systex | 0f0464b92b8a7d9d50454b52f191600b046738e08a4ea874c0226888d9bf58a9

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 14:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260802-rrm15svdlb
SHA256 0f0464b92b8a7d9d50454b52f191600b046738e08a4ea874c0226888d9bf58a9
MD5 5a1b11efb0c34a70d6e0d4db16e83b37
SHA1 e0119a18ce5e11159fe35fd3ad0c809a029cd8f1
SHA512 7a57adfe38dfabdbd6a8a6da79b7b0ce0de5f34efe983679d28d5d0ecf13b21a7fb465fe492de46926ba2ea296165d8211cda5542fb83950f1b4771bb35ccf8c
SSDEEP 6144:TflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:TflfAsiVGjSGecvX
TLSH
T1C2747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2480	xspkhcaxvpnkfcau.exe
5704	xspkhcaxvpnkfcau.sys
2708	CreateProcess.exe
4112	faxspkhcau.exe
5424	CreateProcess.exe
2556	CreateProcess.exe
5872	i_faxspkhcau.exe
4820	wupmhfzxrp.sys
4900	CreateProcess.exe
2332	mhfzxupjhc.exe
1588	CreateProcess.exe
4596	CreateProcess.exe
1756	i_mhfzxupjhc.exe
5884	ecwuomjebz.sys
4372	CreateProcess.exe
5904	wuomgezxrp.exe
4472	CreateProcess.exe
5900	CreateProcess.exe
3756	i_wuomgezxrp.exe
2400	zwrojhbztr.sys
3284	CreateProcess.exe
2580	tojgbztrlg.exe
5780	CreateProcess.exe
3520	CreateProcess.exe
548	i_tojgbztrlg.exe
5916	rljdbztolg.sys
4436	CreateProcess.exe
5400	bvtnlgdyvq.exe
5808	CreateProcess.exe
5580	CreateProcess.exe
4764	i_bvtnlgdyvq.exe
2756	olgeywqoig.sys
5820	CreateProcess.exe
5964	gaytqojgbn.exe
6124	CreateProcess.exe
5568	CreateProcess.exe
3496	i_gaytqojgbn.exe
1512	avsqlidbvt.sys
4948	CreateProcess.exe
4156	qnigayvqki.exe
4480	CreateProcess.exe
2752	CreateProcess.exe
2468	i_qnigayvqki.exe
2900	pnlfdxvpnk.sys
4320	CreateProcess.exe
716	fdxvpnifax.exe
5640	CreateProcess.exe
3924	CreateProcess.exe
5448	i_fdxvpnifax.exe
5668	ausmkfcxvs.sys
1736	CreateProcess.exe
4712	spkhfzxusn.exe
2184	CreateProcess.exe
5436	CreateProcess.exe
2596	i_spkhfzxusn.exe
4324	ecxupmkecw.sys
5048	CreateProcess.exe
5144	pjhczurmke.exe
5608	CreateProcess.exe
5168	CreateProcess.exe
3572	i_pjhczurmke.exe
4404	bzurmkhbzx.sys
4184	CreateProcess.exe
756	uomgezwupj.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2516_643665560\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxspkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlgdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlgdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnigayvqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkhfzxusn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgebwuojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhfzxupjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaytqojgbn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkhfzxusn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicaxsqkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhfzxupjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tojgbztrlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tojgbztrlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgezwupj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kezwusmhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kezwusmhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxspkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgebwuojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idavsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idavsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkhcaxvpnkfcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaytqojgbn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnigayvqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgezwupj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicaxsqkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbztrpje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtrljd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4280	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4404	ipconfig.exe
1220	ipconfig.exe
1984	ipconfig.exe
3780	ipconfig.exe
2648	ipconfig.exe
2700	ipconfig.exe
5384	ipconfig.exe
2292	ipconfig.exe
1260	ipconfig.exe
1228	ipconfig.exe
5148	ipconfig.exe
5892	ipconfig.exe
1240	ipconfig.exe
2620	ipconfig.exe
5608	ipconfig.exe
3388	ipconfig.exe
2040	ipconfig.exe
1224	ipconfig.exe
3596	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301543572377114"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{EC4FB3D1-27F2-408F-89A6-74E634F01C42}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2480	xspkhcaxvpnkfcau.exe
2480	xspkhcaxvpnkfcau.exe
2480	xspkhcaxvpnkfcau.exe
2480	xspkhcaxvpnkfcau.exe
2480	xspkhcaxvpnkfcau.exe
2480	xspkhcaxvpnkfcau.exe
2480	xspkhcaxvpnkfcau.exe
