systex | 2580af44f6ca9db6db7b6cd2b38665eb85a3752d8230ec5d2d3609f0d705e2fc

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260909-e2kmjsbl8v
SHA256 2580af44f6ca9db6db7b6cd2b38665eb85a3752d8230ec5d2d3609f0d705e2fc
MD5 30059e8bb93fa07e1b04da67c85d840e
SHA1 980f65af808054e5cb3c28858f32394452de6583
SHA512 cbf07abfd55347fb8cc99a1c0885f900aa0f6dc2485e01e644423b19620579b4a1acc432264e84fc3fbe1be23eba1a67db581382920b40ed52d8e1ed1d464a7f
SSDEEP 6144:lflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:lflfAsiVGjSGecvX
TLSH
T15D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5676	gaytqljgaytqljdb.exe
4512	gaytqljgaytqljdb.sys
1444	CreateProcess.exe
5668	idbvtoibtg.exe
5684	CreateProcess.exe
4204	CreateProcess.exe
4132	i_idbvtoibtg.exe
992	igayvqolyv.sys
4324	CreateProcess.exe
5568	vtnidavsnl.exe
2932	CreateProcess.exe
4308	CreateProcess.exe
4160	i_vtnidavsnl.exe
2868	vtnlfdxvpn.sys
5628	CreateProcess.exe
4900	nkidxnkica.exe
5292	CreateProcess.exe
1164	CreateProcess.exe
1360	i_nkidxnkica.exe
3400	nkfcxuspnh.sys
4904	CreateProcess.exe
1040	mkicausmkf.exe
3268	CreateProcess.exe
4952	CreateProcess.exe
4464	i_mkicausmkf.exe
3224	pkhczxsmke.sys
2716	CreateProcess.exe
784	khfzxrpkhc.exe
5880	CreateProcess.exe
4160	CreateProcess.exe
1984	i_khfzxrpkhc.exe
4736	rpjecwupmk.sys
2400	CreateProcess.exe
6136	hecwuomjeb.exe
5504	CreateProcess.exe
3492	CreateProcess.exe
2552	i_hecwuomjeb.exe
6132	omhecwtrmj.sys
4076	CreateProcess.exe
2628	pjhbztrmje.exe
2092	CreateProcess.exe
3176	CreateProcess.exe
1640	i_pjhbztrmje.exe
1624	wuojgeywro.sys
1776	CreateProcess.exe
3196	tomgebwrol.exe
5816	CreateProcess.exe
688	CreateProcess.exe
3264	i_tomgebwrol.exe
4508	vtrljdbywt.sys
4420	CreateProcess.exe
5188	ytqljdbvtq.exe
5672	CreateProcess.exe
2760	CreateProcess.exe
5100	i_ytqljdbvtq.exe
1084	dywqoigayt.sys
2100	CreateProcess.exe
4924	tqlidbvtnl.exe
4132	CreateProcess.exe
5140	CreateProcess.exe
240	i_tqlidbvtnl.exe
5828	aysqkidavs.sys
5280	CreateProcess.exe
3264	vtnlidayvq.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1154850662\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1910898845\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1910898845\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkicausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khfzxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomgebwrol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlidayvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaytqljgaytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hecwuomjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqljdbvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkidxnkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnidavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnidavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkeczxrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdbvtqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpkhczurpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khfzxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tomgebwrol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpkhczurpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkeczxrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlidayvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idbvtoibtg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idbvtoibtg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hecwuomjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqljdbvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkidxnkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkicausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdbvtqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbztrmje.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
908	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1716	ipconfig.exe
1576	ipconfig.exe
4148	ipconfig.exe
1964	ipconfig.exe
3728	ipconfig.exe
5100	ipconfig.exe
848	ipconfig.exe
4868	ipconfig.exe
2108	ipconfig.exe
3632	ipconfig.exe
5284	ipconfig.exe
5680	ipconfig.exe
5452	ipconfig.exe
5240	ipconfig.exe
1432	ipconfig.exe
4944	ipconfig.exe
4852	ipconfig.exe
5500	ipconfig.exe
5388	ipconfig.exe
5572	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334015797574203"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{BC0D56AB-B6EA-4481-9F9A-12B51E8723A5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5676	gaytqljgaytqljdb.exe
5676	gaytqljgaytqljdb.exe
5676	gaytqljgaytqljdb.exe
5676	gaytqljgaytqljdb.exe
5676	gaytqljgaytqljdb.exe
5676	gaytqljgaytqljdb.exe
5676	gaytqljgaytqljdb.exe
5676	gaytqljgaytqljdb.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4132	i_idbvtoibtg.exe
Token: SeDebugPrivilege	4160	i_vtnidavsnl.exe
Token: SeDebugPrivilege	1360	i_nkidxnkica.exe
Token: SeDebugPrivilege	4464	i_mkicausmkf.exe
Token: SeDebugPrivilege	1984	i_khfzxrpkhc.exe
Token: SeDebugPrivilege	2552	i_hecwuomjeb.exe
Token: SeDebugPrivilege	1640	i_pjhbztrmje.exe
Token: SeDebugPrivilege	3264	i_tomgebwrol.exe
Token: SeDebugPrivilege	5100	i_ytqljdbvtq.exe
Token: SeDebugPrivilege	240	i_tqlidbvtnl.exe
Token: SeDebugPrivilege	4508	i_vtnlidayvq.exe
Token: SeDebugPrivilege	5580	i_vsqkicavsn.exe
Token: SeDebugPrivilege	2208	i_rpkhczurpk.exe
Token: SeDebugPrivilege	4596	i_pmkeczxrpm.exe
Token: SeDebugPrivilege	4092	i_xrpjhczurm.exe
Token: SeDebugPrivilege	1540	i_rmjebwuomg.exe
Token: SeDebugPrivilege	3696	i_oigbytrljd.exe
Token: SeDebugPrivilege	5040	i_gaysqlidbv.exe
Token: SeDebugPrivilege	3020	i_fdbvtqlidb.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4176	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 5676	3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 3704 wrote to memory of 5136	3704	2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 5136 wrote to memory of 4176	5136	iexplore.exe	91
PID 4176 wrote to memory of 5800	4176	msedge.exe	92
PID 4176 wrote to memory of 908	4176	msedge.exe	94
PID 4176 wrote to memory of 4120	4176	msedge.exe	95
PID 4176 wrote to memory of 4120	4176	msedge.exe	95
PID 4176 wrote to memory of 4120	4176	msedge.exe	95
PID 4176 wrote to memory of 988	4176	msedge.exe	96
PID 4176 wrote to memory of 988	4176	msedge.exe	96
PID 4176 wrote to memory of 2440	4176	msedge.exe	97
PID 4176 wrote to memory of 2440	4176	msedge.exe	97
PID 4176 wrote to memory of 2912	4176	msedge.exe	98
PID 4176 wrote to memory of 2440	4176	msedge.exe	97
PID 4176 wrote to memory of 2912	4176	msedge.exe	98
PID 4176 wrote to memory of 2912	4176	msedge.exe	98
PID 4176 wrote to memory of 3292	4176	msedge.exe	99
PID 4176 wrote to memory of 3292	4176	msedge.exe	99
PID 4176 wrote to memory of 3292	4176	msedge.exe	99
PID 4176 wrote to memory of 4628	4176	msedge.exe	100
PID 4176 wrote to memory of 4628	4176	msedge.exe	100
PID 4176 wrote to memory of 4628	4176	msedge.exe	100
PID 4176 wrote to memory of 2628	4176	msedge.exe	101
PID 4176 wrote to memory of 2628	4176	msedge.exe	101
PID 4176 wrote to memory of 2072	4176	msedge.exe	105
PID 4176 wrote to memory of 3924	4176	msedge.exe	106
PID 4176 wrote to memory of 2072	4176	msedge.exe	105
PID 4176 wrote to memory of 3924	4176	msedge.exe	106
PID 4176 wrote to memory of 3676	4176	msedge.exe	108
PID 5676 wrote to memory of 1444	5676	gaytqljgaytqljdb.exe	109
PID 4176 wrote to memory of 1888	4176	msedge.exe	111
PID 4176 wrote to memory of 1888	4176	msedge.exe	111
PID 5668 wrote to memory of 5684	5668	idbvtoibtg.exe	113
PID 4176 wrote to memory of 1360	4176	msedge.exe	118
PID 4176 wrote to memory of 1360	4176	msedge.exe	118
PID 5676 wrote to memory of 4204	5676	gaytqljgaytqljdb.exe	119
PID 5676 wrote to memory of 4324	5676	gaytqljgaytqljdb.exe	123
PID 5568 wrote to memory of 2932	5568	vtnidavsnl.exe	125
PID 5676 wrote to memory of 4308	5676	gaytqljgaytqljdb.exe	128
PID 5676 wrote to memory of 5628	5676	gaytqljgaytqljdb.exe	132
