systex | b3204534aa91c043b2b1530d310fa61d9560e210d6ac595da8cec4099ba16820

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 06:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260930-hm8mlssv5n
SHA256 b3204534aa91c043b2b1530d310fa61d9560e210d6ac595da8cec4099ba16820
MD5 ed450817a1663f81ff488941078c47e5
SHA1 001dc3bb2ee6dee03569811b2a42d665b7968626
SHA512 1760d50fda1a20d5fb6c6f4934edacdd3d126b120a12e1b115b468e7f36b48b37b9daff86b7d8533c59eb65c2e56402d34bd6221612149eba58c8a0fc5f390c0
SSDEEP 6144:+flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:+flfAsiVGjSGecvX
TLSH
T172747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5604	vtolgeywqoigbywt.exe
4292	vtolgeywqoigbywt.sys
3000	CreateProcess.exe
1328	bywqlgdywq.exe
2652	CreateProcess.exe
4364	CreateProcess.exe
244	i_bywqlgdywq.exe
2328	ljgbytqljd.sys
4504	CreateProcess.exe
4284	aysqoigays.exe
2472	CreateProcess.exe
3380	CreateProcess.exe
5404	i_aysqoigays.exe
5180	gaysqkidav.sys
6140	CreateProcess.exe
3836	vsnlfdavsq.exe
2840	CreateProcess.exe
3496	CreateProcess.exe
1244	i_vsnlfdavsq.exe
2328	icankifaxv.sys
3800	CreateProcess.exe
4668	cxvsqnifzx.exe
5268	CreateProcess.exe
2464	CreateProcess.exe
1820	i_cxvsqnifzx.exe
5848	kfcxvpnhfz.sys
1980	CreateProcess.exe
4152	zxvpfzxspk.exe
2964	CreateProcess.exe
5380	CreateProcess.exe
4872	i_zxvpfzxspk.exe
3488	upnhfzxrpj.sys
4544	CreateProcess.exe
2076	pnheczurpj.exe
1340	CreateProcess.exe
3924	CreateProcess.exe
4640	i_pnheczurpj.exe
5916	rmjhezwuom.sys
2604	CreateProcess.exe
2548	rmjhbzurmk.exe
472	CreateProcess.exe
4940	CreateProcess.exe
4252	i_rmjhbzurmk.exe
2864	ecwuomgezw.sys
5612	CreateProcess.exe
2808	ywrojhbztr.exe
1376	CreateProcess.exe
1304	CreateProcess.exe
4880	i_ywrojhbztr.exe
4752	gbztrojgeb.sys
3196	CreateProcess.exe
1864	bztrljdbwt.exe
4768	CreateProcess.exe
4540	CreateProcess.exe
5916	i_bztrljdbwt.exe
4652	olgeywqoig.sys
3204	CreateProcess.exe
4480	lgdyvqoiga.exe
4596	CreateProcess.exe
4232	CreateProcess.exe
5052	i_lgdyvqoiga.exe
6128	daysqoigdy.sys
4068	CreateProcess.exe
3320	dxvqoigays.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_1253944561\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_1721984102\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_1451537534\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_662800134\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_1253944561\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_1253944561\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_1451537534\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_662800134\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_1253944561\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvsqnifzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjhbzurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvqoigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caxspnkics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtolgeywqoigbywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxvpfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywqlgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxvpfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvqoigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqoigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqoigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjhbzurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywrojhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmjhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqoigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnlfdavsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvsqnifzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnheczurpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caxspnkics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnlfdavsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywrojhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqoigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywqlgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmjhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgeboljge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgeboljge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnheczurpj.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6048	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4808	ipconfig.exe
1068	ipconfig.exe
3464	ipconfig.exe
5656	ipconfig.exe
5052	ipconfig.exe
3216	ipconfig.exe
3576	ipconfig.exe
5908	ipconfig.exe
5828	ipconfig.exe
2448	ipconfig.exe
6112	ipconfig.exe
6040	ipconfig.exe
4896	ipconfig.exe
1220	ipconfig.exe
4720	ipconfig.exe
2504	ipconfig.exe
2220	ipconfig.exe
4804	ipconfig.exe
1820	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-53044966-3830981193-2402648431-1000\{7E75A84E-C351-4A07-A303-A4AA3F9F1D71}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5604	vtolgeywqoigbywt.exe
5604	vtolgeywqoigbywt.exe
5604	vtolgeywqoigbywt.exe
5604	vtolgeywqoigbywt.exe
5604	vtolgeywqoigbywt.exe
5604	vtolgeywqoigbywt.exe
5604	vtolgeywqoigbywt.exe
5604	vtolgeywqoigbywt.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	244	i_bywqlgdywq.exe
Token: SeDebugPrivilege	5404	i_aysqoigays.exe
Token: SeDebugPrivilege	1244	i_vsnlfdavsq.exe
Token: SeDebugPrivilege	1820	i_cxvsqnifzx.exe
Token: SeDebugPrivilege	4872	i_zxvpfzxspk.exe
Token: SeDebugPrivilege	4640	i_pnheczurpj.exe
Token: SeDebugPrivilege	4252	i_rmjhbzurmk.exe
Token: SeDebugPrivilege	4880	i_ywrojhbztr.exe
Token: SeDebugPrivilege	5916	i_bztrljdbwt.exe
Token: SeDebugPrivilege	5052	i_lgdyvqoiga.exe
Token: SeDebugPrivilege	5804	i_dxvqoigays.exe
Token: SeDebugPrivilege	3176	i_icaysqkica.exe
Token: SeDebugPrivilege	4316	i_caxspnkics.exe
Token: SeDebugPrivilege	5324	i_pnhfzxrpkh.exe
Token: SeDebugPrivilege	4704	i_zurmjhecwu.exe
Token: SeDebugPrivilege	4548	i_trljebwuom.exe
Token: SeDebugPrivilege	4884	i_ojgeboljge.exe
Token: SeDebugPrivilege	4672	i_lgeywqoigb.exe
