systex | 49e3927a3ae4baa89b2206381a83e0af8bbcbef09a656092801436f2663affb6

Analysis

max time kernel
149s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260920-2fgebstyaw
SHA256 49e3927a3ae4baa89b2206381a83e0af8bbcbef09a656092801436f2663affb6
MD5 f37a6ca88034555ec5920363f1ea9f55
SHA1 ca663c5c452710e40a20aee8c68e3ba65af4852e
SHA512 c3b09ddffb3aa926168b25e8c86326276adf0a5257157bbd72bd4e56eebbad90d7712853643045f44be3b9ddeea5686128b43c00ce3f2ad5a813db0f36631d79
SSDEEP 6144:gflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:gflfAsiVGjSGecvX
TLSH
T1C8747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5920	omgerojgbztrljeb.exe
4868	omgerojgbztrljeb.sys
4796	CreateProcess.exe
5220	gebwtomdwq.exe
3204	CreateProcess.exe
4452	CreateProcess.exe
5932	i_gebwtomdwq.exe
4868	dbvtolgeyw.sys
5056	CreateProcess.exe
5896	bytjdbvtnl.exe
464	CreateProcess.exe
5936	CreateProcess.exe
1196	i_bytjdbvtnl.exe
5524	wqoigaytql.sys
1084	CreateProcess.exe
5060	tnligaytql.exe
2996	CreateProcess.exe
2096	CreateProcess.exe
5540	i_tnligaytql.exe
580	lfdaysqnif.sys
1352	CreateProcess.exe
3164	lfdxvpnifa.exe
2424	CreateProcess.exe
3484	CreateProcess.exe
5320	i_lfdxvpnifa.exe
3380	ifaqkicaus.sys
3332	CreateProcess.exe
4272	usnkfcxusn.exe
5784	CreateProcess.exe
1020	CreateProcess.exe
5524	i_usnkfcxusn.exe
1840	spnhfzxvpn.sys
5080	CreateProcess.exe
1996	pfzxupnhfc.exe
4684	CreateProcess.exe
5480	CreateProcess.exe
1520	i_pfzxupnhfc.exe
3444	upnhfzxrpk.sys
1036	CreateProcess.exe
1108	urpkhczusm.exe
4592	CreateProcess.exe
1324	CreateProcess.exe
1544	i_urpkhczusm.exe
5104	cwupmgebzx.sys
2596	CreateProcess.exe
2924	wuomjhbzur.exe
4328	CreateProcess.exe
4564	CreateProcess.exe
4544	i_wuomjhbzur.exe
3864	hezwuomhez.sys
4364	CreateProcess.exe
2116	rojebwtomg.exe
4600	CreateProcess.exe
3452	CreateProcess.exe
3492	i_rojebwtomg.exe
4256	bwuomgeywq.sys
2248	CreateProcess.exe
2648	wtolgdbzwq.exe
4668	CreateProcess.exe
4624	CreateProcess.exe
760	i_wtolgdbzwq.exe
5384	qolgdbytql.sys
1820	CreateProcess.exe
5100	tqolgdyvqo.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3316_183623505\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3316_495860615\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3316_495860615\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usnkfcxusn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pfzxupnhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pfzxupnhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqkifvpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojebwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojebwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczurpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtolgdyvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlidaywqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqolgdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnifaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytjdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtolgdbzwq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgerojgbztrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnligaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpkhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwromgebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwromgebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gebwtomdwq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnligaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqolgdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczurpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtolgdyvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpkhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnifaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsqkifvpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usnkfcxusn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtolgdbzwq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gebwtomdwq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytjdbvtnl.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4872	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2612	ipconfig.exe
6012	ipconfig.exe
3364	ipconfig.exe
1272	ipconfig.exe
2868	ipconfig.exe
4960	ipconfig.exe
2748	ipconfig.exe
2240	ipconfig.exe
4512	ipconfig.exe
3512	ipconfig.exe
2100	ipconfig.exe
3556	ipconfig.exe
4776	ipconfig.exe
2492	ipconfig.exe
4220	ipconfig.exe
5532	ipconfig.exe
6028	ipconfig.exe
2328	ipconfig.exe
4936	ipconfig.exe
4256	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134344170860358952"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650287814-2715975232-1279715623-1000\{D866FC0E-0923-426C-9A85-9A7A0ADD82EA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5920	omgerojgbztrljeb.exe
5920	omgerojgbztrljeb.exe
5920	omgerojgbztrljeb.exe
5920	omgerojgbztrljeb.exe
5920	omgerojgbztrljeb.exe
5920	omgerojgbztrljeb.exe
5920	omgerojgbztrljeb.exe
5920	omgerojgbztrljeb.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5932	i_gebwtomdwq.exe
Token: SeDebugPrivilege	1196	i_bytjdbvtnl.exe
Token: SeDebugPrivilege	5540	i_tnligaytql.exe
Token: SeDebugPrivilege	5320	i_lfdxvpnifa.exe
Token: SeDebugPrivilege	5524	i_usnkfcxusn.exe
Token: SeDebugPrivilege	1520	i_pfzxupnhfc.exe
Token: SeDebugPrivilege	1544	i_urpkhczusm.exe
Token: SeDebugPrivilege	4544	i_wuomjhbzur.exe
Token: SeDebugPrivilege	3492	i_rojebwtomg.exe
Token: SeDebugPrivilege	760	i_wtolgdbzwq.exe
Token: SeDebugPrivilege	4928	i_tqolgdyvqo.exe
Token: SeDebugPrivilege	1856	i_sqkidavtnl.exe
Token: SeDebugPrivilege	5252	i_vpnifaxsqk.exe
Token: SeDebugPrivilege	4416	i_axsqkifvpk.exe
Token: SeDebugPrivilege	4184	i_fzxupnhfzx.exe
Token: SeDebugPrivilege	3964	i_hczurpjhcz.exe
Token: SeDebugPrivilege	1720	i_ezwromgebz.exe
Token: SeDebugPrivilege	5676	i_omgeywqojg.exe
Token: SeDebugPrivilege	5804	i_wtolgdyvto.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3316	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 5920	4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4712 wrote to memory of 4892	4712	2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 4892 wrote to memory of 3316	4892	iexplore.exe	91
PID 3316 wrote to memory of 5392	3316	msedge.exe	92
PID 3316 wrote to memory of 3464	3316	msedge.exe	94
PID 3316 wrote to memory of 4872	3316	msedge.exe	93
PID 3316 wrote to memory of 3464	3316	msedge.exe	94
PID 3316 wrote to memory of 3464	3316	msedge.exe	94
PID 3316 wrote to memory of 4416	3316	msedge.exe	96
PID 3316 wrote to memory of 5560	3316	msedge.exe	97
PID 3316 wrote to memory of 4416	3316	msedge.exe	96
PID 3316 wrote to memory of 4416	3316	msedge.exe	96
PID 3316 wrote to memory of 5560	3316	msedge.exe	97
PID 3316 wrote to memory of 5560	3316	msedge.exe	97
PID 3316 wrote to memory of 264	3316	msedge.exe	95
PID 3316 wrote to memory of 264	3316	msedge.exe	95
PID 3316 wrote to memory of 2976	3316	msedge.exe	99
PID 3316 wrote to memory of 4540	3316	msedge.exe	100
PID 3316 wrote to memory of 2976	3316	msedge.exe	99
PID 3316 wrote to memory of 2976	3316	msedge.exe	99
PID 3316 wrote to memory of 4540	3316	msedge.exe	100
PID 3316 wrote to memory of 4540	3316	msedge.exe	100
PID 3316 wrote to memory of 3452	3316	msedge.exe	101
PID 3316 wrote to memory of 3452	3316	msedge.exe	101
PID 3316 wrote to memory of 5916	3316	msedge.exe	105
PID 3316 wrote to memory of 5916	3316	msedge.exe	105
PID 3316 wrote to memory of 792	3316	msedge.exe	106
PID 3316 wrote to memory of 792	3316	msedge.exe	106
PID 3316 wrote to memory of 6000	3316	msedge.exe	108
PID 5920 wrote to memory of 4796	5920	omgerojgbztrljeb.exe	109
PID 3316 wrote to memory of 4300	3316	msedge.exe	111
PID 3316 wrote to memory of 4300	3316	msedge.exe	111
PID 5220 wrote to memory of 3204	5220	gebwtomdwq.exe	114
PID 3316 wrote to memory of 3492	3316	msedge.exe	118
PID 3316 wrote to memory of 3492	3316	msedge.exe	118
PID 5920 wrote to memory of 4452	5920	omgerojgbztrljeb.exe	119
PID 5920 wrote to memory of 5056	5920	omgerojgbztrljeb.exe	123