PID 4900 wrote to memory of 5292	4900	nkidxnkica.exe	134
PID 5676 wrote to memory of 1164	5676	gaytqljgaytqljdb.exe	137
PID 5676 wrote to memory of 4904	5676	gaytqljgaytqljdb.exe	141
PID 1040 wrote to memory of 3268	1040	mkicausmkf.exe	143
PID 5676 wrote to memory of 4952	5676	gaytqljgaytqljdb.exe	147
PID 4176 wrote to memory of 3648	4176	msedge.exe	149
PID 4176 wrote to memory of 1776	4176	msedge.exe	150
PID 4176 wrote to memory of 4380	4176	msedge.exe	151
PID 5676 wrote to memory of 2716	5676	gaytqljgaytqljdb.exe	154
PID 784 wrote to memory of 5880	784	khfzxrpkhc.exe	156
PID 5676 wrote to memory of 4160	5676	gaytqljgaytqljdb.exe	159
PID 5676 wrote to memory of 2400	5676	gaytqljgaytqljdb.exe	163
PID 6136 wrote to memory of 5504	6136	hecwuomjeb.exe	165
PID 5676 wrote to memory of 3492	5676	gaytqljgaytqljdb.exe	168
PID 5676 wrote to memory of 4076	5676	gaytqljgaytqljdb.exe	172
PID 2628 wrote to memory of 2092	2628	pjhbztrmje.exe	174
PID 5676 wrote to memory of 3176	5676	gaytqljgaytqljdb.exe	177
PID 5676 wrote to memory of 1776	5676	gaytqljgaytqljdb.exe	181
PID 3196 wrote to memory of 5816	3196	tomgebwrol.exe	183
PID 5676 wrote to memory of 688	5676	gaytqljgaytqljdb.exe	186
PID 4176 wrote to memory of 1340	4176	msedge.exe	188
PID 4176 wrote to memory of 1340	4176	msedge.exe	188
PID 5676 wrote to memory of 4420	5676	gaytqljgaytqljdb.exe	194
PID 5188 wrote to memory of 5672	5188	ytqljdbvtq.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_30059e8bb93fa07e1b04da67c85d840e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Temp\gaytqljgaytqljdb.exe
  C:\Temp\gaytqljgaytqljdb.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idbvtoibtg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1444
  - - C:\Temp\idbvtoibtg.exe
      C:\Temp\idbvtoibtg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5668
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_idbvtoibtg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4204
  - - C:\Temp\i_idbvtoibtg.exe
      C:\Temp\i_idbvtoibtg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnidavsnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4324
  - - C:\Temp\vtnidavsnl.exe
      C:\Temp\vtnidavsnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2932
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnidavsnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4308
  - - C:\Temp\i_vtnidavsnl.exe
      C:\Temp\i_vtnidavsnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkidxnkica.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5628
  - - C:\Temp\nkidxnkica.exe
      C:\Temp\nkidxnkica.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4900
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5292
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkidxnkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1164
  - - C:\Temp\i_nkidxnkica.exe
      C:\Temp\i_nkidxnkica.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkicausmkf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4904
  - - C:\Temp\mkicausmkf.exe
      C:\Temp\mkicausmkf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1040
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3268
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkicausmkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4952
  - - C:\Temp\i_mkicausmkf.exe
      C:\Temp\i_mkicausmkf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khfzxrpkhc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2716
  - - C:\Temp\khfzxrpkhc.exe
      C:\Temp\khfzxrpkhc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:784
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5880
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khfzxrpkhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4160
  - - C:\Temp\i_khfzxrpkhc.exe
      C:\Temp\i_khfzxrpkhc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hecwuomjeb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2400
  - - C:\Temp\hecwuomjeb.exe
      C:\Temp\hecwuomjeb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6136
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5504
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hecwuomjeb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3492
  - - C:\Temp\i_hecwuomjeb.exe
      C:\Temp\i_hecwuomjeb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhbztrmje.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4076
  - - C:\Temp\pjhbztrmje.exe
      C:\Temp\pjhbztrmje.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2628
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2092
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhbztrmje.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3176
  - - C:\Temp\i_pjhbztrmje.exe
      C:\Temp\i_pjhbztrmje.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tomgebwrol.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1776
  - - C:\Temp\tomgebwrol.exe
      C:\Temp\tomgebwrol.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3196
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5816
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tomgebwrol.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:688
  - - C:\Temp\i_tomgebwrol.exe
      C:\Temp\i_tomgebwrol.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ytqljdbvtq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4420
  - - C:\Temp\ytqljdbvtq.exe
      C:\Temp\ytqljdbvtq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5188
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5672
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5388
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ytqljdbvtq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2760
  - - C:\Temp\i_ytqljdbvtq.exe
      C:\Temp\i_ytqljdbvtq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqlidbvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2100
  - - C:\Temp\tqlidbvtnl.exe
      C:\Temp\tqlidbvtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4924
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4132
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqlidbvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5140
  - - C:\Temp\i_tqlidbvtnl.exe
      C:\Temp\i_tqlidbvtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlidayvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5280
  - - C:\Temp\vtnlidayvq.exe
      C:\Temp\vtnlidayvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3264
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2508
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlidayvq.exe ups_ins
    3⤵
    PID:2844
  - - C:\Temp\i_vtnlidayvq.exe
      C:\Temp\i_vtnlidayvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsqkicavsn.exe ups_run
    3⤵
    PID:3960
  - - C:\Temp\vsqkicavsn.exe
      C:\Temp\vsqkicavsn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4988
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3320
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsqkicavsn.exe ups_ins
    3⤵
    PID:2608
  - - C:\Temp\i_vsqkicavsn.exe
      C:\Temp\i_vsqkicavsn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpkhczurpk.exe ups_run
    3⤵
    PID:2332
  - - C:\Temp\rpkhczurpk.exe
      C:\Temp\rpkhczurpk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3216
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5916
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpkhczurpk.exe ups_ins
    3⤵
    PID:5828
  - - C:\Temp\i_rpkhczurpk.exe
      C:\Temp\i_rpkhczurpk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmkeczxrpm.exe ups_run
    3⤵
    PID:1280
  - - C:\Temp\pmkeczxrpm.exe
      C:\Temp\pmkeczxrpm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5860
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4836
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmkeczxrpm.exe ups_ins
