.exe ups_run
    3⤵
    PID:2692
  - - C:\Temp\czusmkecxu.exe
      C:\Temp\czusmkecxu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:624
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4204
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czusmkecxu.exe ups_ins
    3⤵
    PID:4332
  - - C:\Temp\i_czusmkecxu.exe
      C:\Temp\i_czusmkecxu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmkhbzxrp.exe ups_run
    3⤵
    PID:4568
  - - C:\Temp\urmkhbzxrp.exe
      C:\Temp\urmkhbzxrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4216
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4636
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmkhbzxrp.exe ups_ins
    3⤵
    PID:4712
  - - C:\Temp\i_urmkhbzxrp.exe
      C:\Temp\i_urmkhbzxrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezwrpjztrm.exe ups_run
    3⤵
    PID:4876
  - - C:\Temp\ezwrpjztrm.exe
      C:\Temp\ezwrpjztrm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3364
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3212
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezwrpjztrm.exe ups_ins
    3⤵
    PID:1232
  - - C:\Temp\i_ezwrpjztrm.exe
      C:\Temp\i_ezwrpjztrm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwuomjebw.exe ups_run
    3⤵
    PID:1352
  - - C:\Temp\ebwuomjebw.exe
      C:\Temp\ebwuomjebw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1564
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5808
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebwuomjebw.exe ups_ins
    3⤵
    PID:4304
  - - C:\Temp\i_ebwuomjebw.exe
      C:\Temp\i_ebwuomjebw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbytqoljdb.exe ups_run
    3⤵
    PID:5520
  - - C:\Temp\gbytqoljdb.exe
      C:\Temp\gbytqoljdb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2852
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4176
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5132
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffa6063c188,0x7ffa6063c194,0x7ffa6063c1a0
      4⤵
      PID:2632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1920,i,3789540634383617307,997498081901444775,262144 --field-trial-handle=2800,i,15419375998195847430,6628835988024535089,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:2
      4⤵
      PID:1656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,4549627442921681534,3816724425359879101,524288 --field-trial-handle=2800,i,15419375998195847430,6628835988024535089,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:11
      4⤵
      System Time Discovery
      PID:5920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,12981095680568190560,4450758430053431115,524288 --field-trial-handle=2800,i,15419375998195847430,6628835988024535089,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:13
      4⤵
      PID:2032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,13959223767128854666,2865180872893516799,2097152 --field-trial-handle=2800,i,15419375998195847430,6628835988024535089,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:3128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,13697869748641639685,6414282194741353122,2097152 --field-trial-handle=2800,i,15419375998195847430,6628835988024535089,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:3152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,17709936408834385958,12694901627539783842,2097152 --field-trial-handle=2800,i,15419375998195847430,6628835988024535089,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
      4⤵
      PID:3284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,12345802767346216033,15555606073035314866,2097152 --field-trial-handle=2800,i,15419375998195847430,6628835988024535089,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:9
      4⤵
      PID:1032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,9449098112959909004,14970177535706817758,524288 --field-trial-handle=2800,i,15419375998195847430,6628835988024535089,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14
      4⤵
      PID:3876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,4828018151651257450,15253217211219268658,524288 --field-trial-handle=2800,i,15419375998195847430,6628835988024535089,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:3296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,12529286608785492703,6115182893604608303,524288 --field-trial-handle=2800,i,15419375998195847430,6628835988024535089,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:14
      4⤵
      PID:4132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,11575692225971955157,5349784571223081534,524288 --field-trial-handle=2800,i,15419375998195847430,6628835988024535089,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:4204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,11575692225971955157,5349784571223081534,524288 --field-trial-handle=2800,i,15419375998195847430,6628835988024535089,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:5476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,8149548295782304242,9155395530233689352,524288 --field-trial-handle=2800,i,15419375998195847430,6628835988024535089,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
      4⤵
      PID:3336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,5487600534144099896,2840100063626282802,524288 --field-trial-handle=2800,i,15419375998195847430,6628835988024535089,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
      4⤵
      PID:2676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,13237090963119965199,12358847254614088316,524288 --field-trial-handle=2800,i,15419375998195847430,6628835988024535089,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14
      4⤵
      PID:2884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,4146287295220824088,2478186628991076319,524288 --field-trial-handle=2800,i,15419375998195847430,6628835988024535089,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
      4⤵
      PID:4852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,12286104178895125790,348119652505965039,524288 --field-trial-handle=2800,i,15419375998195847430,6628835988024535089,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
      4⤵
      PID:4164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,2224272915748120323,3428454179338342398,524288 --field-trial-handle=2800,i,15419375998195847430,6628835988024535089,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
      4⤵
      PID:2132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,533391784863338499,10123480705033530605,524288 --field-trial-handle=2800,i,15419375998195847430,6628835988024535089,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:14
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6412,i,9273976886001695462,13556437101447485405,262144 --field-trial-handle=2800,i,15419375998195847430,6628835988024535089,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:10
      4⤵
      PID:4156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,14181026104982155440,15032238330572767077,524288 --field-trial-handle=2800,i,15419375998195847430,6628835988024535089,262144 --variations-seed-version --mojo-platform-channel-handle=1428 /prefetch:14
      4⤵
      PID:4456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5820