PID 5896 wrote to memory of 464	5896	bytjdbvtnl.exe	125
PID 5920 wrote to memory of 5936	5920	omgerojgbztrljeb.exe	128
PID 5920 wrote to memory of 1084	5920	omgerojgbztrljeb.exe	132
PID 5060 wrote to memory of 2996	5060	tnligaytql.exe	134
PID 5920 wrote to memory of 2096	5920	omgerojgbztrljeb.exe	137
PID 5920 wrote to memory of 1352	5920	omgerojgbztrljeb.exe	142
PID 3164 wrote to memory of 2424	3164	lfdxvpnifa.exe	144
PID 5920 wrote to memory of 3484	5920	omgerojgbztrljeb.exe	147
PID 3316 wrote to memory of 4328	3316	msedge.exe	149
PID 3316 wrote to memory of 4456	3316	msedge.exe	150
PID 3316 wrote to memory of 4504	3316	msedge.exe	151
PID 5920 wrote to memory of 3332	5920	omgerojgbztrljeb.exe	154
PID 4272 wrote to memory of 5784	4272	usnkfcxusn.exe	156
PID 5920 wrote to memory of 1020	5920	omgerojgbztrljeb.exe	159
PID 5920 wrote to memory of 5080	5920	omgerojgbztrljeb.exe	163
PID 1996 wrote to memory of 4684	1996	pfzxupnhfc.exe	165
PID 5920 wrote to memory of 5480	5920	omgerojgbztrljeb.exe	168
PID 5920 wrote to memory of 1036	5920	omgerojgbztrljeb.exe	172
PID 1108 wrote to memory of 4592	1108	urpkhczusm.exe	174
PID 5920 wrote to memory of 1324	5920	omgerojgbztrljeb.exe	177
PID 5920 wrote to memory of 2596	5920	omgerojgbztrljeb.exe	181
PID 2924 wrote to memory of 4328	2924	wuomjhbzur.exe	183
PID 5920 wrote to memory of 4564	5920	omgerojgbztrljeb.exe	186
PID 3316 wrote to memory of 1348	3316	msedge.exe	188
PID 3316 wrote to memory of 1348	3316	msedge.exe	188
PID 5920 wrote to memory of 4364	5920	omgerojgbztrljeb.exe	194
PID 2116 wrote to memory of 4600	2116	rojebwtomg.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-20_f37a6ca88034555ec5920363f1ea9f55_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Temp\omgerojgbztrljeb.exe
  C:\Temp\omgerojgbztrljeb.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gebwtomdwq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4796
  - - C:\Temp\gebwtomdwq.exe
      C:\Temp\gebwtomdwq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5220
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3204
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gebwtomdwq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4452
  - - C:\Temp\i_gebwtomdwq.exe
      C:\Temp\i_gebwtomdwq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bytjdbvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5056
  - - C:\Temp\bytjdbvtnl.exe
      C:\Temp\bytjdbvtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5896
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:464
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6012
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bytjdbvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5936
  - - C:\Temp\i_bytjdbvtnl.exe
      C:\Temp\i_bytjdbvtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnligaytql.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1084
  - - C:\Temp\tnligaytql.exe
      C:\Temp\tnligaytql.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5060
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2996
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnligaytql.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2096
  - - C:\Temp\i_tnligaytql.exe
      C:\Temp\i_tnligaytql.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdxvpnifa.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1352
  - - C:\Temp\lfdxvpnifa.exe
      C:\Temp\lfdxvpnifa.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3164
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2424
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdxvpnifa.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3484
  - - C:\Temp\i_lfdxvpnifa.exe
      C:\Temp\i_lfdxvpnifa.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usnkfcxusn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3332
  - - C:\Temp\usnkfcxusn.exe
      C:\Temp\usnkfcxusn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4272
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5784
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usnkfcxusn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1020
  - - C:\Temp\i_usnkfcxusn.exe
      C:\Temp\i_usnkfcxusn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pfzxupnhfc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5080
  - - C:\Temp\pfzxupnhfc.exe
      C:\Temp\pfzxupnhfc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1996
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pfzxupnhfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5480
  - - C:\Temp\i_pfzxupnhfc.exe
      C:\Temp\i_pfzxupnhfc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urpkhczusm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1036
  - - C:\Temp\urpkhczusm.exe
      C:\Temp\urpkhczusm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4592
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urpkhczusm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1324
  - - C:\Temp\i_urpkhczusm.exe
      C:\Temp\i_urpkhczusm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomjhbzur.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2596
  - - C:\Temp\wuomjhbzur.exe
      C:\Temp\wuomjhbzur.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2924
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4328
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomjhbzur.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4564
  - - C:\Temp\i_wuomjhbzur.exe
      C:\Temp\i_wuomjhbzur.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rojebwtomg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4364
  - - C:\Temp\rojebwtomg.exe
      C:\Temp\rojebwtomg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2116
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4600
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rojebwtomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3452
  - - C:\Temp\i_rojebwtomg.exe
      C:\Temp\i_rojebwtomg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtolgdbzwq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2248
  - - C:\Temp\wtolgdbzwq.exe
      C:\Temp\wtolgdbzwq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2648
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtolgdbzwq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4624
  - - C:\Temp\i_wtolgdbzwq.exe
      C:\Temp\i_wtolgdbzwq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqolgdyvqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1820
  - - C:\Temp\tqolgdyvqo.exe
      C:\Temp\tqolgdyvqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5100
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4196
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqolgdyvqo.exe ups_ins
    3⤵
    PID:2932
  - - C:\Temp\i_tqolgdyvqo.exe
      C:\Temp\i_tqolgdyvqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkidavtnl.exe ups_run
    3⤵
    PID:2616
  - - C:\Temp\sqkidavtnl.exe
      C:\Temp\sqkidavtnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2148
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2012
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkidavtnl.exe ups_ins
    3⤵
    PID:2024
  - - C:\Temp\i_sqkidavtnl.exe
      C:\Temp\i_sqkidavtnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnifaxsqk.exe ups_run
    3⤵
    PID:4868
  - - C:\Temp\vpnifaxsqk.exe
      C:\Temp\vpnifaxsqk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3788
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3680
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnifaxsqk.exe ups_ins
    3⤵
    PID:5488
  - - C:\Temp\i_vpnifaxsqk.exe
      C:\Temp\i_vpnifaxsqk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axsqkifvpk.exe ups_run
    3⤵
    PID:2560
  - - C:\Temp\axsqkifvpk.exe
      C:\Temp\axsqkifvpk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5884
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1532