2480	xspkhcaxvpnkfcau.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	5872	i_faxspkhcau.exe
Token: SeDebugPrivilege	1756	i_mhfzxupjhc.exe
Token: SeDebugPrivilege	3756	i_wuomgezxrp.exe
Token: SeDebugPrivilege	548	i_tojgbztrlg.exe
Token: SeDebugPrivilege	4764	i_bvtnlgdyvq.exe
Token: SeDebugPrivilege	3496	i_gaytqojgbn.exe
Token: SeDebugPrivilege	2468	i_qnigayvqki.exe
Token: SeDebugPrivilege	5448	i_fdxvpnifax.exe
Token: SeDebugPrivilege	2596	i_spkhfzxusn.exe
Token: SeDebugPrivilege	3572	i_pjhczurmke.exe
Token: SeDebugPrivilege	4208	i_uomgezwupj.exe
Token: SeDebugPrivilege	5320	i_omgebwuojh.exe
Token: SeDebugPrivilege	5404	i_ljdbvtrljd.exe
Token: SeDebugPrivilege	2028	i_gdywqoigay.exe
Token: SeDebugPrivilege	5612	i_idavsqkica.exe
Token: SeDebugPrivilege	3272	i_kicaxsqkfd.exe
Token: SeDebugPrivilege	4464	i_kfcxupnhfz.exe
Token: SeDebugPrivilege	3004	i_kezwusmhez.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2516	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 2480	1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 1584 wrote to memory of 3508	1584	2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 3508 wrote to memory of 2516	3508	iexplore.exe	90
PID 2516 wrote to memory of 2536	2516	msedge.exe	91
PID 2516 wrote to memory of 2464	2516	msedge.exe	92
PID 2516 wrote to memory of 4280	2516	msedge.exe	93
PID 2516 wrote to memory of 2464	2516	msedge.exe	92
PID 2516 wrote to memory of 2464	2516	msedge.exe	92
PID 2516 wrote to memory of 4800	2516	msedge.exe	94
PID 2516 wrote to memory of 4800	2516	msedge.exe	94
PID 2516 wrote to memory of 2076	2516	msedge.exe	96
PID 2516 wrote to memory of 5416	2516	msedge.exe	97
PID 2516 wrote to memory of 2076	2516	msedge.exe	96
PID 2516 wrote to memory of 2076	2516	msedge.exe	96
PID 2516 wrote to memory of 5416	2516	msedge.exe	97
PID 2516 wrote to memory of 5416	2516	msedge.exe	97
PID 2516 wrote to memory of 5660	2516	msedge.exe	98
PID 2516 wrote to memory of 5660	2516	msedge.exe	98
PID 2516 wrote to memory of 5660	2516	msedge.exe	98
PID 2516 wrote to memory of 1820	2516	msedge.exe	99
PID 2516 wrote to memory of 1820	2516	msedge.exe	99
PID 2516 wrote to memory of 1820	2516	msedge.exe	99
PID 2516 wrote to memory of 576	2516	msedge.exe	100
PID 2516 wrote to memory of 576	2516	msedge.exe	100
PID 2480 wrote to memory of 2708	2480	xspkhcaxvpnkfcau.exe	104
PID 4112 wrote to memory of 5424	4112	faxspkhcau.exe	107
PID 2516 wrote to memory of 1908	2516	msedge.exe	110
PID 2516 wrote to memory of 3028	2516	msedge.exe	111
PID 2516 wrote to memory of 1908	2516	msedge.exe	110
PID 2516 wrote to memory of 3028	2516	msedge.exe	111
PID 2480 wrote to memory of 2556	2480	xspkhcaxvpnkfcau.exe	112
PID 2516 wrote to memory of 4796	2516	msedge.exe	115
PID 2516 wrote to memory of 5992	2516	msedge.exe	116
PID 2516 wrote to memory of 5992	2516	msedge.exe	116
PID 2480 wrote to memory of 4900	2480	xspkhcaxvpnkfcau.exe	122
PID 2332 wrote to memory of 1588	2332	mhfzxupjhc.exe	124
PID 2480 wrote to memory of 4596	2480	xspkhcaxvpnkfcau.exe	127
PID 2480 wrote to memory of 4372	2480	xspkhcaxvpnkfcau.exe	131
PID 5904 wrote to memory of 4472	5904	wuomgezxrp.exe	133
PID 2480 wrote to memory of 5900	2480	xspkhcaxvpnkfcau.exe	136
PID 2480 wrote to memory of 3284	2480	xspkhcaxvpnkfcau.exe	141
PID 2580 wrote to memory of 5780	2580	tojgbztrlg.exe	143
PID 2480 wrote to memory of 3520	2480	xspkhcaxvpnkfcau.exe	146
PID 2516 wrote to memory of 2784	2516	msedge.exe	148
PID 2516 wrote to memory of 4964	2516	msedge.exe	149
PID 2516 wrote to memory of 1236	2516	msedge.exe	150
PID 2480 wrote to memory of 4436	2480	xspkhcaxvpnkfcau.exe	153
PID 5400 wrote to memory of 5808	5400	bvtnlgdyvq.exe	155
PID 2480 wrote to memory of 5580	2480	xspkhcaxvpnkfcau.exe	158
PID 2480 wrote to memory of 5820	2480	xspkhcaxvpnkfcau.exe	162
PID 5964 wrote to memory of 6124	5964	gaytqojgbn.exe	164
PID 2480 wrote to memory of 5568	2480	xspkhcaxvpnkfcau.exe	167
PID 2480 wrote to memory of 4948	2480	xspkhcaxvpnkfcau.exe	171
PID 4156 wrote to memory of 4480	4156	qnigayvqki.exe	173
PID 2480 wrote to memory of 2752	2480	xspkhcaxvpnkfcau.exe	176
PID 2480 wrote to memory of 4320	2480	xspkhcaxvpnkfcau.exe	180
PID 716 wrote to memory of 5640	716	fdxvpnifax.exe	182
PID 2516 wrote to memory of 5516	2516	msedge.exe	185
PID 2516 wrote to memory of 5516	2516	msedge.exe	185
PID 2480 wrote to memory of 3924	2480	xspkhcaxvpnkfcau.exe	188
PID 2480 wrote to memory of 1736	2480	xspkhcaxvpnkfcau.exe	192
PID 4712 wrote to memory of 2184	4712	spkhfzxusn.exe	194
PID 2480 wrote to memory of 5436	2480	xspkhcaxvpnkfcau.exe	197
PID 2516 wrote to memory of 1092	2516	msedge.exe	201