C:\Temp\wuomgezwrpjhbztr.sys
C:\Temp\wuomgezwrpjhbztr.sys
1⤵
- Executes dropped EXE
PID:3408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3576

C:\Temp\uomgebwuom.sys
C:\Temp\uomgebwuom.sys
1⤵
- Executes dropped EXE
PID:1964

C:\Temp\bztrljdbwt.sys
C:\Temp\bztrljdbwt.sys
1⤵
- Executes dropped EXE
PID:1844

C:\Temp\gdbvtnlfdy.sys
C:\Temp\gdbvtnlfdy.sys
1⤵
- Executes dropped EXE
PID:5708

C:\Temp\gdxvqnlfdx.sys
C:\Temp\gdxvqnlfdx.sys
1⤵
- Executes dropped EXE
PID:3664

C:\Temp\dayvqnifax.sys
C:\Temp\dayvqnifax.sys
1⤵
- Executes dropped EXE
PID:2108

C:\Temp\xspkicausm.sys
C:\Temp\xspkicausm.sys
1⤵
- Executes dropped EXE
PID:2416

C:\Temp\keczxupmkh.sys
C:\Temp\keczxupmkh.sys
1⤵
- Executes dropped EXE
PID:4240

C:\Temp\urmkecwupm.sys
C:\Temp\urmkecwupm.sys
1⤵
- Executes dropped EXE
PID:1272

C:\Temp\uomhezwrom.sys
C:\Temp\uomhezwrom.sys
1⤵
- Executes dropped EXE
PID:3780

C:\Temp\jgeywrojgb.sys
C:\Temp\jgeywrojgb.sys
1⤵
- Executes dropped EXE
PID:2900

C:\Temp\ljdbvtolge.sys
C:\Temp\ljdbvtolge.sys
1⤵
PID:2748

C:\Temp\dyvtnligdx.sys
C:\Temp\dyvtnligdx.sys
1⤵
PID:6112

C:\Temp\avsnlfdxvq.sys
C:\Temp\avsnlfdxvq.sys
1⤵
PID:3400

C:\Temp\xvpnifdxvp.sys
C:\Temp\xvpnifdxvp.sys
1⤵
PID:5720

C:\Temp\causmkfcxv.sys
C:\Temp\causmkfcxv.sys
1⤵
PID:5984

C:\Temp\fzujhfcxup.sys
C:\Temp\fzujhfcxup.sys
1⤵
PID:4792

C:\Temp\zwurmjhezx.sys
C:\Temp\zwurmjhezx.sys
1⤵
PID:4928

C:\Temp\hbztrljebw.sys
C:\Temp\hbztrljebw.sys
1⤵
PID:604

C:\Temp\jdbwtoljdb.sys
C:\Temp\jdbwtoljdb.sys
1⤵
PID:5256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bztomebwto.exe