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3556
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axsqkifvpk.exe ups_ins
    3⤵
    PID:2400
  - - C:\Temp\i_axsqkifvpk.exe
      C:\Temp\i_axsqkifvpk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxupnhfzx.exe ups_run
    3⤵
    PID:4804
  - - C:\Temp\fzxupnhfzx.exe
      C:\Temp\fzxupnhfzx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5992
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5792
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxupnhfzx.exe ups_ins
    3⤵
    PID:4636
  - - C:\Temp\i_fzxupnhfzx.exe
      C:\Temp\i_fzxupnhfzx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczurpjhcz.exe ups_run
    3⤵
    PID:4844
  - - C:\Temp\hczurpjhcz.exe
      C:\Temp\hczurpjhcz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1508
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1420
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczurpjhcz.exe ups_ins
    3⤵
    PID:3888
  - - C:\Temp\i_hczurpjhcz.exe
      C:\Temp\i_hczurpjhcz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezwromgebz.exe ups_run
    3⤵
    PID:2712
  - - C:\Temp\ezwromgebz.exe
      C:\Temp\ezwromgebz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5396
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5984
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezwromgebz.exe ups_ins
    3⤵
    PID:2112
  - - C:\Temp\i_ezwromgebz.exe
      C:\Temp\i_ezwromgebz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgeywqojg.exe ups_run
    3⤵
    PID:5672
  - - C:\Temp\omgeywqojg.exe
      C:\Temp\omgeywqojg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4644
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1392
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgeywqojg.exe ups_ins
    3⤵
    PID:4820
  - - C:\Temp\i_omgeywqojg.exe
      C:\Temp\i_omgeywqojg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtolgdyvto.exe ups_run
    3⤵
    PID:4544
  - - C:\Temp\wtolgdyvto.exe
      C:\Temp\wtolgdyvto.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3712
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:548
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtolgdyvto.exe ups_ins
    3⤵
    PID:2328
  - - C:\Temp\i_wtolgdyvto.exe
      C:\Temp\i_wtolgdyvto.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqlidaywqn.exe ups_run
    3⤵
    PID:2068
  - - C:\Temp\sqlidaywqn.exe
      C:\Temp\sqlidaywqn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4316
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2744
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2748
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffa0042c188,0x7ffa0042c194,0x7ffa0042c1a0
      4⤵
      PID:5392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,12161923481440124542,8790546909399660895,524288 --field-trial-handle=2336,i,1292084888278540377,6303080080200488060,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:11
      4⤵
      System Time Discovery
      PID:4872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,16550485112926558133,1635500543589861595,262144 --field-trial-handle=2336,i,1292084888278540377,6303080080200488060,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
      4⤵
      PID:3464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,7717661404431586576,13942460287130338600,524288 --field-trial-handle=2336,i,1292084888278540377,6303080080200488060,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:13
      4⤵
      PID:264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,2144206561286860637,8132879844885341540,2097152 --field-trial-handle=2336,i,1292084888278540377,6303080080200488060,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
      4⤵
      PID:4416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,2845230466070391238,15949469938994401856,2097152 --field-trial-handle=2336,i,1292084888278540377,6303080080200488060,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      PID:5560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,10627508312933773115,6455572199471070955,2097152 --field-trial-handle=2336,i,1292084888278540377,6303080080200488060,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
      4⤵
      PID:2976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,1249935704068276926,18275983739502120442,2097152 --field-trial-handle=2336,i,1292084888278540377,6303080080200488060,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:9
      4⤵
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3452,i,10772139362284506856,11070787787551865382,524288 --field-trial-handle=2336,i,1292084888278540377,6303080080200488060,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
      4⤵
      PID:3452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,876796123444717718,4307779948570667507,524288 --field-trial-handle=2336,i,1292084888278540377,6303080080200488060,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:5916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,844940402748313569,14325502547327095124,524288 --field-trial-handle=2336,i,1292084888278540377,6303080080200488060,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
      4⤵
      PID:792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,9138941734261498018,4719567368075656551,524288 --field-trial-handle=2336,i,1292084888278540377,6303080080200488060,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:2924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,9138941734261498018,4719567368075656551,524288 --field-trial-handle=2336,i,1292084888278540377,6303080080200488060,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:6000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,4348873398279076452,17940588763142713759,524288 --field-trial-handle=2336,i,1292084888278540377,6303080080200488060,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
      4⤵
      PID:4300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,10387879095966756170,7701503891974781793,524288 --field-trial-handle=2336,i,1292084888278540377,6303080080200488060,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
      4⤵
      PID:3492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,4751827805115189593,8917595394630026132,524288 --field-trial-handle=2336,i,1292084888278540377,6303080080200488060,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14
      4⤵
      PID:4328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,9828060283046945109,4254599143396408290,524288 --field-trial-handle=2336,i,1292084888278540377,6303080080200488060,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
      4⤵
      PID:4456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,1313340156338410691,11793105803203204456,524288 --field-trial-handle=2336,i,1292084888278540377,6303080080200488060,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
      4⤵
      PID:4504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,9655755337120695358,6050660195645431857,524288 --field-trial-handle=2336,i,1292084888278540377,6303080080200488060,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
      4⤵
      PID:1348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,4275222136970235458,10337421837060914997,524288 --field-trial-handle=2336,i,1292084888278540377,6303080080200488060,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
      4⤵
      PID:4864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6228,i,4365137230784711681,13629039827787317775,262144 --field-trial-handle=2336,i,1292084888278540377,6303080080200488060,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:10
      4⤵
      PID:3684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,17902545880229907354,10936074156045909905,524288 --field-trial-handle=2336,i,1292084888278540377,6303080080200488060,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
      4⤵
      PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5992