C:\Users\Admin\AppData\Local\Temp\2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_5a1b11efb0c34a70d6e0d4db16e83b37_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Temp\xspkhcaxvpnkfcau.exe
  C:\Temp\xspkhcaxvpnkfcau.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faxspkhcau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2708
  - - C:\Temp\faxspkhcau.exe
      C:\Temp\faxspkhcau.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4112
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5424
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faxspkhcau.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2556
  - - C:\Temp\i_faxspkhcau.exe
      C:\Temp\i_faxspkhcau.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhfzxupjhc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4900
  - - C:\Temp\mhfzxupjhc.exe
      C:\Temp\mhfzxupjhc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2332
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1588
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3388
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhfzxupjhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4596
  - - C:\Temp\i_mhfzxupjhc.exe
      C:\Temp\i_mhfzxupjhc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomgezxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4372
  - - C:\Temp\wuomgezxrp.exe
      C:\Temp\wuomgezxrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5904
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4472
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomgezxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5900
  - - C:\Temp\i_wuomgezxrp.exe
      C:\Temp\i_wuomgezxrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tojgbztrlg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3284
  - - C:\Temp\tojgbztrlg.exe
      C:\Temp\tojgbztrlg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2580
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5780
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tojgbztrlg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3520
  - - C:\Temp\i_tojgbztrlg.exe
      C:\Temp\i_tojgbztrlg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtnlgdyvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4436
  - - C:\Temp\bvtnlgdyvq.exe
      C:\Temp\bvtnlgdyvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5400
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5808
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtnlgdyvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5580
  - - C:\Temp\i_bvtnlgdyvq.exe
      C:\Temp\i_bvtnlgdyvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaytqojgbn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5820
  - - C:\Temp\gaytqojgbn.exe
      C:\Temp\gaytqojgbn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5964
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaytqojgbn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5568
  - - C:\Temp\i_gaytqojgbn.exe
      C:\Temp\i_gaytqojgbn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnigayvqki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4948
  - - C:\Temp\qnigayvqki.exe
      C:\Temp\qnigayvqki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4156
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4480
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnigayvqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2752
  - - C:\Temp\i_qnigayvqki.exe
      C:\Temp\i_qnigayvqki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvpnifax.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4320
  - - C:\Temp\fdxvpnifax.exe
      C:\Temp\fdxvpnifax.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:716
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5640
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxvpnifax.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3924
  - - C:\Temp\i_fdxvpnifax.exe
      C:\Temp\i_fdxvpnifax.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkhfzxusn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1736
  - - C:\Temp\spkhfzxusn.exe
      C:\Temp\spkhfzxusn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4712
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2184
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkhfzxusn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5436
  - - C:\Temp\i_spkhfzxusn.exe
      C:\Temp\i_spkhfzxusn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2596
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhczurmke.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5048
  - - C:\Temp\pjhczurmke.exe
      C:\Temp\pjhczurmke.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5144
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5608
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhczurmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5168
  - - C:\Temp\i_pjhczurmke.exe
      C:\Temp\i_pjhczurmke.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomgezwupj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4184
  - - C:\Temp\uomgezwupj.exe
      C:\Temp\uomgezwupj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:756
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4276
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomgezwupj.exe ups_ins
    3⤵
    PID:2668
  - - C:\Temp\i_uomgezwupj.exe
      C:\Temp\i_uomgezwupj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgebwuojh.exe ups_run
    3⤵
    PID:2816
  - - C:\Temp\omgebwuojh.exe
      C:\Temp\omgebwuojh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4160
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1572
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3596
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgebwuojh.exe ups_ins
    3⤵
    PID:4236
  - - C:\Temp\i_omgebwuojh.exe
      C:\Temp\i_omgebwuojh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbvtrljd.exe ups_run
    3⤵
    PID:6076
  - - C:\Temp\ljdbvtrljd.exe
      C:\Temp\ljdbvtrljd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5308
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4576
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbvtrljd.exe ups_ins
    3⤵
    PID:1476
  - - C:\Temp\i_ljdbvtrljd.exe
      C:\Temp\i_ljdbvtrljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdywqoigay.exe ups_run
    3⤵
    PID:5288
  - - C:\Temp\gdywqoigay.exe
      C:\Temp\gdywqoigay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2280
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2820
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdywqoigay.exe ups_ins
    3⤵
    PID:8
  - - C:\Temp\i_gdywqoigay.exe
      C:\Temp\i_gdywqoigay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idavsqkica.exe ups_run
    3⤵
    PID:3152
  - - C:\Temp\idavsqkica.exe
      C:\Temp\idavsqkica.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2992
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5204
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_idavsqkica.exe ups_ins
    3⤵
    PID:4416
  - - C:\Temp\i_idavsqkica.exe
      C:\Temp\i_idavsqkica.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicaxsqkfd.exe ups_run
    3⤵
    PID:1692
  - - C:\Temp\kicaxsqkfd.exe
      C:\Temp\kicaxsqkfd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2064
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4288
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1224
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kicaxsqkfd.exe ups_ins
    3⤵
    PID:3576
  - - C:\Temp\i_kicaxsqkfd.exe
      C:\Temp\i_kicaxsqkfd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kfcxupnhfz.exe ups_run
    3⤵
    PID:800
  - - C:\Temp\kfcxupnhfz.exe
      C:\Temp\kfcxupnhfz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4868
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5844
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kfcxupnhfz.exe ups_ins
    3⤵
    PID:672
  - - C:\Temp\i_kfcxupnhfz.exe
      C:\Temp\i_kfcxupnhfz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kezwusmhez.exe ups_run
    3⤵
    PID:1308
  - - C:\Temp\kezwusmhez.exe
      C:\Temp\kezwusmhez.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5084
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kezwusmhez.exe ups_ins
    3⤵
    PID:5884
  - - C:\Temp\i_kezwusmhez.exe
      C:\Temp\i_kezwusmhez.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhbztrpje.exe ups_run
    3⤵
    PID:2092
  - - C:\Temp\pjhbztrpje.exe
      C:\Temp\pjhbztrpje.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1328
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6060
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1240
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffc12a0c188,0x7ffc12a0c194,0x7ffc12a0c1a0
      4⤵
      PID:2536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,14532321877015830249,18252782952084266267,262144 --field-trial-handle=2192,i,1542846533962537945,6906322186007395724,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
      4⤵
      PID:2464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,430332045796178843,2275885324353004011,524288 --field-trial-handle=2192,i,1542846533962537945,6906322186007395724,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
      4⤵
      System Time Discovery
      PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,936476241422386404,9113005705088271285,524288 --field-trial-handle=2192,i,1542846533962537945,6906322186007395724,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:13
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,227950011380240010,12201816104849423227,2097152 --field-trial-handle=2192,i,1542846533962537945,6906322186007395724,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:2076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,16020260359945398460,7971124786194885062,2097152 --field-trial-handle=2192,i,1542846533962537945,6906322186007395724,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:5416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,3375532035477853088,7680437320308359272,2097152 --field-trial-handle=2192,i,1542846533962537945,6906322186007395724,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:1
      4⤵
      PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,8919904699633183258,8007245095837224508,2097152 --field-trial-handle=2192,i,1542846533962537945,6906322186007395724,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:9
      4⤵
      PID:1820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,14563317409729078943,5071713027778957768,524288 --field-trial-handle=2192,i,1542846533962537945,6906322186007395724,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
      4⤵
      PID:576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,7022593666816134994,13323848266326710986,524288 --field-trial-handle=2192,i,1542846533962537945,6906322186007395724,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
      4⤵
      PID:1908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,17325494989884489538,11585067558290513472,524288 --field-trial-handle=2192,i,1542846533962537945,6906322186007395724,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
      4⤵
      PID:3028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,8165652881931923565,4971376815710665822,524288 --field-trial-handle=2192,i,1542846533962537945,6906322186007395724,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
      4⤵
      PID:2656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,8165652881931923565,4971376815710665822,524288 --field-trial-handle=2192,i,1542846533962537945,6906322186007395724,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
      4⤵
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,306348509045098824,15703354606347566258,524288 --field-trial-handle=2192,i,1542846533962537945,6906322186007395724,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
      4⤵
      PID:5992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,11053381547216871146,7368141271919807311,524288 --field-trial-handle=2192,i,1542846533962537945,6906322186007395724,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
      4⤵
      PID:2784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,2523391453453135075,14312420572375540653,524288 --field-trial-handle=2192,i,1542846533962537945,6906322186007395724,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:14
      4⤵
      PID:4964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,3329433569619623482,15559715845922994987,524288 --field-trial-handle=2192,i,1542846533962537945,6906322186007395724,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:1236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6968,i,6992863002582380376,10317119047089876293,524288 --field-trial-handle=2192,i,1542846533962537945,6906322186007395724,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:14
      4⤵
      PID:5516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,18386379870290922415,17817357848096897172,524288 --field-trial-handle=2192,i,1542846533962537945,6906322186007395724,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
      4⤵
      PID:1092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7512,i,1578329425057696786,15090094050085686430,262144 --field-trial-handle=2192,i,1542846533962537945,6906322186007395724,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:10
      4⤵
      PID:4592