Path C:\Temp\bztomebwto.exe
Size 361KB
SHA256 2ad4b0e9092b493a6f942f28321ce41250457a69aa95f5829812b47b50736616
MD5 375ec76378db70a66456212bfa898d28
SHA1 02ace7dd7f56d6b49ba9f3c2e744fedf4f187196
SHA512 838db03315abd327937697ef246ce57b568f7ad8a66e0a7ef541f5930ffc90f3fbb592663784d3b93984b78b7faf9d70843694d4fce0ac0e7b178a7361f8e81d
SSDEEP 6144:3flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:3flfAsiVGjSGecvX
TLSH
T152747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrljdbwt.sys

Path C:\Temp\bztrljdbwt.sys
Size 293KB
SHA256 681192289cec431e6151526ee2f5dc8be7eb7606e2f920a1a2e763392e93e11d
MD5 b8fde283dc0be647d362f8024beebae7
SHA1 9c890b677ec57040e052e5c2726f09b8dc9cc3f2
SHA512 f4c36d56d1ff730f32f7d5774903d933ab6d8d63336c8491169b1b3db3bc9ce25d771c0c5b24890e13841817f21cc6defeecb05df64dc4c8602006da5900c512
SSDEEP 3072:ttKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:tIJjiJcbI03GBc3ucY5DCSj
TLSH
T12F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cavsnlfdyv.exe

Path C:\Temp\cavsnlfdyv.exe
Size 361KB
SHA256 7873f28759b9e2931d18914497c14cf2406196d85ff8f7f831ae0173bde5a546
MD5 51c22ec853a309cc7e4a586571e42a4d
SHA1 62bb1bf156f08517f5f9e131b117dc9045a8f2ee
SHA512 992c2a1354f4e712e8d1b718dc0f69b6b69a12057d648e41a674948478f3653381c3bcac8d31e6cce84428b15c28ed5b6bbf0626f7cf92352ba015a3f77171be
SSDEEP 6144:/flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:/flfAsiVGjSGecvX
TLSH
T1B1747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dayvqnifax.sys

Path C:\Temp\dayvqnifax.sys
Size 293KB
SHA256 38493dd882e7a6375f1a3cb9effe186fcf670f6c1c0549841778f796e5246bc2
MD5 1f604730214caf5350a00c5e0c526515
SHA1 79eb780a277a3b7f986398501c3d545be42fd79c
SHA512 43238a36c85fc9e056ebc436eb31c72d315402580075094ad3d77b95e6885b0a6c7973ddb59d1a087397ca1f02f11961ab8ebcbca8097f08780c2cf140d46f96
SSDEEP 3072:5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:5IJjiJcbI03GBc3ucY5DCSj
TLSH
T1FA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdbvtnlfdy.sys

Path C:\Temp\gdbvtnlfdy.sys
Size 293KB
SHA256 019f944f4622c719047c80e244fb8d5021b8598a01bcb8976033b8b52db4201f
MD5 a664d6585beb2dc6e9aa1fd6d832456a
SHA1 91077898b4e01f557ed65b4238acbf973bb23d63
SHA512 bfbff0cab1a94ffae31a9e486f24c3f78b8b4b5d6674242c9dfba2fd9d477dbc1ed0d9b24af8d62f44d9887201d06dab22e9263d1e65e07ad7cc05563c5bb52f
SSDEEP 3072:VtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:VIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdxvqnlfdx.sys