    3⤵
    PID:3540
  - - C:\Temp\i_pmkeczxrpm.exe
      C:\Temp\i_pmkeczxrpm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4596
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpjhczurm.exe ups_run
    3⤵
    PID:5388
  - - C:\Temp\xrpjhczurm.exe
      C:\Temp\xrpjhczurm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2988
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5704
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpjhczurm.exe ups_ins
    3⤵
    PID:4080
  - - C:\Temp\i_xrpjhczurm.exe
      C:\Temp\i_xrpjhczurm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmjebwuomg.exe ups_run
    3⤵
    PID:5896
  - - C:\Temp\rmjebwuomg.exe
      C:\Temp\rmjebwuomg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5996
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2928
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmjebwuomg.exe ups_ins
    3⤵
    PID:4940
  - - C:\Temp\i_rmjebwuomg.exe
      C:\Temp\i_rmjebwuomg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigbytrljd.exe ups_run
    3⤵
    PID:248
  - - C:\Temp\oigbytrljd.exe
      C:\Temp\oigbytrljd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1300
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1948
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigbytrljd.exe ups_ins
    3⤵
    PID:2488
  - - C:\Temp\i_oigbytrljd.exe
      C:\Temp\i_oigbytrljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaysqlidbv.exe ups_run
    3⤵
    PID:2460
  - - C:\Temp\gaysqlidbv.exe
      C:\Temp\gaysqlidbv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2036
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3088
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaysqlidbv.exe ups_ins
    3⤵
    PID:1488
  - - C:\Temp\i_gaysqlidbv.exe
      C:\Temp\i_gaysqlidbv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdbvtqlidb.exe ups_run
    3⤵
    PID:4860
  - - C:\Temp\fdbvtqlidb.exe
      C:\Temp\fdbvtqlidb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3424
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdbvtqlidb.exe ups_ins
    3⤵
    PID:5024
  - - C:\Temp\i_fdbvtqlidb.exe
      C:\Temp\i_fdbvtqlidb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvpnifax.exe ups_run
    3⤵
    PID:2768
  - - C:\Temp\fdxvpnifax.exe
      C:\Temp\fdxvpnifax.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3804
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1132
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4944
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x30c,0x7fff4a00c188,0x7fff4a00c194,0x7fff4a00c1a0
      4⤵
      PID:5800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2164,i,10855461866876188965,2201746812909739751,524288 --field-trial-handle=2864,i,4269977712022782173,14968312291221393719,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:11
      4⤵
      System Time Discovery
      PID:908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1928,i,14747814982046760528,10008615113958150715,262144 --field-trial-handle=2864,i,4269977712022782173,14968312291221393719,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:2
      4⤵
      PID:4120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,16348841716873624625,17521169898045656093,524288 --field-trial-handle=2864,i,4269977712022782173,14968312291221393719,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:13
      4⤵
      PID:988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,8035165595927126269,6770104552452240311,2097152 --field-trial-handle=2864,i,4269977712022782173,14968312291221393719,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:2440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,2871941601876636740,582824815096300477,2097152 --field-trial-handle=2864,i,4269977712022782173,14968312291221393719,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:2912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,18045322919903503014,9044566451029629613,2097152 --field-trial-handle=2864,i,4269977712022782173,14968312291221393719,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:1
      4⤵
      PID:3292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,8719927397072147096,14608610544119473231,2097152 --field-trial-handle=2864,i,4269977712022782173,14968312291221393719,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:9
      4⤵
      PID:4628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,13834560443371838749,15748288731684629241,524288 --field-trial-handle=2864,i,4269977712022782173,14968312291221393719,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
      4⤵
      PID:2628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,4241846897848656208,10500631899039182469,524288 --field-trial-handle=2864,i,4269977712022782173,14968312291221393719,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:2072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,3913493683247401074,6819830200868060859,524288 --field-trial-handle=2864,i,4269977712022782173,14968312291221393719,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
      4⤵
      PID:3924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,5955040362343976514,2607004042416830947,524288 --field-trial-handle=2864,i,4269977712022782173,14968312291221393719,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:2932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,5955040362343976514,2607004042416830947,524288 --field-trial-handle=2864,i,4269977712022782173,14968312291221393719,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:3676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,11426066821356234614,10139073628137558962,524288 --field-trial-handle=2864,i,4269977712022782173,14968312291221393719,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
      4⤵
      PID:1888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,1510551315514154180,18028741737349078440,524288 --field-trial-handle=2864,i,4269977712022782173,14968312291221393719,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
      4⤵
      PID:1360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,12145472376486150786,7367126076910491279,524288 --field-trial-handle=2864,i,4269977712022782173,14968312291221393719,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:14
      4⤵
      PID:3648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,2369759158764863761,9383473389003870958,524288 --field-trial-handle=2864,i,4269977712022782173,14968312291221393719,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:14
      4⤵
      PID:1776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,3678395728009150846,11898716291090910364,524288 --field-trial-handle=2864,i,4269977712022782173,14968312291221393719,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
      4⤵
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,17321420408989937327,6600360395820463786,524288 --field-trial-handle=2864,i,4269977712022782173,14968312291221393719,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
      4⤵
      PID:1340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,173251280776104875,7723448160765416160,524288 --field-trial-handle=2864,i,4269977712022782173,14968312291221393719,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
      4⤵
      PID:5436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6056,i,5795519447279925020,2446246395439143581,262144 --field-trial-handle=2864,i,4269977712022782173,14968312291221393719,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:10
      4⤵
      PID:1620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,10310403450607095774,11071659446196780547,524288 --field-trial-handle=2864,i,4269977712022782173,14968312291221393719,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
      4⤵
      PID:3572