C:\Temp\omgerojgbztrljeb.sys
C:\Temp\omgerojgbztrljeb.sys
1⤵
- Executes dropped EXE
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2592

C:\Temp\dbvtolgeyw.sys
C:\Temp\dbvtolgeyw.sys
1⤵
- Executes dropped EXE
PID:4868

C:\Temp\wqoigaytql.sys
C:\Temp\wqoigaytql.sys
1⤵
- Executes dropped EXE
PID:5524

C:\Temp\lfdaysqnif.sys
C:\Temp\lfdaysqnif.sys
1⤵
- Executes dropped EXE
PID:580

C:\Temp\ifaqkicaus.sys
C:\Temp\ifaqkicaus.sys
1⤵
- Executes dropped EXE
PID:3380

C:\Temp\spnhfzxvpn.sys
C:\Temp\spnhfzxvpn.sys
1⤵
- Executes dropped EXE
PID:1840

C:\Temp\upnhfzxrpk.sys
C:\Temp\upnhfzxrpk.sys
1⤵
- Executes dropped EXE
PID:3444

C:\Temp\cwupmgebzx.sys
C:\Temp\cwupmgebzx.sys
1⤵
- Executes dropped EXE
PID:5104

C:\Temp\hezwuomhez.sys
C:\Temp\hezwuomhez.sys
1⤵
- Executes dropped EXE
PID:3864

C:\Temp\bwuomgeywq.sys
C:\Temp\bwuomgeywq.sys
1⤵
- Executes dropped EXE
PID:4256

C:\Temp\qolgdbytql.sys
C:\Temp\qolgdbytql.sys
1⤵
- Executes dropped EXE
PID:5384

C:\Temp\vqnlfdbvtn.sys
C:\Temp\vqnlfdbvtn.sys
1⤵
PID:5524

C:\Temp\idavsqcaxs.sys
C:\Temp\idavsqcaxs.sys
1⤵
PID:4956

C:\Temp\aysqkicaus.sys
C:\Temp\aysqkicaus.sys
1⤵
PID:5076

C:\Temp\zxupnkfczu.sys
C:\Temp\zxupnkfczu.sys
1⤵
PID:1196

C:\Temp\mhfzxrpjhb.sys
C:\Temp\mhfzxrpjhb.sys
1⤵
PID:4472

C:\Temp\mjecwurmke.sys
C:\Temp\mjecwurmke.sys
1⤵
PID:5176

C:\Temp\mgebztrojg.sys
C:\Temp\mgebztrojg.sys
1⤵
PID:4116

C:\Temp\trljdbvtol.sys
C:\Temp\trljdbvtol.sys
1⤵
PID:4540

C:\Temp\ysqolgdywq.sys
C:\Temp\ysqolgdywq.sys
1⤵
PID:1716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bytjdbvtnl.exe