Path C:\Temp\gdxvqnlfdx.sys
Size 293KB
SHA256 6746e956532deef22133a43567825558819ae63e46cb9fb638b4b6bdd31a03c0
MD5 423c7cc170af2eb448bc20a8f75f2f38
SHA1 7a3d27f57def093dd1608df25e54857077294dbc
SHA512 bf8308fd8380b659bcc87ee39856b5eaccdc38da0ed9c13a05551d61193cdc9758dee5c8dd999d8178df5d3eab8930b815eb912efd00bcad0d8a3f4a32e96da4
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T108545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bztomebwto.exe

Path C:\Temp\i_bztomebwto.exe
Size 361KB
SHA256 833354f6716ffe0fb37b0b39bfe2dab2e1704cbc12302cb6a75248def2698933
MD5 e61517147e5a736198705d92d117eae2
SHA1 b3f53ce8fcd614db621cc6bf725141d8c065240d
SHA512 61867aabcfe425049cecebeb481cc6f193eb0c13a7accb38231adaf0759c5d21b6e50024842bfb36018da7ba8330b1014a488ca4b1640296301c7bd35ee3b3af
SSDEEP 6144:2flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:2flfAsiVGjSGecvX
TLSH
T1F8747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cavsnlfdyv.exe

Path C:\Temp\i_cavsnlfdyv.exe
Size 361KB
SHA256 a18ef2dca864d047d89334653c76e585473d8ef5db54afa1e123170755335036
MD5 3141734d2b56bb6f6aaf8c436b73c830
SHA1 dc86773bbf797895e5d0314b9e6392e93860fb41
SHA512 5e28ce61cacfb9bed72c1003de412ea3d665ece52d641dce9d58f40b3197a05397c06ce784652553d349e05df6ace238cbbb5d4e55570d77cf1c59ea83661bab
SSDEEP 6144:gflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:gflfAsiVGjSGecvX
TLSH
T136747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igdywqoiga.exe

Path C:\Temp\i_igdywqoiga.exe
Size 361KB
SHA256 7258c3365ef7458c7023622edf0a8ae9810acf6ad21e2ad147081a7fb61d2696
MD5 af05e861414436c8bb23b9b5406332b1
SHA1 a3921e28cfe3059fb293b982eb26589a9464a368
SHA512 822145e208f6bcb352c16b01ba2388085268d2458e9335ca6367adf98327043e72f9b5a30ce5c3dbe54b20848a2837dc596f4a1fd4009f100f1c3f578293eb34
SSDEEP 6144:SflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:SflfAsiVGjSGecvX
TLSH
T18A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_roigbvtolg.exe

Path C:\Temp\i_roigbvtolg.exe
Size 361KB
SHA256 c43ea4a288ea86a903a11be4a097488409b2de7339744c152548b323e9819b03
MD5 de8721c97da18e58bbebc2adb0c53cdf
SHA1 ed8bbfd4ccfdf68b890fab39407f495606b8b92e
SHA512 8162b708dfff53895ebae7895ecc2fbb5cc54cef9fc606e30ae023cb815a67c7aca09e8df1bb2e51d8347e0e7a3ed008c1e2a31f30820ad41150fb2be1fcc75a
SSDEEP 6144:cflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:cflfAsiVGjSGecvX
TLSH
T176747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztrjhbzumj.exe

Path C:\Temp\i_ztrjhbzumj.exe
Size 361KB
SHA256 14c70707c1af4a0e09ca9566fc44226bcbd1f12a1d18258135d7e97b6bb3682f
MD5 418a8ba465a20a8575bc2995d8c82fcb
SHA1 f90c3f819a45b93265d1aeb4f0aaf9baf0c109f9
SHA512 7b24bb4d21bb91452349ed1920608f665110612ea052e26a28412b150e0eb898d530ba3b3d12998cdb54ba58a4fb727fe26d10ec93ecb00c382a919a7d89d773
SSDEEP 6144:0flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:0flfAsiVGjSGecvX
TLSH
T164747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igdywqoiga.exe