Token: SeDebugPrivilege	5944	i_dyvqoigays.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4956	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 5604	848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 848 wrote to memory of 3796	848	2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 3796 wrote to memory of 4956	3796	iexplore.exe	91
PID 4956 wrote to memory of 4324	4956	msedge.exe	92
PID 4956 wrote to memory of 3360	4956	msedge.exe	93
PID 4956 wrote to memory of 6048	4956	msedge.exe	94
PID 4956 wrote to memory of 3360	4956	msedge.exe	93
PID 4956 wrote to memory of 3360	4956	msedge.exe	93
PID 4956 wrote to memory of 2976	4956	msedge.exe	95
PID 4956 wrote to memory of 2976	4956	msedge.exe	95
PID 4956 wrote to memory of 1040	4956	msedge.exe	97
PID 4956 wrote to memory of 2908	4956	msedge.exe	98
PID 4956 wrote to memory of 1040	4956	msedge.exe	97
PID 4956 wrote to memory of 1040	4956	msedge.exe	97
PID 4956 wrote to memory of 2908	4956	msedge.exe	98
PID 4956 wrote to memory of 2908	4956	msedge.exe	98
PID 4956 wrote to memory of 4788	4956	msedge.exe	99
PID 4956 wrote to memory of 996	4956	msedge.exe	100
PID 4956 wrote to memory of 4788	4956	msedge.exe	99
PID 4956 wrote to memory of 4788	4956	msedge.exe	99
PID 4956 wrote to memory of 996	4956	msedge.exe	100
PID 4956 wrote to memory of 996	4956	msedge.exe	100
PID 4956 wrote to memory of 3792	4956	msedge.exe	101
PID 4956 wrote to memory of 3792	4956	msedge.exe	101
PID 5604 wrote to memory of 3000	5604	vtolgeywqoigbywt.exe	105
PID 4956 wrote to memory of 4276	4956	msedge.exe	106
PID 4956 wrote to memory of 2052	4956	msedge.exe	107
PID 4956 wrote to memory of 4276	4956	msedge.exe	106
PID 4956 wrote to memory of 2052	4956	msedge.exe	107
PID 4956 wrote to memory of 752	4956	msedge.exe	110
PID 1328 wrote to memory of 2652	1328	bywqlgdywq.exe	112
PID 4956 wrote to memory of 3580	4956	msedge.exe	115
PID 4956 wrote to memory of 3580	4956	msedge.exe	115
PID 4956 wrote to memory of 4496	4956	msedge.exe	118
PID 4956 wrote to memory of 4496	4956	msedge.exe	118
PID 5604 wrote to memory of 4364	5604	vtolgeywqoigbywt.exe	119
PID 5604 wrote to memory of 4504	5604	vtolgeywqoigbywt.exe	123
PID 4284 wrote to memory of 2472	4284	aysqoigays.exe	125
PID 5604 wrote to memory of 3380	5604	vtolgeywqoigbywt.exe	128
PID 5604 wrote to memory of 6140	5604	vtolgeywqoigbywt.exe	132
PID 3836 wrote to memory of 2840	3836	vsnlfdavsq.exe	134
PID 5604 wrote to memory of 3496	5604	vtolgeywqoigbywt.exe	137
PID 5604 wrote to memory of 3800	5604	vtolgeywqoigbywt.exe	142
PID 4668 wrote to memory of 5268	4668	cxvsqnifzx.exe	144
PID 5604 wrote to memory of 2464	5604	vtolgeywqoigbywt.exe	147
PID 4956 wrote to memory of 1376	4956	msedge.exe	149
PID 4956 wrote to memory of 3256	4956	msedge.exe	150
PID 4956 wrote to memory of 4812	4956	msedge.exe	151
PID 5604 wrote to memory of 1980	5604	vtolgeywqoigbywt.exe	154
PID 4152 wrote to memory of 2964	4152	zxvpfzxspk.exe	156
PID 5604 wrote to memory of 5380	5604	vtolgeywqoigbywt.exe	159
PID 5604 wrote to memory of 4544	5604	vtolgeywqoigbywt.exe	163
PID 2076 wrote to memory of 1340	2076	pnheczurpj.exe	165
PID 5604 wrote to memory of 3924	5604	vtolgeywqoigbywt.exe	168
PID 5604 wrote to memory of 2604	5604	vtolgeywqoigbywt.exe	172
PID 2548 wrote to memory of 472	2548	rmjhbzurmk.exe	174
PID 5604 wrote to memory of 4940	5604	vtolgeywqoigbywt.exe	177
PID 5604 wrote to memory of 5612	5604	vtolgeywqoigbywt.exe	181
PID 2808 wrote to memory of 1376	2808	ywrojhbztr.exe	183
PID 5604 wrote to memory of 1304	5604	vtolgeywqoigbywt.exe	186
PID 4956 wrote to memory of 4244	4956	msedge.exe	188
PID 4956 wrote to memory of 4244	4956	msedge.exe	188
PID 5604 wrote to memory of 3196	5604	vtolgeywqoigbywt.exe	194
PID 1864 wrote to memory of 4768	1864	bztrljdbwt.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_ed450817a1663f81ff488941078c47e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:848
- C:\Temp\vtolgeywqoigbywt.exe
  C:\Temp\vtolgeywqoigbywt.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywqlgdywq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3000
  - - C:\Temp\bywqlgdywq.exe
      C:\Temp\bywqlgdywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1328
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2652
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bywqlgdywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4364
  - - C:\Temp\i_bywqlgdywq.exe
      C:\Temp\i_bywqlgdywq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqoigays.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4504
  - - C:\Temp\aysqoigays.exe
      C:\Temp\aysqoigays.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4284
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2472
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqoigays.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3380
  - - C:\Temp\i_aysqoigays.exe
      C:\Temp\i_aysqoigays.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsnlfdavsq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6140
  - - C:\Temp\vsnlfdavsq.exe
      C:\Temp\vsnlfdavsq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3836
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsnlfdavsq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3496
  - - C:\Temp\i_vsnlfdavsq.exe
      C:\Temp\i_vsnlfdavsq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxvsqnifzx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3800
  - - C:\Temp\cxvsqnifzx.exe
      C:\Temp\cxvsqnifzx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4668
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5268
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxvsqnifzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2464
  - - C:\Temp\i_cxvsqnifzx.exe
      C:\Temp\i_cxvsqnifzx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxvpfzxspk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1980
  - - C:\Temp\zxvpfzxspk.exe
      C:\Temp\zxvpfzxspk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4152
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2964
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxvpfzxspk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5380