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1312

C:\Temp\gaytqljgaytqljdb.sys
C:\Temp\gaytqljgaytqljdb.sys
1⤵
- Executes dropped EXE
PID:4512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2824

C:\Temp\igayvqolyv.sys
C:\Temp\igayvqolyv.sys
1⤵
- Executes dropped EXE
PID:992

C:\Temp\vtnlfdxvpn.sys
C:\Temp\vtnlfdxvpn.sys
1⤵
- Executes dropped EXE
PID:2868

C:\Temp\nkfcxuspnh.sys
C:\Temp\nkfcxuspnh.sys
1⤵
- Executes dropped EXE
PID:3400

C:\Temp\pkhczxsmke.sys
C:\Temp\pkhczxsmke.sys
1⤵
- Executes dropped EXE
PID:3224

C:\Temp\rpjecwupmk.sys
C:\Temp\rpjecwupmk.sys
1⤵
- Executes dropped EXE
PID:4736

C:\Temp\omhecwtrmj.sys
C:\Temp\omhecwtrmj.sys
1⤵
- Executes dropped EXE
PID:6132

C:\Temp\wuojgeywro.sys
C:\Temp\wuojgeywro.sys
1⤵
- Executes dropped EXE
PID:1624

C:\Temp\vtrljdbywt.sys
C:\Temp\vtrljdbywt.sys
1⤵
- Executes dropped EXE
PID:4508

C:\Temp\dywqoigayt.sys
C:\Temp\dywqoigayt.sys
1⤵
- Executes dropped EXE
PID:1084

C:\Temp\aysqkidavs.sys
C:\Temp\aysqkidavs.sys
1⤵
- Executes dropped EXE
PID:5828

C:\Temp\xvsnkicaxv.sys
C:\Temp\xvsnkicaxv.sys
1⤵
PID:696

C:\Temp\xspkicausm.sys
C:\Temp\xspkicausm.sys
1⤵
PID:2356

C:\Temp\xuspkhczur.sys
C:\Temp\xuspkhczur.sys
1⤵
PID:1232

C:\Temp\ecwurmkecw.sys
C:\Temp\ecwurmkecw.sys
1⤵
PID:3776

C:\Temp\wromgeywro.sys
C:\Temp\wromgeywro.sys
1⤵
PID:5288

C:\Temp\lgeywtrljd.sys
C:\Temp\lgeywtrljd.sys
1⤵
PID:2768

C:\Temp\olgdywqolg.sys
C:\Temp\olgdywqolg.sys
1⤵
PID:556

C:\Temp\lidbvtqlid.sys
C:\Temp\lidbvtqlid.sys
1⤵
PID:3040

C:\Temp\nifaxsqkic.sys
C:\Temp\nifaxsqkic.sys
1⤵
PID:2668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gaytqljgaytqljdb.exe