Path C:\Temp\igdywqoiga.exe
Size 361KB
SHA256 9b19a73da42e4092107bece57df875bd2baee5927425c57ba0c59e0229e9dffa
MD5 deaa64b7b67748458aef03fe7e894922
SHA1 a4543da9b11c4f5feac77b78a2b41847d1e8f015
SHA512 d28f1f8dd674f71fdf5f3b1edcc1adb29ce6afc43e55f18114b82d6377a2ac5733384edb8cd5a37a993b062ed7de5fde1ab3102f5fc075484a1c1357779a17b8
SSDEEP 6144:QflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:QflfAsiVGjSGecvX
TLSH
T1C1747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

roigbvtolg.exe

Path C:\Temp\roigbvtolg.exe
Size 361KB
SHA256 5eb0c119cecb31bffe60589d179b6f4bfb55802652b9d6f2ce6f81a3eb927266
MD5 d0027f76eaafd52a6aca3bc4cbf8674a
SHA1 4ec43b7b8187b205f1258b23dac265cf07d8bca6
SHA512 e088b8bf714707c5b38328af23acfd00e7296688869aba5fc451543bdb91a86dca9e0b639329f4272d2ce35e8c8262907ea9cabe94b1d6fc0ab33f01e6e99d22
SSDEEP 6144:YflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:YflfAsiVGjSGecvX
TLSH
T1E1747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqnhfaxsqk.exe

Path C:\Temp\sqnhfaxsqk.exe
Size 361KB
SHA256 6b9b1c80c2040f7b1e57bdaf5c7eff680ac060ba148abcd9b8ce466bee348973
MD5 db979d7e191dc660596361b4c40558ac
SHA1 bee125bdd52133ad31afba833955f2a87194e724
SHA512 12f848680c0b83f65d4b34fe91f08bbfebdd7cb82681f6fc5f51632134a3f49fa0eaf175d7e4bcaad6a1a4a6837d4d9851bc1563759707c17dfcae0c1d911a7f
SSDEEP 6144:uflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:uflfAsiVGjSGecvX
TLSH
T12A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgebwuom.sys

Path C:\Temp\uomgebwuom.sys
Size 293KB
SHA256 8366370de1eb0a4cf0d5c085ce758e689eb8ad395a2ac6f0e83a62627116b9df
MD5 fbbc82385f1b3db38e8a34847d820f68
SHA1 f0db835e5d2d3bfac789ea1cb26a9d9356bee1b6
SHA512 a06a2d32f7293f1fed8e3e3af328a7edea7b214b0fa84c20cc331dffcd9ca598a551df053a5bb0a40bd718960bea82b31003b50eb143b678b9c19f8bf5d3d933
SSDEEP 3072:JtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:JIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgezwrpjhbztr.exe

Path C:\Temp\wuomgezwrpjhbztr.exe
Size 361KB
SHA256 8cb8e67412ec39a47959febbcc6f0ea743f2e06200b4740a92a715114022c839
MD5 42b48b8d9ab386b5b8b57011ea69a19e
SHA1 2dfd0a99219e46c30ffc5527cd79ea3b2608fbbd
SHA512 1ea3518bcb68146d7f7d2c2796489cf5927bc3f4a430787e5fe913e9800ca2ca81e5a72cc12479e623486d3125ec745de3d2b8d01f8cd193afd958b3e4b89fb6
SSDEEP 6144:oflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:oflfAsiVGjSGecvX
TLSH
T1E7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgezwrpjhbztr.sys

Path C:\Temp\wuomgezwrpjhbztr.sys
Size 293KB
SHA256 fb3b016dbcb77ea58bd7f76e1eaf5da2f4312fcf0646634545cdc78337cafed8
MD5 90b73c9f525e26b9f0850f3aeae41c65
SHA1 4ea9a0df658d77660bd8c5405cb1ae4f5c676992
SHA512 2ff347048ee918e05f858dd1e7960744e32ba60cb638465a7dab37ada49ba2c586e1c171d6ea8f7493030255ec7c1ee2712be1f022a62880879538c8921797a4
SSDEEP 3072:2tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:2IJjiJcbI03GBc3ucY5DCSj
TLSH
T13B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrjhbzumj.exe