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5436

C:\Temp\xspkhcaxvpnkfcau.sys
C:\Temp\xspkhcaxvpnkfcau.sys
1⤵
- Executes dropped EXE
PID:5704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4840

C:\Temp\wupmhfzxrp.sys
C:\Temp\wupmhfzxrp.sys
1⤵
- Executes dropped EXE
PID:4820

C:\Temp\ecwuomjebz.sys
C:\Temp\ecwuomjebz.sys
1⤵
- Executes dropped EXE
PID:5884

C:\Temp\zwrojhbztr.sys
C:\Temp\zwrojhbztr.sys
1⤵
- Executes dropped EXE
PID:2400

C:\Temp\rljdbztolg.sys
C:\Temp\rljdbztolg.sys
1⤵
- Executes dropped EXE
PID:5916

C:\Temp\olgeywqoig.sys
C:\Temp\olgeywqoig.sys
1⤵
- Executes dropped EXE
PID:2756

C:\Temp\avsqlidbvt.sys
C:\Temp\avsqlidbvt.sys
1⤵
- Executes dropped EXE
PID:1512

C:\Temp\pnlfdxvpnk.sys
C:\Temp\pnlfdxvpnk.sys
1⤵
- Executes dropped EXE
PID:2900

C:\Temp\ausmkfcxvs.sys
C:\Temp\ausmkfcxvs.sys
1⤵
- Executes dropped EXE
PID:5668

C:\Temp\ecxupmkecw.sys
C:\Temp\ecxupmkecw.sys
1⤵
- Executes dropped EXE
PID:4324

C:\Temp\bzurmkhbzx.sys
C:\Temp\bzurmkhbzx.sys
1⤵
- Executes dropped EXE
PID:4404

C:\Temp\wromjebzur.sys
C:\Temp\wromjebzur.sys
1⤵
PID:4492

C:\Temp\wqoigbywqo.sys
C:\Temp\wqoigbywqo.sys
1⤵
PID:4868

C:\Temp\wqgaywqoig.sys
C:\Temp\wqgaywqoig.sys
1⤵
PID:2868

C:\Temp\ysqlidbvtn.sys
C:\Temp\ysqlidbvtn.sys
1⤵
PID:1240

C:\Temp\vpnifaysqk.sys
C:\Temp\vpnifaysqk.sys
1⤵
PID:1016

C:\Temp\smkifausmk.sys
C:\Temp\smkifausmk.sys
1⤵
PID:5320

C:\Temp\upmhfcwrpm.sys
C:\Temp\upmhfcwrpm.sys
1⤵
PID:2652

C:\Temp\ezxrpjhbzx.sys
C:\Temp\ezxrpjhbzx.sys
1⤵
PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avsqlidbvt.sys

Path C:\Temp\avsqlidbvt.sys
Size 293KB
SHA256 9fcf51d72fc935a3a87735263aaae3cc9df8a748f4aff3368055cd96c4092fd1
MD5 12d7875c43b518414a13153b6d9d33f1
SHA1 262d357020e3abeda38607e7d914cd4a30698a2f
SHA512 4afbd76ab49cbba2bedaecc34b6a2b7e42149400f72634eecb217404664c5679bd839362474ec1c57c3ec266a52535163d620acd408cf9c4cd6b53474afe4a42
SSDEEP 3072:otKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:oIJjiJcbI03GBc3ucY5DCSj
TLSH
T141545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtnlgdyvq.exe