Path C:\Temp\gaytqljgaytqljdb.exe
Size 361KB
SHA256 041f3dadee0a49f0528d54ecf282b6b0555e71cc80d92c47c899b633373036bd
MD5 0a01711585115a9543dd06c06bc0b8bc
SHA1 c3014aa61abca552efc8f7a1fe654db75a5ca7fe
SHA512 c7f90f9c910cb0c819c42c6238f1245dedab4cceddc907fa6109b71842965b2d397393e5f99e4bbf313dd6d605b1ace58d8a6753af0ba33e53f6633eebb16648
SSDEEP 6144:TflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:TflfAsiVGjSGecvX
TLSH
T1B3747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaytqljgaytqljdb.sys

Path C:\Temp\gaytqljgaytqljdb.sys
Size 293KB
SHA256 c097acb4c70922273a5adea1562c76fd34555fb1780a25aa15048702e3dd6314
MD5 7fe18df73dd802755c965ac59d70c644
SHA1 ab031d86d2b42f2335764e908799840049ab192e
SHA512 2adf988ad60d15fc53f8dea158d958d9e36da423f0fb8df621366dfb7b74e5bce3902aa9a9e41af34cdc9bb330f9cdb4f35cec3d81f9d69e89fd4e978ab68e6e
SSDEEP 3072:MtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:MIJjiJcbI03GBc3ucY5DCSj
TLSH
T117545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hecwuomjeb.exe

Path C:\Temp\hecwuomjeb.exe
Size 361KB
SHA256 8d0d0acc84548b417e2473106248eaa0ca8116ba330c0debec6a7b50b77411c3
MD5 86666acc92c10c48f7724a191b43b583
SHA1 fee88c0c487ddaa5330ed89b62b5f29b8d936383
SHA512 5e8880741b0a9d414db2f53f8595cca1f14bdac9c848e6c54ced8ce2752de450b5c05ce525682bf21d7f268ffaea878d9e4cad3153b27cc425bfe5e6a0d6a316
SSDEEP 6144:lflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:lflfAsiVGjSGecvX
TLSH
T136747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_idbvtoibtg.exe

Path C:\Temp\i_idbvtoibtg.exe
Size 361KB
SHA256 c70764c3542973f809860af3a3119ec1c79e1a4342e09ccbfb15de8543b56584
MD5 46f14ca2b9ab02b2487d322048fba604
SHA1 5ef6804c78b2145a525d708502afefb866478497
SHA512 980d26699fec575e189dc4889d06329a7a46fac0af6973c7d69cfaa7d6329eebf1bee5498a76d144452bacdb243f2e4d83946b95a429f2ebd77b743c05df9ef8
SSDEEP 6144:tflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:tflfAsiVGjSGecvX
TLSH
T1D3747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_khfzxrpkhc.exe

Path C:\Temp\i_khfzxrpkhc.exe
Size 361KB
SHA256 b4d35ffc5be568528f013e541df3a5b28f51bf1a4972de04fa84e83792a8b388
MD5 7db07154fc6f6afd431321bb5ea7a664
SHA1 855f4eb259371290a60575b1d223883e215235e0
SHA512 4a6f5d06bb4d778f0648dbab62ec623f8e513052c42b2b4e393fd69b19b2be64c466215684d6401b9c22f6693e885d36a1ead7c94bbd9b8ca1f250c30eb6e15d
SSDEEP 6144:FflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:FflfAsiVGjSGecvX
TLSH
T1CB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkicausmkf.exe

Path C:\Temp\i_mkicausmkf.exe
Size 361KB
SHA256 f65377bc57201173eb20ef5e4da287b7e0dff2f80851857dab3ae0c1dd8415ca
MD5 8672bffe3c9a44419c40899526d8ad02
SHA1 322371b0e6bddffbb5f602c9e416304ddfa03da8
SHA512 ca9fabbde41217b2bb761ab509856820573d37666290d7b537dd5420319691b73f86e2992516d2e99c835c44dcf9204c7510bd743f904cf99e4dd2fd34e45aa6
SSDEEP 6144:sflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:sflfAsiVGjSGecvX
TLSH
T1F3747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nkidxnkica.exe

Path C:\Temp\i_nkidxnkica.exe
Size 361KB
SHA256 48acf961f0cac550cfd329052d0db05ee3618186d41368213cc1277a002c612c
MD5 75c86a2490e3289f47e1fe8b7cd8006f
SHA1 9ce0f51e8884b1fd87cf253ae2787cbd8a526e54
SHA512 a5948397e0b3346efc24669a22b8e5604afc47d0cb1c5c008f15d12d4769ee0054bbc743a621da2dc27e601d01a47fa087c13425921dc3b79443899ea335d98b
SSDEEP 6144:GflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:GflfAsiVGjSGecvX
TLSH
T1D5747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtnidavsnl.exe

Path C:\Temp\i_vtnidavsnl.exe
Size 361KB
SHA256 60a023e7e8dd3caa722408a3ffbb8b50dcb7d2263c834e6ff2b08b3fd4eb0805
MD5 18cf22d77c2401b08fea68ff67e68991
SHA1 97bbbcec068d5696bcbecbb7a59e0de1271c6356
SHA512 985c6d472726922bf0db0159b0a3a6c5ccddf8624e8e267f6d8ef4b0505196b21a9e4ea51d6b3a400d808007b12b1f1148b1ecae68af3324a71876a0d14c3d1a
SSDEEP 6144:OflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:OflfAsiVGjSGecvX
TLSH
T1D4747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idbvtoibtg.exe