  - - C:\Temp\i_zxvpfzxspk.exe
      C:\Temp\i_zxvpfzxspk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnheczurpj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4544
  - - C:\Temp\pnheczurpj.exe
      C:\Temp\pnheczurpj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1340
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnheczurpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3924
  - - C:\Temp\i_pnheczurpj.exe
      C:\Temp\i_pnheczurpj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmjhbzurmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2604
  - - C:\Temp\rmjhbzurmk.exe
      C:\Temp\rmjhbzurmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2548
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:472
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmjhbzurmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4940
  - - C:\Temp\i_rmjhbzurmk.exe
      C:\Temp\i_rmjhbzurmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywrojhbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5612
  - - C:\Temp\ywrojhbztr.exe
      C:\Temp\ywrojhbztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2808
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1376
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywrojhbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1304
  - - C:\Temp\i_ywrojhbztr.exe
      C:\Temp\i_ywrojhbztr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrljdbwt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3196
  - - C:\Temp\bztrljdbwt.exe
      C:\Temp\bztrljdbwt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4768
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrljdbwt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4540
  - - C:\Temp\i_bztrljdbwt.exe
      C:\Temp\i_bztrljdbwt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdyvqoiga.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3204
  - - C:\Temp\lgdyvqoiga.exe
      C:\Temp\lgdyvqoiga.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4480
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4596
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgdyvqoiga.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4232
  - - C:\Temp\i_lgdyvqoiga.exe
      C:\Temp\i_lgdyvqoiga.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvqoigays.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4068
  - - C:\Temp\dxvqoigays.exe
      C:\Temp\dxvqoigays.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3320
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1740
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvqoigays.exe ups_ins
    3⤵
    PID:4344
  - - C:\Temp\i_dxvqoigays.exe
      C:\Temp\i_dxvqoigays.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icaysqkica.exe ups_run
    3⤵
    PID:2872
  - - C:\Temp\icaysqkica.exe
      C:\Temp\icaysqkica.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4636
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3076
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icaysqkica.exe ups_ins
    3⤵
    PID:3904
  - - C:\Temp\i_icaysqkica.exe
      C:\Temp\i_icaysqkica.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\caxspnkics.exe ups_run
    3⤵
    PID:4372
  - - C:\Temp\caxspnkics.exe
      C:\Temp\caxspnkics.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1096
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4708
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_caxspnkics.exe ups_ins
    3⤵
    PID:4108
  - - C:\Temp\i_caxspnkics.exe
      C:\Temp\i_caxspnkics.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfzxrpkh.exe ups_run
    3⤵
    PID:4072
  - - C:\Temp\pnhfzxrpkh.exe
      C:\Temp\pnhfzxrpkh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3064
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4328
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfzxrpkh.exe ups_ins
    3⤵
    PID:3772
  - - C:\Temp\i_pnhfzxrpkh.exe
      C:\Temp\i_pnhfzxrpkh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zurmjhecwu.exe ups_run
    3⤵
    PID:5800
  - - C:\Temp\zurmjhecwu.exe
      C:\Temp\zurmjhecwu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4780
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1752
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zurmjhecwu.exe ups_ins
    3⤵
    PID:1440
  - - C:\Temp\i_zurmjhecwu.exe
      C:\Temp\i_zurmjhecwu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljebwuom.exe ups_run
    3⤵
    PID:4600
  - - C:\Temp\trljebwuom.exe
      C:\Temp\trljebwuom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5928
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2256
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljebwuom.exe ups_ins
    3⤵
    PID:2468
  - - C:\Temp\i_trljebwuom.exe
      C:\Temp\i_trljebwuom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ojgeboljge.exe ups_run
    3⤵
    PID:5648
  - - C:\Temp\ojgeboljge.exe
      C:\Temp\ojgeboljge.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5456
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1116
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ojgeboljge.exe ups_ins
    3⤵
    PID:4180
  - - C:\Temp\i_ojgeboljge.exe
      C:\Temp\i_ojgeboljge.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgeywqoigb.exe ups_run
    3⤵
    PID:5780
  - - C:\Temp\lgeywqoigb.exe
      C:\Temp\lgeywqoigb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4912
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:624
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgeywqoigb.exe ups_ins
    3⤵
    PID:6088
  - - C:\Temp\i_lgeywqoigb.exe
      C:\Temp\i_lgeywqoigb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dyvqoigays.exe ups_run
    3⤵
    PID:4104
  - - C:\Temp\dyvqoigays.exe
      C:\Temp\dyvqoigays.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1744
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:260
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dyvqoigays.exe ups_ins
    3⤵