Path C:\Temp\ztrjhbzumj.exe
Size 361KB
SHA256 447686707c91dc6df468f0d6002eb9fb99016f8587db311b580f7eab4efc0e73
MD5 b64baea85968adc46b16ca0e03b91d95
SHA1 6e59d05e76658756b960203a2a514c7ba41b00db
SHA512 ac47421827ef9e4d9bcdf7132fcfbceae549edc94fe9498d98b2104f90e3e242e862fbb0f6e5dcd19430f0ebf48f4aee0bacf74b16050ef3104e4c26a057c8b8
SSDEEP 6144:YflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:YflfAsiVGjSGecvX
TLSH
T1C9747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 aea9dc9e36fdbd031633fad41c8e2a46bc2b9b12a1ed8c54aa42615da5ddcfbc
MD5 fca4c31980c2e4da4ddd0722189610f6
SHA1 1c522e78a5a0d1999f9f72967e69a59810ffa653
SHA512 6c245a62d2377f537b144f0ff98ad29d173b42506c550b55080d19eecdb713ed2e6ae23f1c88fc5211106698b4e054c37885c3206c9995567c5d9e2d3f2cfaca
TLSH
T1335164A0072B26E1D7F184B271F9A6A9B3F4829901071E29E8427DB47A01FDCD1D162B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59834f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59834f.TMP
Size 2KB
SHA256 bdbfc527a98b98ecbaec8da7c8fb53b3f72ad00c6e36b3364d54538c047ca06b
MD5 12572b130230643d7fef5ce43bb1a6d5
SHA1 ecce895d7a76d5850e3e7afd27d29b2627b8c4fa
SHA512 9b5b7376c17844ea1d948522c8b4950dd5b0700bbc8d7633afb7b739995ce3eab58e3b9ad8fd17f6c4e047511ed344c3fdcb13066d80432c589489efdb7e69f1
TLSH
T1025164A0072F26F1D7F584B271F5B6A9B7F4829901071E29E8027DB47A01FDCD1D162B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7548a539129b16339e89ed7e15f7be491c2cd0912ed59b88dc939b0034e9a1a5
MD5 bd40bb1c801dc5a24fb6a7ad89479171
SHA1 6d5ee19b7c44ba004f4332bc4d3d9cd10e4332b2
SHA512 4be9b6a53cc8d8486a9927041c9596a17b0534425074f593f76e3eb2cd9a8942ba645fe5b1e2ed45c35d5a9356e0efdc27d67681fe5544162c0d93b231d52986
TLSH
T16251CFF3C3E8866ECA1155F0AB147E2BCE1D0914432C3D5A89E4EE5BA7E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9575baa535794fd873877241e4253e6ed81c49446f41820565791006f3dfacb6
MD5 617b6740e224ed76dba3acfb4a9ef649
SHA1 bae192660aa0e5762267b8aa8e329d67b5d8cc43
SHA512 4bdcff4f5979aadf30cedde0bb1ab187d85ddbe43eb9cc742932f3b5a4bddec5d5ee2082b99557c252c3a958aa14dbc024fd8775231b683b3af6e5516108d829
SSDEEP 192:sxRGRSyM/jK1Ml8wCt/fssYOqz8bZaEW4PzoA8pi/g6+WNIYEAiKRG/IgtJ:sxRGY8t/fssz68VaErmi/5IN73
TLSH
T1D552CA15AA34597B8CCBD20DFA557F93D6F81573A2905E449AFCCB1C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1097f107ab644fdc80edb76368993dde2734be3ea50ea45b90ea4c67bf5ada67
MD5 a40af98b4cf322429b6d78d34210f827
SHA1 20c478b803263f09fe4a6b623424d176fdb45ea5
SHA512 6e195eca9ca9f590058d08780b0b7a8ec9ded6d2275789e93d08aaa9a8a4fcef88e9d602875db325400e7924571280bfe9274e02b65e07a1d2fff778f273218c
SSDEEP 192:sxRNRSyM/jK1Ml8UQRCt/fsshOq08bZaEW4rzoA8prH/g6+WNCzZ/YEziKRG/Igj:sxRN4qIt/fssUh8VaErK7/5c/K7j
TLSH
T1DC62C855AA34597B9CD7D209FA517F93E2F8157292905E48AAFCCB0C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 36d9de5bdd3c771d76865429e0fb71631545964b5758df2cf33dd1934f0a8bc5