Path C:\Temp\bvtnlgdyvq.exe
Size 361KB
SHA256 a813066aa87b718053459a51034e0954f08b715bbc5a50247beef497fb966c05
MD5 136b8ac8b5996dccd1a86eaf06033020
SHA1 76f3bfe844f57dbb8d538ca734bc72245ffd2128
SHA512 1fbdb67a7be5788fd1d35807ccffe0f59c505f9662e5c527fa27618562fbff92a68146de62595d28332ced1254aa07cac9372d38859811eed69a9ccf471874ed
SSDEEP 6144:yflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:yflfAsiVGjSGecvX
TLSH
T1CB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomjebz.sys

Path C:\Temp\ecwuomjebz.sys
Size 293KB
SHA256 5fa2e4a45ead2bd8063d239311d66aac7d5db671527712217f514b1044252d27
MD5 381845fb1fa2136c92b5520d47db96dd
SHA1 c058edc77b35aa0413d7a32ef97bc57ba03d2bc7
SHA512 5e3d0d5cadbf5be7860e784298fd3f87a89b8d47e10e2bff323cf3bde1cca6eee22379edce12d9e2a674eaba55d4d9324cc1de6c3f9a4ef57ebede8f84bc9ad1
SSDEEP 3072:stKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:sIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxspkhcau.exe

Path C:\Temp\faxspkhcau.exe
Size 361KB
SHA256 c2b26b8bb8c5c0d30557da08170df2198c22db1d20f39b972c9593ca0d581417
MD5 b0f7fe62ef17286b76b4f62241c0418f
SHA1 ae0a60d3fa78a683f04009e9b58ac4d9c2686c55
SHA512 b1a1f6454bf989668dbc156a132771816bd5ed1dbc788c92225a3c52c1ca789c930dd0d0c35fdafff0fa4c7675e9e3feba6d4d1a4203a0c439bcaee222448679
SSDEEP 6144:1flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:1flfAsiVGjSGecvX
TLSH
T1C7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaytqojgbn.exe

Path C:\Temp\gaytqojgbn.exe
Size 361KB
SHA256 5bb0ee26663da9a14b874491a4ccd91c77fab644c7645da58fb9e204e01b61e8
MD5 6f867e520586140f849c9fd3b588cb7c
SHA1 e209e04e9248e1a90a53a076fb77cfce158a97dd
SHA512 435e4695e9d7f48864bcf4de0a55cae7807d962ae6f027a9bb9b8254d6e272c6be4c5b2fa5d93374fcc09891ddb454fbde9ecabd15f39b6a5c598fbc03a5e046
SSDEEP 6144:pflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:pflfAsiVGjSGecvX
TLSH
T1E4747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtnlgdyvq.exe

Path C:\Temp\i_bvtnlgdyvq.exe
Size 361KB
SHA256 c64962c0d7359c562fc12f2a94578e30ec42c71ad02a0e91d0480f58b664c1cb
MD5 90b632a2d69cdab61fba2507ac01d671
SHA1 79136a2effd210fc86739ffb8e645d567b2f9237
SHA512 d9b00dd7913c70f292e6ab4a727b82f980f01ec7eb7a408e0595c388c5e9e480ec2c3d99523cfbf791d58600dc0e026464872999de6b41894b37dea46b54a2e7
SSDEEP 6144:OflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:OflfAsiVGjSGecvX
TLSH
T1C4747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_faxspkhcau.exe

Path C:\Temp\i_faxspkhcau.exe
Size 361KB
SHA256 0704c7545b3101de2091288d1de5ae74a441cdb1fdd46c86e1f7a6e8722c432d
MD5 c14ab6ce8c48b0dfe758adeef259d4c8
SHA1 a60220a64f84e9769845eaad439a58499ea69948
SHA512 eb7e973c84606681d5b9b0f5d8f72b47b77e0dfc1c60b3bb2c68114dc914a0b0d855c23df3fc70a574983cd87e5bbca19ce506c1e2e2b9406ba6cbaf616210a5
SSDEEP 6144:FflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:FflfAsiVGjSGecvX
TLSH
T1B3747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gaytqojgbn.exe

Path C:\Temp\i_gaytqojgbn.exe
Size 361KB
SHA256 a33e3a1f79e7a1edcda8ad0c1157f8dc8545a39d091690caeb70ecff5e3e41b7
MD5 73c7cbc8718fe85aad651518b4357266
SHA1 939d96d187976b84d541c3d10bd365db6e9153ad
SHA512 37feb78d2a0e64fece4fde50caa0935c06fc5da3ba81ddeb6c431be32cd8b3507580944cbdca4cebec3aa249ac893392698f4d0e00696d9dd253ae484cbe9cfd
SSDEEP 6144:FflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:FflfAsiVGjSGecvX
TLSH
T1BF747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mhfzxupjhc.exe

Path C:\Temp\i_mhfzxupjhc.exe
Size 361KB
SHA256 cb0a719ab772370a05e2e4a724bc574b0cbf31728674db08b0cfd0b24fc451f9
MD5 cd7b3651875dbf3d16fab58be3a03102
SHA1 23d03922689e608bd1a6238aae52dc78fc07d7ee
SHA512 7a562d34e2a8169153fe686a0178ea9befe30adce41bc93b2904ae36ff98ecf21aec9127d1f3daffa95ddd3dd619cd3ea159dc8e4671eeb5b30fe37e41c0b29c
SSDEEP 6144:TflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:TflfAsiVGjSGecvX
TLSH
T134747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnigayvqki.exe

Path C:\Temp\i_qnigayvqki.exe
Size 361KB
SHA256 db9549c80cdd17a880db105b4388b536e95eff599b8eef8db63dddb50d6d9ff6
MD5 37931ea24af8ba8761866919e65ad8dc
SHA1 929f6bdde992c6650977ef8c80f2951a1eb1e717
SHA512 a0e10e3474d0ff6bb9620ed0b4f7262a7bf1a15b8af6cb05446d16f94b835f61dd444b752a4011bd1b7ef9b076bf67a27de484f8625e87b7036f463a28818432
SSDEEP 6144:aflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:aflfAsiVGjSGecvX
TLSH
T178747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tojgbztrlg.exe