    PID:5916
  - - C:\Temp\i_dyvqoigays.exe
      C:\Temp\i_dyvqoigays.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5944
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffa14bdc188,0x7ffa14bdc194,0x7ffa14bdc1a0
      4⤵
      PID:4324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,2574352535801225708,12978637797011024764,262144 --field-trial-handle=2948,i,3597953825641112153,2337913865727861481,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:2
      4⤵
      PID:3360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,15446740235166381121,9530404655245891593,524288 --field-trial-handle=2948,i,3597953825641112153,2337913865727861481,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:11
      4⤵
      System Time Discovery
      PID:6048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,12135615531700891015,7391210492233455240,524288 --field-trial-handle=2948,i,3597953825641112153,2337913865727861481,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:13
      4⤵
      PID:2976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,9920418127826120139,1232033616707540757,2097152 --field-trial-handle=2948,i,3597953825641112153,2337913865727861481,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
      4⤵
      PID:1040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,16581450032140412430,11763203564554984818,2097152 --field-trial-handle=2948,i,3597953825641112153,2337913865727861481,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
      4⤵
      PID:2908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4376,i,10929735890732348596,1190358941495567437,2097152 --field-trial-handle=2948,i,3597953825641112153,2337913865727861481,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:1
      4⤵
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4404,i,10890369079813548295,13177365532457963715,2097152 --field-trial-handle=2948,i,3597953825641112153,2337913865727861481,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:9
      4⤵
      PID:996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,12793841156870083809,7996584816767502961,524288 --field-trial-handle=2948,i,3597953825641112153,2337913865727861481,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
      4⤵
      PID:3792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3836,i,18329022432225102161,10703436461821282535,524288 --field-trial-handle=2948,i,3597953825641112153,2337913865727861481,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
      4⤵
      PID:4276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,3352600326568343605,1996639542707170605,524288 --field-trial-handle=2948,i,3597953825641112153,2337913865727861481,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:14
      4⤵
      PID:2052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,9319104451559172133,4764453040010394591,524288 --field-trial-handle=2948,i,3597953825641112153,2337913865727861481,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
      4⤵
      PID:4224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,9319104451559172133,4764453040010394591,524288 --field-trial-handle=2948,i,3597953825641112153,2337913865727861481,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
      4⤵
      PID:752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,2824191789737529807,8037201052455646987,524288 --field-trial-handle=2948,i,3597953825641112153,2337913865727861481,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
      4⤵
      PID:3580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,11876215689828227357,3191574866383840556,524288 --field-trial-handle=2948,i,3597953825641112153,2337913865727861481,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
      4⤵
      PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,15337577843391580910,8393354391491612116,524288 --field-trial-handle=2948,i,3597953825641112153,2337913865727861481,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:14
      4⤵
      PID:1376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,17878752134532451739,15951023392780132924,524288 --field-trial-handle=2948,i,3597953825641112153,2337913865727861481,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
      4⤵
      PID:3256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,9895721248255334694,11670377623242173510,524288 --field-trial-handle=2948,i,3597953825641112153,2337913865727861481,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:4812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,4729674147811087256,417791488820430286,524288 --field-trial-handle=2948,i,3597953825641112153,2337913865727861481,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
      4⤵
      PID:4244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,12642130495087892602,17468598870409148529,524288 --field-trial-handle=2948,i,3597953825641112153,2337913865727861481,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
      4⤵
      PID:4424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,9540087344737743729,2866331262918052688,524288 --field-trial-handle=2948,i,3597953825641112153,2337913865727861481,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
      4⤵
      PID:4224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,11266364338695873106,16398145722417604082,524288 --field-trial-handle=2948,i,3597953825641112153,2337913865727861481,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
      4⤵
      PID:4156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6616,i,4351513214573135727,1524811469153924553,262144 --field-trial-handle=2948,i,3597953825641112153,2337913865727861481,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:10
      4⤵
      PID:500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,1255103076399697340,1086588190866097232,524288 --field-trial-handle=2948,i,3597953825641112153,2337913865727861481,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
      4⤵
      PID:5768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4748