MD5 7a8d56ee3aec7923563fcdf0880dd3c8
SHA1 e972cd23b7901d415fc673e18c1476efd47c0f93
SHA512 f880597c0fe5e89f4b2eac2b037319913411d6804751c4f96388080df79602d6f5ab2c5706a314520956d95172160917ccd9bd2ab7ed130d7e575bb41b41c761
SSDEEP 768:0hiivW7pLuL7jaWgH7f3Q8F1+UoAYDCx9Tuqh0VfUC9xbog/OV71eOV8droJ6L:0hiiv2E7jaWgH7f3Qu1jao1eI8W8
TLSH
T1A1E2EC3B680CCB7E4F404ADCEC29BD9A6DE801CB96D88D9447EA844C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c1d98fa7-468c-4a82-a899-54c5969cd030.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c1d98fa7-468c-4a82-a899-54c5969cd030.tmp
Size 14KB
SHA256 14fba171905e58db9f6d2d51752030ca4b1dcd712eeeec4c73f83fafc4a85d37
MD5 cbf5af89e907189278c49922b444a6f8
SHA1 d8052236218f9c97ec0cad52d446fc4b8276948c
SHA512 c0513759206389f74371c50ee98654f5ba2fdefa09f0f8ab4a3aa6f04873f1140a9bce0001ccb8b8e1e8f6f77ed1f538a45da9329df10e13266d0118d263aa9c
SSDEEP 192:sxRNRSyM/jK1Ml8wCt/fsshOqz8bZaEW4rzoA8p9H/g6+WNCzZ/YE1iKRG/IgD3J:sxRN48t/fssU68VaErKx/5c/E7l
TLSH
T19162CA15AA345D7B9CD7D209FA517F93D6F81572E2905E48AAFCCB0C00E6AED211381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a2099.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a2099.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a6431338532050c94936f77bc7b944760141ddcab59b2d3977aa7e8eb0de3f3d
MD5 11b10b12a9de3019839586ec4138169f
SHA1 17bde9cc84b1b71348eb9341f8fe1ac5835b619b
SHA512 dee6e0de106eff244c1d300bfda2c973a84d983c6c06c79b1d6a8156e09c4b412bea0dfcce675430f00695d252119c98a8c04847335c4ede5f886e7486d2fa02
SSDEEP 768:Qrv+4UNbdf34qGUVDlmK48dHeByERRFzjK3YLeVH1SCj:QbsbJ3JGG148dHSyw/5EH1Z
TLSH
T1C403BE71A8A85E734CE792897643B657BFF4411382C45BA4C5DDAF4E828B4DC130BE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d10a92ce605373be4fd077ed46d60717989069c771179d59eacad32d9e3ddd0a
MD5 7c74d53532fd4997f682b09c22f7cf81
SHA1 902bff375cfef87b52f0413be1a0da71dc5653bd
SHA512 86b818017f1bd2e8f70f370b31eb6dbfd147a33e73f18e336f0a8b49cecdd6b3d28ea6eca5a91f21472f5a42b10e61d4368d5bce2b4bb72c8888eaf5577ee927
SSDEEP 768:bj+9v3+qGsMDlLtCK48dHeByERRFzjK3YmMjP:O9v3HGbr48dHSyw/wI
TLSH
T161F2AEB168659DA34CEBD24976537B96EFF0016385C05F98CAD9AF0E44C25EC0B0BD2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 4fb2170f72ae0792036265f8404ac1f5d2e063e63795ac9db444ebeff713cd3c
MD5 24a3915b21b58cbff8449591474ba6e9
SHA1 0e6d1a525f970d73cd6f809d437391930c2d4df4
SHA512 524fb1587cccbeb43c84fcf7e9b30b009b098309fb5cec853c4b8d0c6f45999d327d8bf2bc021ceceddfc300505e5656357e563005c3c1012c724ba21c881758
SSDEEP 768:+j+9v3+qGsMDlLtCK48dHeByERRFzjK3YmMjP:99v3HGbr48dHSyw/wI
TLSH
T165F2AEB168659DA74CEBD24976437B96EFF0016385C05F98CAD9AF0E44C25EC0B0BD2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 95df3d9b276d53490e3dafc19e17645ff72efead774f7c6e4bd572b5827a19b6
MD5 56c63c5478536d388ab9cd83c6aabb5a
SHA1 2e33dca4ac81e823901d2e2a62578f19e49ea60a
SHA512 34943be55d9322879387d6ca0c9bd1f1a7e7c068d49dffce4fff17b4e1b01cf65e69bf9b627e92acb0ea9ce627ac20658a3f573c23c38be0347f450ce9d2f543