Path C:\Temp\i_tojgbztrlg.exe
Size 361KB
SHA256 f2d04901b706c249e6d8c4d1441396b28ded7052b7bf1bae1915e751f0728e6f
MD5 fee1fa156b2a5370278792403f8010e1
SHA1 8321efb1d7288236f84bfd774099503398fc331c
SHA512 072eddb1e717f1332267e289eb0c4474bd93084b81e91636cc2ab143c99262ce5b36a1867f9fb5623abf1a63b7dce736d90ada9c21f3090bd3e68939e1c8b8c1
SSDEEP 6144:QflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:QflfAsiVGjSGecvX
TLSH
T186747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wuomgezxrp.exe

Path C:\Temp\i_wuomgezxrp.exe
Size 361KB
SHA256 924fa8f695e5e0909d32f5baa88b91bb71d8741717a612c99ad806d2a60735a0
MD5 64f7539cff9153c79aa8a24e5f40ad39
SHA1 c1523687e918d834b896c1a10acad8dda9a8121b
SHA512 176e9215a3380be906d89ad835c928e984d1738ba60d6502118bb54308b500609ff0aea8bf704924a892ce35d409919dbb67221d8af5f193ce9b3d6172d9bfbe
SSDEEP 6144:EflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:EflfAsiVGjSGecvX
TLSH
T1C2747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhfzxupjhc.exe

Path C:\Temp\mhfzxupjhc.exe
Size 361KB
SHA256 52112e5ad9a70e44ff450c698ffaa950b7a50d722418e55fbcda2ec3508e666c
MD5 0bd3664f9bff8698761a1e2187ae2789
SHA1 f7901e6342439ca8a9fa5cefb4ca6554d2b4cc03
SHA512 da66372daed0c6834d82ebcba368b38d6f5f3dc6b6ef631535bd43a4bd1c6960a8f4909b13c9fc348437dd18b235223a939dffee6761e76e4dce6cb0e839d7dd
SSDEEP 6144:TflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:TflfAsiVGjSGecvX
TLSH
T1C0747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgeywqoig.sys

Path C:\Temp\olgeywqoig.sys
Size 293KB
SHA256 8fca2adcbeac48601fe4a60458d11646df07ad3d8887b84981eb95efd119f833
MD5 c18b0da4d02bd28d53ce4ff4752cc314
SHA1 4a99335ff4f74ed74ab58b7c17e5ede47dab99ba
SHA512 5b370179a3b8366aa54c6b377b3145e0ee0dc3178066f49d5f9061e3ab47b9333aab31269cd9f0b92541519680ae4f442b88722786ea6603c0294077d3f39de4
SSDEEP 3072:EtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:EIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnlfdxvpnk.sys

Path C:\Temp\pnlfdxvpnk.sys
Size 293KB
SHA256 5997f338a5afde9cfcbcef0259e920254a4589cd3957b1863fe6829eae6848a2
MD5 cb3cae20a7a7b85ccaf353208db94760
SHA1 ab48a19f75b078072dac4f860b5530d55d4621cd
SHA512 e0a4d725c7d3cd6c645c7d3928d75406461fc7920321103178d7497e53298ed281f55e58a5fb28e6aa7e7fd332cc300c59d48d46551beafec92d82139a072ec7
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnigayvqki.exe

Path C:\Temp\qnigayvqki.exe
Size 361KB
SHA256 93e70b3ea9a6f9b2e1e5de6e48510a991e72f6bf34dda0db3ec14ed16e4ba1c3
MD5 0671ab3f4eacb84f9567deb4a9fd4c3a
SHA1 fbb17c1d86beadca375a91972638d9b00dcf5eda
SHA512 95a73e9a502aa42e02a45901eb319e6fe5df3355965e94a184f6649dafa69f10840c05ed1b7656e1b3d2f73d5a2e5b254c0d08b0223c8f199ae552c4b8f50381
SSDEEP 6144:aflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:aflfAsiVGjSGecvX
TLSH
T16B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljdbztolg.sys

Path C:\Temp\rljdbztolg.sys
Size 293KB
SHA256 40e57aa4e7ae39b0089acd8b2a554326dd81f2e1b730d0acf723a5f5347b6e66
MD5 392f1c4a223e6c05849863e0d3e13019
SHA1 932ef9cf2f5007302430d632d9d56dab5b8ab8d3
SHA512 54b29646c26595c11fc81fd18e98b30fbab7c0291a2ca32ad45fc33e6902722687e127381144770c6f7005d4eee8152bb52a1c9cf7a3fc3344627eadc55566ba
SSDEEP 3072:jtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:jIJjiJcbI03GBc3ucY5DCSj
TLSH
T186545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tojgbztrlg.exe

Path C:\Temp\tojgbztrlg.exe
Size 361KB
SHA256 a778bea9ed162edbbfe22d912d76fa742c52647e7bd67e4b6ecd2b86ff43c1a3
MD5 543059305f31395fa832e78af359987e
SHA1 ad0e92a04a26d3e224cabf457b63c0f0e66864dd
SHA512 1df9a87395b29c20970441a6875d14b436f1d0b5d655a9e3489b9e398dc21e9fef5554ad895752ebdbe84491a4522ca57322b1472501fc9f5316edf0b1b2a6d9
SSDEEP 6144:fflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:fflfAsiVGjSGecvX
TLSH
T194747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgezxrp.exe