Path C:\Temp\bytjdbvtnl.exe
Size 361KB
SHA256 945c73be7b68308ef00e39c66d53f3d71762cce08d0a7ae0bb21142025ae9b42
MD5 f61f586e679418f81c5f6b27f625e3f2
SHA1 f65eef23a8201d2852b1a60b50f02f9a7019c7b9
SHA512 ea36f966df2e41e2abc392c9480b50a0e4c793e55196205bb09f5eb9abd24ec255e62307f7ed23013c4841ca4ca4a55f336a22b6ab05d7ad4fac70c9f03513f9
SSDEEP 6144:MflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:MflfAsiVGjSGecvX
TLSH
T196747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtolgeyw.sys

Path C:\Temp\dbvtolgeyw.sys
Size 293KB
SHA256 31bb58fb8d9a6176d03e7fa6942c14f6244140c1c8a223ba86c9478b4c449b00
MD5 ba216ce5716b8131ec65e2fb3f883fda
SHA1 c063b34688d4d687b26eb446d2f476ac417fa066
SHA512 f31566e628a74acb342db32861f7f062f4c92156eeb9cf16e5ff79b49aa2617b4769c6104a8054f5197c3cb6c48720275ea8501e36a0bad96a294b3a31c6b32e
SSDEEP 3072:GtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:GIJjiJcbI03GBc3ucY5DCSj
TLSH
T162545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gebwtomdwq.exe

Path C:\Temp\gebwtomdwq.exe
Size 361KB
SHA256 36462e9e752e6cb27c6082ab5974c47b927e05b0b2b7479a202e45f58b0c4111
MD5 fd8b70d45f8c98a2ac2864d473b139a4
SHA1 18fc41ee8c09b4d9dd4a1934a03966019a7c88bf
SHA512 7885a90633cd243a812e810080dca4061225ea876b0738dcc039bcab5c132772b70f38d18346cfee7ed151f1b78e3c55901e6132d05300099a7c1ec3599b182e
SSDEEP 6144:9flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:9flfAsiVGjSGecvX
TLSH
T1C8747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bytjdbvtnl.exe

Path C:\Temp\i_bytjdbvtnl.exe
Size 361KB
SHA256 026981487414bed522299af2d3f47b9da4b23224d8fc6230350246d71505ee5f
MD5 d00423b57d6d17b3b73328a1793468b6
SHA1 aa6f82d62089669533c1470ad9f749933feb675b
SHA512 faf39ae4f68fdedee045f010f540c0d1dd7bfa69c732ea0a3c0e5fab67b19d6ee40028b7027d184dad7ab529148fc97b1e884932560b53128657049eeb2c0bb8
SSDEEP 6144:FflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:FflfAsiVGjSGecvX
TLSH
T185747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gebwtomdwq.exe

Path C:\Temp\i_gebwtomdwq.exe
Size 361KB
SHA256 be11ce88a20b3f089e83aa7715a84183bbb9a96ddac8b4d73f0a54e776b11f9f
MD5 2ccf428a6213efb4d3e8ca85a48adb5f
SHA1 d4045de3c5805584eed46829ad386f075fb1b560
SHA512 f57489c1b50e72778f1135aa9179193d677d8c5ed2618b1b81f02a9ba5d871683e405ed5947b6fb8576747862ae9b28af21688cf31312be2973cd49e8b591977
SSDEEP 6144:uflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:uflfAsiVGjSGecvX
TLSH
T1D7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdxvpnifa.exe

Path C:\Temp\i_lfdxvpnifa.exe
Size 361KB
SHA256 1f1aaefddf5afd84944c69b6cc691b0045ba7bfc0af2a30c206d5499bc97839c
MD5 4276de7d0803507f1d0b49060b918379
SHA1 9cf2e3a1f0e155004311d2dd39e1cb9724b38efc
SHA512 a51026eb66787ed73a511533d6bf58289975c47efba483628eea5fe9e6d938289d7b4b20e4c29479ad5b36e825b50ce0f1ea62de4838e4c325ca2be11db3c193
SSDEEP 6144:hflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:hflfAsiVGjSGecvX
TLSH
T153747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnligaytql.exe

Path C:\Temp\i_tnligaytql.exe
Size 361KB
SHA256 5302ab0de6868afdbc1978d095712103cce111930de05a49b52808c3ac87744e
MD5 2c7ac7e248f3efbe7b0ea1a658ff1556
SHA1 a9410a838e2c32d02b9fee33ef22578f227d020f
SHA512 8503bca0b01cfdb4999b05acb03e0b86ababae1715d474ee9e57ff680ce53aba34d6f81c580042b90830f99db5378808913a5c482ebab0cbad9c9dffd2ecac55
SSDEEP 6144:aflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:aflfAsiVGjSGecvX
TLSH
T1EA747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usnkfcxusn.exe

Path C:\Temp\i_usnkfcxusn.exe
Size 361KB
SHA256 7d5e18cc3b52b95338d1aaa7720922e36a4bae27552f68fa7156f0ab5f4d5ecf
MD5 6b2a26926cf5e81813ad4b28f13572e6
SHA1 396010e53679a96eeb776c299db8cb29c8d23357
SHA512 8578164d67c1e4e64488751ef13acf0af348e9bd71420e1394ee08550632addc597bf78753717ea1f0e8a24cf012a7f3a6988316be089aa88af7e70a2138e673
SSDEEP 6144:kflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:kflfAsiVGjSGecvX
TLSH
T190747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaqkicaus.sys

Path C:\Temp\ifaqkicaus.sys
Size 293KB
SHA256 d69c5b1086a3a22e839b3009350b12a94d8a4e2839d19fe01092474637fc80ec
MD5 ae21baea830c37985f7caf18d84dce53
SHA1 223ebcf8e3677cc5c7c4a291e8cb1605b5514f8b
SHA512 a402b5b091b105f62f6228fe303139ae997a3343a57271fc46bfb03d4f5c668202e7fb390281b2ffde95a04d8c656b6ab1bb6cc42745c8eed08208968b286612
SSDEEP 3072:6tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:6IJjiJcbI03GBc3ucY5DCSj
TLSH
T13E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdaysqnif.sys