C:\Temp\vtolgeywqoigbywt.sys
C:\Temp\vtolgeywqoigbywt.sys
1⤵
- Executes dropped EXE
PID:4292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4748

C:\Temp\ljgbytqljd.sys
C:\Temp\ljgbytqljd.sys
1⤵
- Executes dropped EXE
PID:2328

C:\Temp\gaysqkidav.sys
C:\Temp\gaysqkidav.sys
1⤵
- Executes dropped EXE
PID:5180

C:\Temp\icankifaxv.sys
C:\Temp\icankifaxv.sys
1⤵
- Executes dropped EXE
PID:2328

C:\Temp\kfcxvpnhfz.sys
C:\Temp\kfcxvpnhfz.sys
1⤵
- Executes dropped EXE
PID:5848

C:\Temp\upnhfzxrpj.sys
C:\Temp\upnhfzxrpj.sys
1⤵
- Executes dropped EXE
PID:3488

C:\Temp\rmjhezwuom.sys
C:\Temp\rmjhezwuom.sys
1⤵
- Executes dropped EXE
PID:5916

C:\Temp\ecwuomgezw.sys
C:\Temp\ecwuomgezw.sys
1⤵
- Executes dropped EXE
PID:2864

C:\Temp\gbztrojgeb.sys
C:\Temp\gbztrojgeb.sys
1⤵
- Executes dropped EXE
PID:4752

C:\Temp\olgeywqoig.sys
C:\Temp\olgeywqoig.sys
1⤵
- Executes dropped EXE
PID:4652

C:\Temp\daysqoigdy.sys
C:\Temp\daysqoigdy.sys
1⤵
- Executes dropped EXE
PID:6128

C:\Temp\aysqkidavt.sys
C:\Temp\aysqkidavt.sys
1⤵
PID:3120

C:\Temp\faxspnkfca.sys
C:\Temp\faxspnkfca.sys
1⤵
PID:4684

C:\Temp\smkfcxupnh.sys
C:\Temp\smkfcxupnh.sys
1⤵
PID:980

C:\Temp\rpmkebzurp.sys
C:\Temp\rpmkebzurp.sys
1⤵
PID:6088

C:\Temp\ezwrpjztrm.sys
C:\Temp\ezwrpjztrm.sys
1⤵
PID:5980

C:\Temp\uomgeywuol.sys
C:\Temp\uomgeywuol.sys
1⤵
PID:5992

C:\Temp\ligebwtomg.sys
C:\Temp\ligebwtomg.sys
1⤵
PID:3200

C:\Temp\dbysqligay.sys
C:\Temp\dbysqligay.sys
1⤵
PID:6076

C:\Temp\gdbvtqoigs.sys
C:\Temp\gdbvtqoigs.sys
1⤵
PID:1280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aysqoigays.exe