Path C:\Temp\wuomgezxrp.exe
Size 361KB
SHA256 1852eb3f2fe6915c52b6a5b6e914d40d818a9921de51ad1b5b3a64e45cfa2407
MD5 350ecd478d71865803c750b26ed67cc3
SHA1 2fa532a79e292deedc6fdccd9570aec2faf12bc9
SHA512 d83bf43e6e35713cb4b4fc75d1518ec99caf8b6572715674e348d5b7643edbec2b52d23a73662dea0eed95b35acf3fd0d26b2973cedb455efa34f0c12a58285c
SSDEEP 6144:RflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:RflfAsiVGjSGecvX
TLSH
T1DB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wupmhfzxrp.sys

Path C:\Temp\wupmhfzxrp.sys
Size 293KB
SHA256 b7aeee62e960ef6d03472c537ba39c2993c27a3f07e7ebb2febc4b580334acb3
MD5 c263c68e3a18b11c854e8ecb00a1c12c
SHA1 ed8ef2b6ea4aa1c0b34d01cd030587afa348450b
SHA512 92b648e2561838067bd8774a15d5606b1a90aff23299ed4109e2cd5d05cd0ff64326744305d2259fc627869f2b722608050d21db2360152fb868789c0a3280a4
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T103545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspkhcaxvpnkfcau.exe

Path C:\Temp\xspkhcaxvpnkfcau.exe
Size 361KB
SHA256 8f69cc7a6620fd91a11185e55ae7580025a676c7b928a1a8706b768562760761
MD5 ee90f2bdc31e7bdf8d3959704fce575e
SHA1 ba30ef881640901c221fa82003a50ed04e41a194
SHA512 54aa8fda32cda176c58ec3a6ddfd10071657db730a4963275413551ad672eeebc14a6a8466ec808c7b5f56eb78b9f44bda17689ecd88127a27a0ce7d4b52cdb6
SSDEEP 6144:iflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:iflfAsiVGjSGecvX
TLSH
T116747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspkhcaxvpnkfcau.sys

Path C:\Temp\xspkhcaxvpnkfcau.sys
Size 293KB
SHA256 4fb16dc8b92f0416b91fd0cbc5207c13e1a55cb0e6302c8d032290f60b06feaf
MD5 79517f00a91d35c5284364faec1b08bc
SHA1 28b36d6ad6539fbebfd8658f360b7e4d110c21d2
SHA512 396bf9ee835b9ef9d80f3f5f9f50eb9a91a0c4bfb941fb6ff8e87fdef410d72ac095f81c395ca0e616e747eab1d9b3cabba7ba24ec57ef25f291323704f37db0
SSDEEP 3072:EtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:EIJjiJcbI03GBc3ucY5DCSj
TLSH
T14E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwrojhbztr.sys