Path C:\Temp\idbvtoibtg.exe
Size 361KB
SHA256 d64e22cff475ce585521d5776c665314f5e5082983c5d339d50e796f10f5218f
MD5 2742f1a60554c77f6ba135094384fe6e
SHA1 bef3851eb530b0f2ddb968213ffb480615a69c99
SHA512 38c7d6c65af6c48f743a8d0fd7556c88795797a4f120f76d1a7ffa4db8e0a756acc97188ebdd593d38005765085ceb3b48a42b9298d0b1d3f72d30155bdee366
SSDEEP 6144:0flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:0flfAsiVGjSGecvX
TLSH
T1A0747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igayvqolyv.sys

Path C:\Temp\igayvqolyv.sys
Size 293KB
SHA256 b4a87e3e75ddb2eae7728932189d918c4ead5a882fdd64d37421e80171dc0376
MD5 491e470472183546dd336dc6a39c6ca0
SHA1 52f0f1defc98227511c380dec6c7f322e6a23d12
SHA512 89cd74b6fe2e5eba9bba82d3f2eb388bcb202a15ece1f7eb263e55f32f1a05997b421fa2d7b3160697bf86e0303273901bfabf47762db2c23bf13817e3cdffe0
SSDEEP 3072:EtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:EIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khfzxrpkhc.exe

Path C:\Temp\khfzxrpkhc.exe
Size 361KB
SHA256 f4ff73697be616f7e7da0969128503d5893f03ac9596e10b4257a4c7266ac89c
MD5 0a020db56dad2bb65c26ff27b245c4eb
SHA1 9f148f664b189be4cf953e85d803094481367660
SHA512 33303b047ff049456647484a0992c1f718feb012301e3dd56e081e92fc94e832a95a6a1e973872af97d480c9028e1e4e57edc73ad8e6ed62185f3a7ec603c089
SSDEEP 6144:FflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:FflfAsiVGjSGecvX
TLSH
T1AF747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkicausmkf.exe

Path C:\Temp\mkicausmkf.exe
Size 361KB
SHA256 e9957d19a0c1deabddc184d48d71698a6e0f29fcb4324694c5ad0835950aacde
MD5 8e5c3279e6a8b5a65052a8009ea6fca6
SHA1 21757864b0ce858cd8749935eaff50cf3c691815
SHA512 4a5a49a03f3aa0fba2eb8e0a38a6cfc0bbffd8336ece59dbb25ef5fc2358c5db7b286de18caa9cdca9d493ed0ad2e973c54e3a569309327c3388e36ccdc7e9ea
SSDEEP 6144:FflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:FflfAsiVGjSGecvX
TLSH
T13E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfcxuspnh.sys

Path C:\Temp\nkfcxuspnh.sys
Size 293KB
SHA256 932199d388c36c86f39c12b2a32f516771c632d6e4e72ccc7aa20a4ad5d88ce8
MD5 9bb365fb829b0ae158296d1fa3c02d9d
SHA1 2d931def9f664a8875b70f4b920c305f6b3e698d
SHA512 b2ec595815fda3c6af7a08c2e5b428dd98810f8488a82beca35435633cc9bc2c5f036c02dfd513dd289b7f8d6535edef55f2d3f219dff93f18ecd28171084feb
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T114545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkidxnkica.exe

Path C:\Temp\nkidxnkica.exe
Size 361KB
SHA256 6ac4e66d8d609e09d83dad1496f9c93ff82f94e105aa5e16baa6b98ef78f5fb7
MD5 a3067dd169100e95f0a1ba9da854df1e
SHA1 c71a8fdb00067bce6c52531c61047bb840312e69
SHA512 58e1e10cccd5536d4af3fb359e0111ab888cf042bfb55970365f0895e8340c5ab2e4ab05e33407df48466d51b20fa0f2358ad641f9ddcd2e510ff5f75d013418
SSDEEP 6144:NflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:NflfAsiVGjSGecvX
TLSH
T118747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhczxsmke.sys

Path C:\Temp\pkhczxsmke.sys
Size 293KB
SHA256 6022e0cc69b98ec191f9827eda5b9f8e57aa0957279f5aa4d9fc4cea73e82a18
MD5 67d32dcdc79fbb4d28b1f1bdcab0e85e
SHA1 6010dea03ff9cd7fff3edd53e31fd2c4620d34af
SHA512 5cbcb61f57beb5bfc92812eececa796315e02ee0f7559042601f53b38071b85d4604ddf185b00925f7fb278a2add7cb66ab31313d61167f20a1ae564a9d768f1
SSDEEP 3072:rtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:rIJjiJcbI03GBc3ucY5DCSj
TLSH
T146545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjecwupmk.sys

Path C:\Temp\rpjecwupmk.sys
Size 293KB
SHA256 27280ecb7b39e770d5969660f6a26c756fca68283044ab12b095550c317c9068
MD5 9b27c84f9ae466250b37b1c453dae1bc
SHA1 8872c36de0dfc079f6503bfff40217f4411afd4d
SHA512 f94c1425818b414a6ffd076f54a9ef28b53b7323c5012d4e282dd5ad97882b8ccac6cb8a681c9659403335da4ef8c1688c61cb37324d08cd86cb5f64df7cc946
SSDEEP 3072:rtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:rIJjiJcbI03GBc3ucY5DCSj
TLSH
T157545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnidavsnl.exe

Path C:\Temp\vtnidavsnl.exe
Size 361KB
SHA256 331289a569a51a9ff6117d23c327e6944f4026f611423d1d6195bc116c975ab7
MD5 6c19c11a0c18a7407900708fd91df517
SHA1 524873ca73cdc9bde9d6a165cfdd2992cd86fe22
SHA512 d0104ffb4768e235d91f851998de7202e97211b731494e7d8e069a908f924a10e1ac95103115df5c732f9d9e1939b16733b18db9009388bd7ab3e2454f3c6140
SSDEEP 6144:MflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:MflfAsiVGjSGecvX
TLSH
T1AE747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdxvpn.sys