Path C:\Temp\lfdaysqnif.sys
Size 293KB
SHA256 b9584733f381f22cbc37b211b3ced06a9eaa31a7711af3dc8e63d6f615cc4559
MD5 9a695ab9e0623047b6000b43a0a8c928
SHA1 4a3f031f9aefe7f9b92bf6591515f18c4121d282
SHA512 4a33aba77fbacb64f6847534564a4346355f87250367e8021ee7b426a995f1b5e0fdb78a9af9ddef16c5a6d44382d665f7f1c94b8298d3547aa5e73d41b30b35
SSDEEP 3072:2tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:2IJjiJcbI03GBc3ucY5DCSj
TLSH
T1D5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvpnifa.exe

Path C:\Temp\lfdxvpnifa.exe
Size 361KB
SHA256 974107762109c96894ed9ee2b1b771741de4ec059f8680ef758a2f62d049120b
MD5 a5b8a42b562d73cced506371d9aa265e
SHA1 088d3af2e0dc0fb6c6b50d10a8859804a3aabf44
SHA512 849b34c28d423e2743dcee8254ecf963d644867797fe1043609f3c4cb59754ae498a95857830073e8f5b9d203e11064a0df474c6cbf1f7095ae9fc8b85957601
SSDEEP 6144:qflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:qflfAsiVGjSGecvX
TLSH
T159747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgerojgbztrljeb.exe

Path C:\Temp\omgerojgbztrljeb.exe
Size 361KB
SHA256 050b5dc8b5d8a21facda2cb113efbc9e445c2951d0a8d160e68c85aee0ba3dea
MD5 01bae196f673ec72201481cfdb3c2742
SHA1 802a403565485f93f43237b77c2978bb45187bad
SHA512 c91c2a1e40df9eabe2ed9f134c2052e870e0311f0207a3ba9d4dd0b5c0738d3e82cd331cb1b47c95a0ca1246be349fb0c351dc6841d9a256deca89e37eff74cb
SSDEEP 6144:7flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:7flfAsiVGjSGecvX
TLSH
T1FE747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgerojgbztrljeb.sys

Path C:\Temp\omgerojgbztrljeb.sys
Size 293KB
SHA256 8959842e60da754e007dc46a491cc30ffac73b58d333fce8519121a1f79353c0
MD5 e69ebcc8dde69c0c79c0e2a5d27da360
SHA1 a4a643a31dfe57b259555c54a6d9d1ac06a449f7
SHA512 927ae26732fa731a3fd68fedb59ebd2387e3a973e5759f8371f24f680ee65bbd2a3de014640386288156304aa0a16148786e7c54e6cee8f885cca0fdfb74eb50
SSDEEP 3072:JtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:JIJjiJcbI03GBc3ucY5DCSj
TLSH
T191545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pfzxupnhfc.exe

Path C:\Temp\pfzxupnhfc.exe
Size 361KB
SHA256 f25f44fcce10b7f616e3c74607c253d82c857837839a5001371d328e7407dd27
MD5 b8f0f932acc4b5716f57698183530e36
SHA1 d7626a71334c80a84bed747727d4f197c55c40b2
SHA512 e599d4ea23dc3ed5e384ee37d97e75914d498c9a8eefb1a02e890cef09e34d6d50d8dbd1e67445db60a954638a006a2a041083511325947cfd2d26ff9306e0a0
SSDEEP 6144:uflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:uflfAsiVGjSGecvX
TLSH
T19C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spnhfzxvpn.sys

Path C:\Temp\spnhfzxvpn.sys
Size 293KB
SHA256 e38768800edf8e0967a5353c8403a6482fff3aa99f9ad6f7521a0852738a2b44
MD5 5ab318389a754c63257a910547fa3f7d
SHA1 e45cbfb9d96ade990eb16b8192ba4aa7371b5f36
SHA512 8b600477a443f1376cef43dd7eca66c5550546dc376788fe4da6311ce40ff2b078c05b5ca6486cfacf316184b0e628a671ab160066b4ef52288e366670926be8
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T15D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnligaytql.exe

Path C:\Temp\tnligaytql.exe
Size 361KB
SHA256 7ba6d79f24ba04b9714f0896b4b674e22baa24e8b13e3ee7fcb532842dff6fbb
MD5 cadb75596d7632add3460b4757177d8f
SHA1 628b9c07f9b0d5c642e3ee995d63a9644eea6357
SHA512 5ea23aaa0a1141f003a2da4a1dcb2264943f9707982e58b89d3a214d3af33806ae904bb4f108139d74c2e4d65ae4ab445da0838f98e54a00e09bae82e9fe828d
SSDEEP 6144:OflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:OflfAsiVGjSGecvX
TLSH
T175747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usnkfcxusn.exe

Path C:\Temp\usnkfcxusn.exe
Size 361KB
SHA256 a1b76a056a954292e4062742359f7f5027a4fc422db032c73b49bb2df01ea5a2
MD5 8c448d802e9a45a4f1e910a92ff58b00
SHA1 154c7566bf2e2b014afe3f7d973753042ce3b247
SHA512 0cd49db990aa622adf91efe89d9c20d59603aeb2becd6a9ef7dcbecc334d6503c4f70d82ec7f2d851035af9284d27d86716afca7a4042c34fcf9f10ff0d389da
SSDEEP 6144:lflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:lflfAsiVGjSGecvX
TLSH
T103747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqoigaytql.sys