Path C:\Temp\aysqoigays.exe
Size 361KB
SHA256 7479423fb47ee39b893221f91718a24712f798e2ad8e7357c761d09cd47c7f14
MD5 d5d83866dd864738f2f07ef055116150
SHA1 3d80c7439c4bbfde78df0a512d4cd973bf379555
SHA512 364f5004f0eca5483852addb4ed614beeaf8bc3b8d88a224c594d2f23b450fb2fc4066c49160e1426ed3096bb74b001dc87b546ef451e022de68db7ab8f738fa
SSDEEP 6144:vflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:vflfAsiVGjSGecvX
TLSH
T1E5747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bywqlgdywq.exe

Path C:\Temp\bywqlgdywq.exe
Size 361KB
SHA256 a2c66d68b7441d38ca4dfc7438ef2eea406e17ae3a7eb344ff93420c1a549b4c
MD5 40666e3a395ef3def2f7ff3e58862b34
SHA1 2d3ab53bcb94e60cf682321626a7d4e00e0ad1d2
SHA512 33d7d648398bf60eb5756f3588cc29e2f1e8214980c42c4ce57c78a7fd9f2f027084ff307ddde48eb2588c33c0890549430c8655f772cec0fddae351d0b17d6b
SSDEEP 6144:DflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:DflfAsiVGjSGecvX
TLSH
T1B5747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxvsqnifzx.exe

Path C:\Temp\cxvsqnifzx.exe
Size 361KB
SHA256 23adfb790338e7be96c77e033a46245de73def0eb300ebe42e3ced9de68cf612
MD5 f58fc461298fc5be025c8b01bd8d05d2
SHA1 b8f7d095c32f406a391c48546cd8e068c3240014
SHA512 4bbf52c28a9b8fac8e6d503d364bc397d088872bc6bc23f334a99fdf6a3e7364e06fdf98a62868e0ecdfa80452c4b14a22973bd57e1e371184a6716e8c456052
SSDEEP 6144:4flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:4flfAsiVGjSGecvX
TLSH
T113747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaysqkidav.sys

Path C:\Temp\gaysqkidav.sys
Size 293KB
SHA256 879c7a04b1202a4f07db53e95d25f3ceff2fbbf88d08af2aee47e622bd9ae6bd
MD5 29ac7e808b3b0a777b2b79e75f58756f
SHA1 1ddf42a709bf0a03686b960733b7d5f9f24ace2d
SHA512 42d277dffd0b05149acedbb5bfefd16dc3d427bb92a803a70889d4204988f7d28643b5b8b65e8b3342bbd3a68f183624b23425a91e5797a888f6df2b225d52d1
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D1545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aysqoigays.exe

Path C:\Temp\i_aysqoigays.exe
Size 361KB
SHA256 90791a185ab84c90ae7e6bf44fc614005ae9717402b824000b670824638a15aa
MD5 b18de8905525d49530070216b05c8c9b
SHA1 2f09659e2ac327e5f04d3a80816d5b358b380b7d
SHA512 9f9b1313a6bc5bcb287e84bd2fd52dd31e6628b09b5d8e772deb9d0cd1008b3ced1b2605ce58c6a860294bc0c82abb192344741c62e544ca5a3f67571bcf2527
SSDEEP 6144:fflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:fflfAsiVGjSGecvX
TLSH
T1B8747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bywqlgdywq.exe

Path C:\Temp\i_bywqlgdywq.exe
Size 361KB
SHA256 fdfaa3a4b8a55ea39e44c8415defe8787d86ccaa9b005d4d82764039c1d54603
MD5 fc07f1979b470f064eba7ed68dcb6ab9
SHA1 192821808a9310a630b43377f6995f8756d93866
SHA512 ba532a04aeaa3915e181e66e6ece9325ec2e30d53b50a4c77b9779519c9be33c6d7cba8af6758e34184dfe99f9e9de715721e43c8bc051a9985600729991eb83
SSDEEP 6144:OflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:OflfAsiVGjSGecvX
TLSH
T1B4747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cxvsqnifzx.exe

Path C:\Temp\i_cxvsqnifzx.exe
Size 361KB
SHA256 52c42ef16b8ae41b414e6c1a4e085ace358bc0f8651c3aaefbcb4fcf6cdff9c6
MD5 393b743b6ec3a1d2763ce6abdcc4d56a
SHA1 d344727f6195e07e96f58260933f0c7c25fccc88
SHA512 d400ae15b31c3e28fbfced616bdab1c3101d774690783f5e6bdaae00efbc27b1eb913c3caed104ca566f29b9a14af3999de9cfa414abc301069522fe27eaa5c2
SSDEEP 6144:mflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:mflfAsiVGjSGecvX
TLSH
T107747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsnlfdavsq.exe