Path C:\Temp\vtnlfdxvpn.sys
Size 293KB
SHA256 01a09a0b8a83a9548ac1359896de11457491847d7ebf50593d7b0bf35683ab7f
MD5 66050a87edd672ded77e3092c13d600f
SHA1 72ee6dca2c83fcb03079d71695bcf701e50ac122
SHA512 a47017b6530d3a8d40e42cc95ee988a835f37c0371d4aa78d25e83d09b102f753c1fdc3d05735a0c233bcb4be30145f102b755e8fe3cb1d13eace322d5c7623a
SSDEEP 3072:QtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9Ed+:QIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 5e0f4fb3b5ac70c044c401419b2bed9a2d7a55eb740e43ae49d329013037a3eb
MD5 7cd463638ff7b4e85b98de59157c6ae0
SHA1 c7509820c5b0889ebc426f65bd89ccd4f409eecb
SHA512 514ca04954015ed3040a6380abad37e20022c28c4294127f79bbeb81a57b5fd1d570a9bc2a36872c55ad6b53c39855da18d9ab8f5d262bc80190298a3118a001
TLSH
T14851B7E303271DC2C7E582B254E1ACFA7A3AC6FA41CF9E95788EA4B4864331E31D5024
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d7e8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d7e8.TMP
Size 2KB
SHA256 47af4b2fb209c2245f5f81c1063596c40516c5538b6bd87c2f203ea3019fb495
MD5 b8583ed592bc4b102ec8ca8a5f4ba311
SHA1 9d9d884157553e946bab9e1c869fcc14f6658769
SHA512 03d57e9d113cbfd87c4c744b64a9c849a4e48cf252c090c3e7801791b47652060fb6702f4b5cbe442f2261a5b467ac7015f02cc86f8bb6f8a48a13a2003d3d84
TLSH
T1F351C8E303171DC2C7E582B258E0ACFA7A3AC6FA41CF9ED5788E94B4864331E35D5024
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 86378b5b4c7327927204f8fc0f81fb360f8919033c70200bee99adcf5f31a4b4
MD5 3c0134a4a019de89b37e4cb02105bdce
SHA1 a67faa61268dca264ede288d63224a60649d66a7
SHA512 1dd1944fc4f4e709f5d4cdf915d25f162b7066c2404400024c45e89c1f728a5bb177d33fd52bc8c8b99366a743568a5109316b5c79d16d38d9d5b9abd3feb15b
TLSH
T16941C1F3C3F4857E8A0196F0AA146E1FCE1D0525432C7C5A85E0AE2B93E3471D141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c03f5c23af35c8b9644b91a712d981842478aac6e83dd770fca9bc2e30afea1a
MD5 3f1d492e03d5cb4f661350f87e3ee754
SHA1 97c32e8a2fd493cf8978ef88eb2f5df6d50ec6b0
SHA512 382c2dd0ae0f332506b1d4412f888d235e47db55a5f40bc698e5c87272746ac14563c1a3488af0a96b7ad7e63a99e20d88fb0f9b07aa6e036c16a77edbe7ac76
SSDEEP 192:sxRDRdCB/fssax9ZRvpzoD8p9K/g6+WNC91/YCmduOiGgIgVInJ:sxRDuB/fssaxzRvd8/5W/gKWJ
TLSH
T10042D91A6928693B9CC7D30CBB66BF53D2F9513261D05E58E7FC8A1C04E66DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c71867133aa0957d6f2f846cd31376be4ad15e168ef780feb66cba64b8b82a8e
MD5 80e259a02da443489ab944ad1f04f2ec
SHA1 b92c144cb2f7ba3946868848b45b4d89f20c6afc
SHA512 da422bf396aeb26c5bbce167a444a330e6e2c13a249133ce970131f98842b94dad0dfa0e695349f9e78c9b940d8c061d43f2ac7e6ae777ff3654191e39774d54
SSDEEP 192:sxRcRdCB/fsstx9ZRvpzoD8p9K/g6+WNC91/YCmduOiGgIgDrInJ:sxRcuB/fsstxzRvd8/5W/gK4J
TLSH
T1CC42D91A7928697B9CC7D30DBB66BF53D2F95132A1D01E48A7FC8A1C05EA6DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 87ab9d2ba53c463e0e7d6ae92ae9f9a9c054e9dca3124f2f773262b1e5579eb6
MD5 9d430d500b854b63aa590b2e9ec0efac
SHA1 366365e708c400c5294879bb9e38169922f78a6c
SHA512 a766bbe77d7152e9f77437068cc2402aef6a9bc3cd7c53716e5ad128d7dcb3099471a2ed9c0a4a137e5cc18daa2da53b88e6093a4445973105355cbbaa086dd2
SSDEEP 192:sxRcRdCB/fsstt9ZRvpzoD8p9K/g6+WNC91/YCm9vuOiGgIgD5InJ:sxRcuB/fssttzRvd8/5W/CKWJ
TLSH
T1B042C71A6928697B9CC7E34DBB66BF53D2F9513261D01E48A7FC8B1C01EA6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 b293f210c854de209c84f342ebad0772e3cf6d50c92827f3da571c6d52f4c084
MD5 fed964fe2edbf066bccbf7e313c06e1f
SHA1 6fcd73e5fbfed0d53c209b9bd44382b8097afda4
SHA512 23458b68cfd63650a9407079376602748feaad60dc1c52b14aa2cf85225a9dea54c104c65274bfce2b4ce833edc4faf40e7d26fd176e8d981797864246852082
SSDEEP 768:jC+vrN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsi0QqcjroZ9:jC+vr7E7JQWgQ+f4+u1jaHi0VcQf
TLSH
T121D2EA7B640DCB7F4F804ADDEC197E9E6DA802CB9698CD4047FA941C02C67EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46bd885b-e6e9-45a8-8487-f8d672a17ad0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\46bd885b-e6e9-45a8-8487-f8d672a17ad0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 666c4eb725c6bf6f61d22b5544d7e564b1d3c1ec6d119390c83616dad71ce6e4
MD5 c446431fc56ba2eb1bf9693cbaa3070e
SHA1 2f4b44cd6e5e05f89dfae1cfffc2a9294c780b7d
SHA512 73b9e494ce346f5640d560b671ea7fe3611ede34cdaeda89a386546c0d82159ce33a36d0c1ebbfb4a6443b6235980159a6ed5478df3783e65719dfaa702c1152
SSDEEP 768:Irv+4UNbdD39c4Np8+p3bd66j+4BRv86aLIiK2bwCl1:Ibsbp37L8+p3Z6n4yY0ww
TLSH
T12C03CE73F8A899739CE6C644B2467A433FF821A396C10EC4D4DD2B4E419A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d6fd2d9a34e0360e5c799c432cb9d6945d1bc3d8a1921b9b89cf280e9fbb6db8