Path C:\Temp\wqoigaytql.sys
Size 293KB
SHA256 fd34fa94ef3cb20f7a52db5e0d65a4f6c0ccc03317aa1e144fd5f2a43f51ac7e
MD5 932de44a1cdac9f4adde78757c57a4fc
SHA1 48a3c3c47e705cd7da413fbfc4426afef9b8d1fd
SHA512 343cbc7268fa6f90277abdd11464a05276d266de2a9f047fa6b475cd24ad1d4a4f60c2a9258ef3458986d619b431b0b879530623484c3e33e566322ce3516b54
SSDEEP 3072:GtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:GIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6ff73de37e74e04bc32af0dd2dd926bcd2d6c623deb8eb066c65071254002178
MD5 a569aede49695d8fc8b039ab7024fd75
SHA1 de14644ea578b78d3cd08753552602517297fd30
SHA512 b87c4dc8e3e3be51d402a4d2d6166ca389ae05ea059903425483e2dcc38b0f2394d29a7a81921700d62e2a403e94a7b3e6c02c186966742a945996df580c0065
TLSH
T18FD02B71EFBB6C03D184207C100282C01610FC406B6902C4170041B4042C5444313201
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e0217c0f2953c25b5ecacbfc82728d57c809cf5450e9203a48d2faaff8836c2b
MD5 04b3b3f543557524e135a08dac44efda
SHA1 4f856c66c17971828ff8fd245186ea6b1b303bc7
SHA512 a11f6ce9f676e6157f7d9b86de7e7c3f0b7758052de5b00121c54342e363951818cf7787ed1baf39e636241455a76f6b90dc0405f5eaf0361a7c1056c3560c1a
TLSH
T1F5D02B71EFBB6C03D184207C100182C01620FC40BF6902C4170001A4042C5444313205
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c8080adf36d0f99d7215cb4a51dcd8f0b34c3fa0f0d54634e58ed19ba2ea9582
MD5 58899fb1a3292417c309503848a40580
SHA1 e0fc83225d8c91e86e579a1180de72913589a346
SHA512 cc915c3647961f924f8fd5002c465d6a96418a1ed36f524401d5128d9951fe399f468ad0b00f9510e702d1420835da4816ffd11307c46777ba755ff0fdd0f382
TLSH
T144616EB31EBF7252FB95013A9ED14C97363A5A8117AB1D9337F8F4F4E84232A418606C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a752.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a752.TMP
Size 3KB
SHA256 2da3e1af9b5145d6014602a1478c4f2edb09862649545a3e6a43e68e80c13d64
MD5 4a705ba8f6fb2ba7ee2f4c6ee95763b0
SHA1 71171ad6aa99c81229209e4fe6fc30cfbd60b74a
SHA512 edc20b22dc5fa592e1ef468df66dbb27df6e2e127c89abbb99cd53ebe1cc208211103e514b4b0e20a62c83ae045f7558fab9895e0356296ee6339a0ee0551a8b
TLSH
T1E0616FB31EBF7252FB9401399ED14C9736395A81176B2D9337F8E4F4E84232A418602C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 37429bfe94b7a049cc1a7438542440eb2f6efe134602fb78904809107ad17292
MD5 a898f346cdec5a1d3cfa3c6f376b9b4e
SHA1 16ad11018d410817e8dc7f2b8cab31fac951eafc
SHA512 6f488270b5292a8d030cb180b10ef0ae6d43300b43767c903d4fa966335fab64b869e269115aa5de1144a9260d18850711e2fee390c8ef60d6f0aa697defe832
TLSH
T19C41ACF7C3E8866E8A0256F0AB187E2BCE1D0915432C3D5AC9E4AF2B93F2471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 07f67b7576dc5f43b27393bd515c7b371bee7d7df9c33b36acb6dbb9d66c6bed
MD5 f958358dfb001647de8d2a73763ce2ab
SHA1 fbbf9d64a8eebb0c99013f0b331960d29705c888
SHA512 92141ec0d7f8a5731176f35b1244af79f5615790892aa17f2ca5111c826b97dcca7aa78aff357b62dcebca64a6cc78b9eb50891096f643db506dcd0f4b9bb15a
SSDEEP 192:sxRgRdCZ/fG+suKWNZ5TxxzoA8p9i/g6+WNChX/YFxfGlIgDTJ:sxRguZ/fNs2jtxs8/5g/RZ
TLSH
T19032C819AD28B93B4CC7D21DFB65BF53E6F91032A1951F48A6FC8A1C15E66DD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 fd13bc91fd18f2c6a5a86ee76a158507b986db44af263e92e1e36dc43c47c62e
MD5 2b112cb90254ff1172661741c00c34b4
SHA1 2690114d6316876f879b9a523be93283affbe73a
SHA512 423b37926ab7c30b24d98e5493bd6dd1b424362adee15995676d085189a65faf13f72040348ae55ad69da23ba4a5f4233656c75a3aae2305affff126d1d830cb
SSDEEP 192:sxRgRdCZ/fG+subWNZ5TxxzoA8p9i/g6+WNChX/YFSfGlIgDZJ:sxRguZ/fNs7jtxs8/5g/I3
TLSH
T17542C819AD28A93B4CC7E21DFB65BF53E6F91032A1951F48A6FCCA1C15E66DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 672038fe4a436317e334892c5ef6c318ee607aa78e0c191b5eabe1da2152e4dc
MD5 0867798f3821a254905824de15ffbe09
SHA1 44ad31b65ee8c004dd3f89e08b528bf9b053e455
SHA512 6bd4346aeafa40c7ac58df32ffb3306f065154745ca668c44e79b7416e98afd368dbc9141ed25b2af4de20bfcc3ea35704aeaab043b5269bcaaf931dd7e97eba
SSDEEP 192:sxRDRdCZ/fG+sqKWNZ5TxxzoA8p9i/g6+WNChX/YFxfGlIgtJ:sxRDuZ/fNsKjtxs8/5g/R3
TLSH
T18F32C819AD28B93B4CC7D20DFB65BF53E6F91032A1951F48AAFC8A1C15E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 23cc799e645362d40599a1d702a126b5902b848dc817a17a57791fcec24e4511
MD5 d68b85201369a10d5cb0ffe6dc55df7d
SHA1 0f3860eee8313364150a0ca62e33a76e2d01358e
SHA512 e93c6b9b7bee4c5e0f772cbf0d9123bf6b0569fe0fb33f1c35143dfe78b88c64907b1db173c8bea21668649269896c9219d770e99bd8063120ffd02af15e3727
SSDEEP 768:+l2PZq7pLuLbDKWgwef4e8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4JI0a08ro+Pq:+l2PZCEbDKWgwef4eu1jafJIh0n+q
TLSH