Path C:\Temp\i_vsnlfdavsq.exe
Size 361KB
SHA256 832cdf80f363aeb99e75032f610080f1a47e3b5cb98803b1ca618930920f732b
MD5 22532d824764a63922676ccc972a597a
SHA1 35e85fdbab35e1504ad1d60ac9127c64b4e921fe
SHA512 bf5373b7a06cd6a940e942b5b3ee6d8c0d64edfb81eafc865c5bf9abde0651d66058f889b33292d711f088c75e21111cb47cb9f377727e1613fd289da17b25b2
SSDEEP 6144:GflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:GflfAsiVGjSGecvX
TLSH
T1F5747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxvpfzxspk.exe

Path C:\Temp\i_zxvpfzxspk.exe
Size 361KB
SHA256 dc2d25f225a4ab8167729f60e5e9335dde59970a0ff60c2f7d20d698615712f7
MD5 b63654ef0cb0aa45ec868564bbcdaed6
SHA1 681e856bdab4d8cd02a066c66ff4e1f03ef1abc7
SHA512 e6fee8b8353994ad0b30c144da3d80db9540ecadf6796f6e64dd27f4f27d05fc7608aa28f32e154ab8d2883115896b47229eaa203ca919c4e3154284d267af15
SSDEEP 6144:2flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:2flfAsiVGjSGecvX
TLSH
T19D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icankifaxv.sys

Path C:\Temp\icankifaxv.sys
Size 293KB
SHA256 776ce432abf577a5b227c70b17ca2f3efa2f255997f60038a41f26ca9088d02c
MD5 1513c8053c9d742130dc21a6487c95b2
SHA1 f437dcfc7c155648aff56f3bf73808a35b7c2909
SHA512 a85d0655d336e1781b1764a63c5b7740cef265fda075dfaddc3cee5b796a34290dec6d3a1c5280cd80d5b355d4a6eed9b7a5d723648196af02e05a5dfa1f4b21
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcxvpnhfz.sys

Path C:\Temp\kfcxvpnhfz.sys
Size 293KB
SHA256 57831916bc7f1724ab514b3e4bdad856b967671275390d9a95cf3021a82b69ed
MD5 286757a68b022e2912fae6e9092b84de
SHA1 c7493dd66f6e7975c3ecad39fe139fed0ba0a1f2
SHA512 e49c96607726b4c87f5cb40dd2e505321729e29bb757773173d87aef6ef1dc73461f02bba2f9f8069992c726fff460bc6490eda25a50556ebd13bbee2249c749
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T16B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljgbytqljd.sys

Path C:\Temp\ljgbytqljd.sys
Size 293KB
SHA256 28fb744ae976b9c5580546ece617a81ec740d531ef6c48396cd7ca601a67fa28
MD5 7fa86588e91e514db3475981889f2334
SHA1 6f405e86202e9925d0dc6c714960179dd7bb4559
SHA512 4ba4473804d56d24979bb3ba5e6eff83b5625dec359f875dd977b3ab41b13e1f975faaf247e6b2ed6a4a4bf30b24aba2ade735762bd0f67cf1f2c247270fc18d
SSDEEP 3072:dtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:dIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E1545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnheczurpj.exe

Path C:\Temp\pnheczurpj.exe
Size 361KB
SHA256 4345734669507128f646f0c5408dcfa8509f1d3a57cf4e966ad759f5080a369d
MD5 7cd120aeee8a6968845fcc5012f56c2e
SHA1 bd04af5a4a12ab35a9832a2d82cd450a10df3b4c
SHA512 27ba3579188e26dde586aea89700de31ded57e968251e6663450146a7825ed0bdacd9652aff2278858b63261aa1c5cb97daeebd82bf8fa03bcf08cf326ea931e
SSDEEP 6144:3flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:3flfAsiVGjSGecvX
TLSH
T1F3747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upnhfzxrpj.sys

Path C:\Temp\upnhfzxrpj.sys
Size 293KB
SHA256 0233ac4b6c7a516d8442e2ef5236890b2c480e4eeb8c3fddf83167de545774e4
MD5 486643300db560f8552b226bb09d2e79
SHA1 3502e760e54a578ac219ad8541d975c81df2fce2
SHA512 11b2c81991312b3e90ac5c7c6755888736ba72f377f5a5cb2de6bbee2a28c119235a567b453f59adda81ad553912c4e19eec480424690fb7b9371fea1e9ba790
SSDEEP 3072:itKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:iIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnlfdavsq.exe

Path C:\Temp\vsnlfdavsq.exe
Size 361KB
SHA256 7dbae3a7fefdd4a9bfc5d828f4ea2654f5bdfb1ad043a55e298fac1ed255925b
MD5 1dd76c906c4eec7bac7d2054a18b68c8
SHA1 0a9ab2b4e6d0179df66de5698417083b674a5196
SHA512 01ccac6ced71de777cf6c2a6b47420ce19747eee64cbbd290dbd8fe4707623394dc81932800be707f836761961c1ec7970cd3fa3a987b6cf435ba809c3275bc1
SSDEEP 6144:MflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:MflfAsiVGjSGecvX
TLSH
T1EA747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtolgeywqoigbywt.exe