MD5 9db45b4b6b75d0fe90ccd047a364ba4d
SHA1 16032fefb9b91690eb3060e06f18e8bf900209c4
SHA512 2a215ce70c974864c7c02c1d219fe32c2419faac8e6f5d43f98aa7655ae4ae4866d64684857ebc33f013de25b532d219d52710f04b4194f89bfa59d03abe29db
SSDEEP 768:Drv+4UNbdq3gntJoop8+p3bd66j+4BRv86aLIWrE+:DbsbY3928+p3Z6n4y1E+
TLSH
T18503AD75F869DD339CE6C744B24676837FB411A355C00E98D8D96B4E018A19E270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 5ece74277f585f28371d01460874099fa71d3cfd17b8a5da82639ebc0cce474f
MD5 e37a4b2f2d70ccc1332462e86a55ae3d
SHA1 d30cb52412eea09930ac763db0ddc1dc59c3ca58
SHA512 2fee0ada475315952c8f5289f1ef3876f7d3992f61eca68c5eacb18c23222f44cb97393446bc485bc78a581471f98598a21265ddf27a0bb2f14bba938000067c
SSDEEP 768:793ZrtJoDp8+p3bd66j+4BRv86aLIWrcTRf61:793CV8+p3Z6n4y1cTRfK
TLSH
T111F2AFB5F8A9DD735CFAD345B2577743AEF411A395C00E94D8DCAB1E008629E170B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 3387d1d0cfde6d5804daff398d859b50fa3904c991389840ac01ccbbbae5b541
MD5 4007f3217d2a6c76f58860778841ffd5
SHA1 2d85f4106d93496f8421afa967f921fed2d299cc
SHA512 328cef1c56d13708088a4a673ecb8ccae8bdf859692da0068db707bc659cb10ae41b6252655f5f75e32c292d3ce675116ec386631187b09b7365ac2176af0c23
SSDEEP 768:593crtJoDp8+p3bd66j+4BRv86aLIWrcTRf61:593zV8+p3Z6n4y1cTRfK
TLSH
T107F2AEB5F8A9DD775CFAC344B2577743AEF411A395C00E94E8DCAB1E008629E170B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 58424232e1f7caa50aa72d55a3ab581761972cd2bff7f6b1e77da72e2a3c06bb
MD5 e9483792116b9daa3b9d6f6bc8206a3c
SHA1 89b9e4159bfc67583110e9c8400420060e1aa4ac
SHA512 638ecb905c59000805cea37a545e65c9a0c8cf9c010c16b6075a8e3a9093581f8e983887f744b2b6c747e7d7ea05e75f417ed62c2a7438543f98282e19c181ed
SSDEEP 768:/rv+4UNbdD3qI3JoNp8+p3bd66j+4BRv86aLITr2bwCl1:/bsbp3gL8+p3Z6n4yy0ww
TLSH
T17603BE72F4ADE9739CE6C644B147B7837FB821A399C10EC4E4D96B4E015A19E270B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 1be91a4a50d4c4b03e675f437256f2593c6b3befe3d59dcf7381e125d75ab859
MD5 990a6129da2c94f295af982680905ed8
SHA1 b59ff4b2895a46135f2668b6573c306b3b599168
SHA512 149b7976736648ff317f6b72a1389c71111719c44e929ba03996102db4252faec0f4eea4e73745cdaa9b5d8105dcc36ab1949334b1f9d84c683034dbf166b91f
SSDEEP 768:eFQ637wgFli0Hp8+p3bd66j+4BRv86aLIWrcTRf61:163d8+p3Z6n4y1cTRfK
TLSH
T1A01327F698D78936D8EE8787A33D6E429EBCC06375844994B7C85E0DCC821BFD706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

d7bdde33-db70-4d9d-988b-306d104e0d28.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d7bdde33-db70-4d9d-988b-306d104e0d28.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4176_333007827\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 a8de9a1b147b61caabe7d63e8ec7a349ba568912cf016f7a731ecfb744fb3ad7
MD5 01ad7b8993ed717782917e88cda0d0d8
SHA1 3d4a53e91e174061b833a0031a3616f44e1b082e
SHA512 33f927cd7d688288e754b42396692ac602bc2d00e46829c2402bca0bacc841d9acc37da00c71fa40371a06e6ea4a4c086740da11e5aee3c367017acc0ab032e3
TLSH
T1D471048356A8D5B2C1DA5BF402C35544F5BB2238076330204B91598AE770A7564B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/556-431-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/696-374-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/992-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/992-236-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1084-337-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1232-418-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1232-396-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1624-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2356-380-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2668-462-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2768-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2868-235-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3040-442-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3224-276-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3400-264-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3776-416-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4508-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4512-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4736-289-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5288-421-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5828-376-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5828-362-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6132-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download