T17CD2F97B640CCA7F4F904ADDEC297A8F6DA802CB9698C94047FA941D03C67EB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4955acb3-cd4f-413c-b38c-11fbdf2192dc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4955acb3-cd4f-413c-b38c-11fbdf2192dc.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 55caaecc03f20224f54b936b46549c9ed0fcf0466fe5b1399a7a706bfd45d0c2
MD5 ec33d2e22200a833270b336ab55264a0
SHA1 3afa33dade008d13059e1e902b5677b7f582fccc
SHA512 dc99c3d303c2b8af3351b3134260a1bd4a4444982d64f2532b101515d0e2ca9d5448cfb53edfbcfbb09112f0cd5c88d99484dd573d3df7cd36bf1b56cd5a876a
SSDEEP 768:p/UxvxjgC+k3DEf9cH7AyEMbxyJugQVTJ7vvmev9SHtBk:cZj3+k3SwAyEmxyJJq17vvSbk
TLSH
T1C203D035ACA59C3388F792843649E787EFF406A394C62BA485DD6F0E128B3AC5307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 48b96bb4b26be162b8bf6ac4eded4181eb52ecaa27a809b8c4a4ae5ba60e5f18
MD5 ac504791ec944c6faf21cfa8a9393063
SHA1 396a5d2349fa626d75579f9b3bd2020c6a4d6d25
SHA512 18ce0a775763252f7c0a075e9a03e72c3ab6a03f6259774cd0ae0b4c8d3134ea9c3239821eff9312ab3e99f5555e18b6886bf2fe61997f0e7171938061666dd4
SSDEEP 768:C/UxvxjgC+l3ouf9cH7CNkyEMbxyJugQVTJ7vvmeXcoM8:HZj3+l37wmkyEmxyJJq17vKoM8
TLSH
T16303BF35AC769C3399F692807249E7C3EFE406B354C61E68C8D95F0E05873AD174781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 1c1680fa2b8bf9fa2ed4dbfc203c8fba8bfa5cedfa8cdb40b42f7c8c1a8df18d
MD5 e0282ac1ec84d494ee84a0408d559435
SHA1 675d63af23a274e086a722718ae6bb96fd858a15
SHA512 5388aeefa6aa0b1d20f241d0109a0889ae1d3eeb8bc7515c9b67fddf293d1eed053be8a1ae7d468174eb437ee3e8b2beb581170b4bb33f574e1b26c586f286f8
SSDEEP 768:pM3vuf9cH7CNZyEMbxyJugQVTJ7vvmeXccTRkn:pM34wmZyEmxyJJq17vKcTRkn
TLSH
T147F2BE719CB6CC7359FA8285B645BAC3AFE402A348C60F54D4DD9B1E0587BAD170B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 3a86036d114e2b15162bd61feca08521372631a584dc6b2b84504c191cfafc61
MD5 58662436202d721ccdc2ffd5464b71e5
SHA1 3ccd74d8d3b498c747a6ad30dba469deb79fa883
SHA512 2833127f8ae29a770489d274fdcab08e26aaf6dfd63a43c4c68e788c17244e37d93b3231519571d7fcb8a6c004e14ffac9b931397302daa1b77a740fc64b1586
SSDEEP 768:eFQp3JwgvVAi9cH7CNdyEMbxyJugQVTJ7vvmeXccTRkn:1p3JwmdyEmxyJJq17vKcTRkn
TLSH
T12C1318F588E78976D9AE4383673CAE829EFCC16374895980B7C95E0DCC865BFC706805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 b50bdbda7c169de4f6b4283a197b0808da7105bc58d20d798e66a57894554efe
MD5 4132640475ad8f26828f89fbf2481e7f
SHA1 6011d4e6b228b65e4b713f71899a1a44e1d72ff0
SHA512 fb6ce5e08918d45ee1f126defb31954392697526b368cbe67cd322a07e4f7bda28d40a1434fb5d87f4561002f1c9b8b75fbdafe71ce41f08d87604e1cfe125a2
SSDEEP 768:CM3yuf9cH7CNZyEMbxyJugQVTJ7vvmeXccTRkn:CM3lwmZyEmxyJJq17vKcTRkn
TLSH
T1ADF2BE719CB6CC7349FA8285B645BBC3AFE402A348C60F54D4DDAB1E0587BAD170B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

193a940d-113c-4717-a44e-8a158181bd4e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\193a940d-113c-4717-a44e-8a158181bd4e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3316_1989847527\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 415497f8d611991d7649a6978257248d99fe0332f338aa212c023d352cf4be45
MD5 5507c85d0b5d8d6598f4e4a151efc2ba
SHA1 19469fa0d95bfc5233ce7aac1fafdd43f5327907
SHA512 162ff1d128645a1dc02c337687d332745649d51923374e31a5f2f49f60c584267fc70d865abd2071c7e04d897271fa6837f29b07de25479492d356066b71888a
TLSH
T19971238357B9C5B3C1DE5FF102835608F5FF22384B2330204BA16546AB30B7A24B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/580-263-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1196-415-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1716-459-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1840-287-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3380-275-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3444-312-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3864-331-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3864-353-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4116-428-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4256-335-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4472-419-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4540-439-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4868-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4868-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4956-387-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5076-395-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5104-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5176-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5384-374-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5384-361-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5524-235-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5524-373-0x0000000000010000-0x00000000000AB000-memory.dmp

Download