Path C:\Temp\zwrojhbztr.sys
Size 293KB
SHA256 df7576770200a4a57287bd4c34254aedcc05756c13018133570c8eeeb458b398
MD5 0b71d9327fb063067fee998ef1c128e9
SHA1 a266c4ee8112639a84fc7c3b91ec95ae742b654e
SHA512 d84942ff6f7453fc32bea41b8177454d7ed80b5b83b5d6a0a725bcb4cb3b0d901e68857acb7d9bf37f471e8d4836889acec2db4d8862714bb66de14519817faf
SSDEEP 3072:UtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:UIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 20781e4ea08e032c10c97525a0e0fea9119beab1de691d36d27c5a76c510c178
MD5 7c827df67a3138a495f44d75b6d2fd25
SHA1 f6805153a60d409d41cfcfeb433d191eb59b9167
SHA512 40f6c13811702de11fe0cf2eb2608feb631669e3dd2ad6b6d198c1b65eccc76bda2d829ef1b7cfbcf0e0cfd712527f4ab4050278ba91a16aa12719afd45a2298
TLSH
T18E51AFF3C3E8866D891156F0AB186E1BCE2D0915832C3D5AC8E4EF6B97E3471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1301f7f90fc718f45f633e51c403ca14b0f388dbae653f9410aeb50245c95c0a
MD5 74cf31e5fa0c688dd355f9020fdb3204
SHA1 07df2ca367de5ea4ab89bd77fd25e3095d6d463d
SHA512 e3b03c95ad9c12c47f4c6f7f05cda20a683d6cddf13c154afc6da2ce2bb3c2b47d4136dcbb639cbfb0bf1ecb6cde45c9297f70049584a029ef3b9d87dc103db0
SSDEEP 192:sxRhRFCD/fZsISwGZzoA8pi/g6+WNIYoECYvGrIgD/LAJ:sxRhmD/fZsISpki/5Ij1Hk
TLSH
T17E32B716AE28A93B9CC7D21DFB65BF53E2F9103364D42E58A6FC961C00E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 56f0c445b6ce12302ecbb5e2a7ee4197f0a64d94a4c2c9204cd5f114bdee7731
MD5 244d211e8a2345aebacdedddfac25068
SHA1 25863d165f50f881117e42df662fe8e8e7481422
SHA512 1602216c6ce2a5c86f0902a83e24bfcc74bba278a0bf76900c04f6c635479347effdd7243b8fc4ad4673c18fd6961f35bc92f330dda359006763b16cb0b9d71c
SSDEEP 192:sxRGRFCD/fZspSwGZzoA8pi/g6+WNIYoECYvGrIgVLAJ:sxRGmD/fZspSpki/5Ij11k
TLSH
T1AC32B816AA28A93B9CC7E21DFB65BF53D2F9103365D42A58E6FC961C00E66DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f85899ae8e7e2f6e74c1fea55b0d3a2ebb826e33e033a2fb6f32d52dd87ea6a1
MD5 c999a22f92c5e22e938a5c8616a123d5
SHA1 f03ce6ae6024728902c4af6b930c9a9c9111d418
SHA512 e259e0b3174a6135ab495212d9ab6fff864de2a7a766b4cacd8b52797491f53944ff253cfece3d884ddc9dacf4e6c3aca7f566c65d12b2d43ef1def8ca0669db
SSDEEP 192:sxRhRFCD/fZsIdwGZzoA8pi/g6+WNIYouCYvGrIgDNLAJ:sxRhmD/fZsIdpki/5Il1hk
TLSH
T16742B816A928A93B9CC7E21DFB65BF53E2F9103364D42E58A6FC961C00E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 5c704eeeb7078f76b3c635b55c032fae7ad305446a597c06962cc3ec6ddd3d2b
MD5 16836004cf8900b578071edb83362dbe
SHA1 2fa49e30b5e1bf6780c5915401ea1dff8961060d
SHA512 b8af056bf219a226cb48b36a680165847d571a01a1aef3bef3739ebeff0e4c47fcfaaeaf32b9dcd2c20f2045db0c44a545fed86e5d1f24408e71bb55bb3e1bb0
SSDEEP 768:j26HWo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVvVu4zro9ge0Urv:j26HWUE7MRWgs2f02u1jaO44APv
TLSH
T121C2CA6B640DCABE4F800ADDEC197E9F6D6802CB9698CD8047FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7244653e-8dcc-496b-a516-c76af49e0048.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7244653e-8dcc-496b-a516-c76af49e0048.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 7ac2bfefc33f1071cd536aeb37439101fc74766fc20b42caeefc77c44a7deff9
MD5 e0c53a78285c19b059bace27536a8ba7
SHA1 379bab56174d5db6e513c0fc726fb7f16a8eea5e
SHA512 17344b90348ac8095f52b48c9090912feaebb9e8091eb8f08c8418668e45bcbb10aacc8f3f795cdb764d6640f1cec90e7abde58c150b8c11d81fdbf2da8dd946
SSDEEP 768:Urv+4UNbdc3VXJM/TBOW3v9lONXyer1IRCzni9u2ewBKZO1E:Ubsb+3ViPlSIqnZ2evZ1
TLSH
T1EF13BF30E46CAD634DE6B296B10B76437FB820A7D8800B64EEDA2F4D059759E270FD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 408448765536158f51a23fcbab23dc90e051ceb8d557091c568161ff23df7005
MD5 9aa2ecd8fdee8a9a2b334a905343864d
SHA1 4121e2e38c407e5fa676db4b564048e1f500c3af
SHA512 2f371d29075405cc828b9ea6f3a8678ce3b3ffeef13c39b40d3b377e329a4c42198109b009315e274d95dcfc8404d7977d092269ac83feec78108727e00654bb
SSDEEP 768:/n3bXJM/TBOW3v9lONXyer1IRCzni9u2ewBKZO1F:/n3biPlSIqnZ2evZc
TLSH
T102F2BF70E4A9AD234CD6B386B14A63836EF82063E9C41B64EEEA6F1D019365D170FC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2c7d5ad1c4e7ecb155e3b2840b56294a3db129429c4927ad6ff2a8f284796186
MD5 02ed0e2046d3f76e4485bdcc8801ff9f
SHA1 8d5be38a051d583d1a8fe2bebb5bbd598c607a0a
SHA512 6dd2cb9b3cb2fb622a0218d8c0942c047d3f7a25a78f515b26f4506ad5d48ce64eeff8c095ab8618664039f457548af8fae587191452bcc08e4347edf4a2c64b
SSDEEP 768:hrv+4UNbdz3N7+/TBOW39ONXyer1IRCzniBXeVH1SK7:hbsbV3UnSIqnMEH1l
TLSH
T18603CF32A4A89E334DE2A3C6B14776137FF86057D6800B90EDDE2F4E069B59D130B95B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 e3330b79ba824ff13688129b92def45addcb4cd71fccac59e2ba587f6d334a0b
MD5 c756bd63cd3e15541e7e067eba71673f
SHA1 2be639bd4ad6a6ffa9b0e8fe02b79762a2fc90c1
SHA512 e42a705cb7f24e295fe6672fa7dee3bde5f5ea394f211cf6aacca7a76530bc0dcf2fa4a483188f2e30bc34e10b5d194921b65573504042191cb108786aa5dbbb
SSDEEP 768:jFHk3bwgyxJ/psOW3v94ONXyer1IRCzni9u2ewBKZO1F:Nk3ozE4SIqnZ2evZc
TLSH
T181039E35D894EE275CE6A3C6B6097747AEF41063C9C85AD4EED96F4D009329D070FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a59d8182ed3f3d5a4d89a1c37df975f469dff6d88a4f66f9c9864c05ba215c93
MD5 92450406f4ba133931dc301dcb5c05f9
SHA1 e2900a72bc847126b819c684b5fa34eab1a1bfab
SHA512 efa0132d65aaba26ec76ef9dfefab2217eeab204cc3eb71e58727c28d2d6b4d8de4c469a8b3ba0c17607c8793d16bfc87d62b9da32605150ff79666ebfcf02de
SSDEEP 768:Ln3+xJM/TBOW3v9tONXyer1IRCzni9u2ewBKZO1F:Ln3+gPtSIqnZ2evZc
TLSH
T175F2BF70E4A9AD234CD6B386B14A63936EF82063E9C41B64EEEA6F1D019365D170FC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 c1f822aa3bc91c3b7f4ec9d416236b506944aea56419e648349f04f2fe2dd6bd
MD5 5bc8b760d4b7ad1cf8a09605fdc03777
SHA1 5490c90ff8e001ba57db26690ba58c3f3cc2e85c
SHA512 7a66895fcbaae8a2e3b7acd079c3c31adff75b1364eba34a1cc96de5da92fc321806ef85957a427268ec9a588ab454215c556ceafef377ad4d595950519b8702
TLSH
T1C471239366B8DAF3C1DE5BF503835644F2FF22380723302017515986AB30A7A68B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1016-382-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1240-378-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1512-278-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2400-226-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2652-390-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2756-266-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2868-374-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2900-290-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4256-394-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4324-332-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4404-345-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4492-357-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4820-158-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4820-206-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4868-370-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5320-386-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5668-334-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5668-306-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5704-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5884-197-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5916-238-0x0000000000010000-0x00000000000AB000-memory.dmp

Download