SSDEEP 768:vj+9v3tqGwMDlLt/K48dHeByERRFzjK3YmMjP:C9v34GvS48dHSyw/wI
TLSH
T1A0F2AEB168659DA34CEBD24976537B96EFF0016385C05F98CAD9AF0E44C25EC070BD2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 883dca6d5382de30fdf38465aa0429afc5acefb442c77aa289554d57819944b3
MD5 5d23e1c731510adba77563621c1f8150
SHA1 2589b4407a61af5924fd657981206f076efcc398
SHA512 de91d5eef765e5620c55b18c01baba84592c47af147341f9fce254887a5f58b5882fc1c361fde816d113b587a07cc090b2c56c6250e0fdcf0897027936149fb0
SSDEEP 768:rFKj+9b3jwgJqGHgfLtGK48dHeByERRFzjK3YmMjP:L9b3qG048dHSyw/wI
TLSH
T1891339F198D38A76D8AE8387673E6E469AFCC163B4849994F7C85D0DCC821BFC706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

127b0f26-bc21-409d-b692-f078f6c7643b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\127b0f26-bc21-409d-b692-f078f6c7643b.tmp
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

2fe34f77-ddeb-4e99-a063-f6f42b030c9e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2fe34f77-ddeb-4e99-a063-f6f42b030c9e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2448_137846118\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 702d4aa2aef8560d8bbaaf0c9824c75f7e8017254040e42bd40c9f731f692a81
MD5 a1ff9027135c993aa0db48fb0b8538c2
SHA1 bee6e39e79a43f7768606cc1426a32a0f4c4b549
SHA512 556f93d320f0b983bc83a2ad670478df9ea417535c6afcc3276d865e8be40b88758b5d3843062aa059cb3f1236a595c34c442821aff0714c2bad8b1014842c66
TLSH
T13671274357B9C5F3C1DA5BF402835148F5FB2238472370300B55558AAB30A7D6479F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/604-455-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1272-340-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1844-232-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1964-193-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2108-303-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2416-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2748-381-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2748-400-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2900-369-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3400-403-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3408-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3664-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3780-344-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4240-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4792-432-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4928-436-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5256-475-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5708-268-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5720-423-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5984-427-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6112-394-0x0000000000010000-0x00000000000AB000-memory.dmp

Download