Path C:\Temp\vtolgeywqoigbywt.exe
Size 361KB
SHA256 1535b512a1783df7826e1d01bb84349fb964382a4ff36628f504509237d0d3a3
MD5 e3bf1d898e632e4031efdf3bc8d671e3
SHA1 02daefdc416c8d36ae880e4f003fb3592eb280b9
SHA512 0352b1c5fce76d04ad981af0555f055b8530e86c8be37782594f0a3651c8d33ff6df0b32bdf2a4629c7218ae0b547f8030cba4f8c9adbc2493673d123dc237ad
SSDEEP 6144:FflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:FflfAsiVGjSGecvX
TLSH
T127747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtolgeywqoigbywt.sys

Path C:\Temp\vtolgeywqoigbywt.sys
Size 293KB
SHA256 83b634f53fcb83dd916cff9a5106545723b540c46efc594813fd171b743f0f91
MD5 22a1f73962db854546a312088e89ad1c
SHA1 3d29db542d8271fd419abe920600813061d61a12
SHA512 c896009db9e723cc82bc78542a101794472fd7478e95388e34ed1c34c515d05a4dc2a003d9cfffc91deefc897e1a6990706b5c4d97438937b79cc706496c2f2c
SSDEEP 3072:atKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:aIJjiJcbI03GBc3ucY5DCSj
TLSH
T168545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxvpfzxspk.exe

Path C:\Temp\zxvpfzxspk.exe
Size 361KB
SHA256 a9e86bcbf21fcf47890a7a9b8cf3d6523ea1c5b988c610dc0d06342a74e8ef9b
MD5 b15d3f0180f5014bdd2737f006f7ec07
SHA1 0e6126efa54b35bc6a9e1909db7235bc485c3e15
SHA512 fefb91d54bc26583ab85b4fe01c014ececf330fb4a85ff64f936394b73bfcf678e565e656046672458cce7fe2d33072fbaecdc63105127e56e43450915081743
SSDEEP 6144:EflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:EflfAsiVGjSGecvX
TLSH
T134747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 63b3e051645c9957f53c538586c3b5463f3ba4412c230d66eb66f06ad6052604
MD5 0070abe22a07fb36149648973e990688
SHA1 c8a203457b36afa6d0ce9b56d26cb7817d832d37
SHA512 cda9b7179f6f997dac4ee0624ff9f92ed77b7c27218584fb07f6b2ebc24d10fc25d45c3d2781b766d834f82054e29ee150712e7ab7d7a11465c468d0f8a31fd1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P79:fwUQC5VwBIiElEd2K57P79
TLSH
T175B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a9db3b181fe23d2da858b764c2d3bc2baae4a7e217d8cc5885ed34c7b21166b7
MD5 c2e18a2143bb27e5b37e2d5b65c09643
SHA1 43bb7d235630acc17d81e04e37f3cd25e299ecc7
SHA512 08f1e7fa966122b22bea5e316c89298987fac4c53be675ad48a1c1c8a784dc7b1d8789be8d1abdb8cdb59c14d6757e0f1934d0a56d919c8fb08e311621fe4d9c
TLSH
T109D02BB0B77DCCD3D00310FE0015AE0421A370159E0402802302885844001041101358
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2664448b8ab4f4edce89a8c875c31ed1e748ff3060fa1567c434149210bb4fc5
MD5 35b0bc3bbbf168c9b6c74d3bc119d3eb
SHA1 3dde0e79982d9dbcf2dbd3045bae0a5bc63e14cd
SHA512 9c5f83f731b8e4bf7f7e64c2e51191192b13fa5260950a1fcade843318dbf7d5b99057f3ca893e35cb6c19942f5b5852e7124ed01f7c46e7de9bcea70152fc0d
TLSH
T173D02BB4B76DCDD3D00310FE0014AE0421B37015EE040280230248484400104110236C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f3175d06d5ae8f14706c9c76cb00633d3fb11afaa3419f09b8e5755e270f5e48
MD5 7b51601c27b50f7b246405953a72db7c
SHA1 2e848d2a21e714837898804608db6b4eeffcc60e
SHA512 15953cde9d89bb8535fb224672d10e1e4fa57e9a67a3e772436928657c6339bef23cd374589f6a224c7028f3aedd656b78212865fd85f8dc9c9dcfd0c8105907
TLSH
T1D561A98665F0815EF7B952B1D3CF8FC73A34668151431F3244C8DE768986317E0798C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2f40801a2448c1c9b4b0771dd666b86afe20b9bc3da81e7e7ef5dcb0f2199d9e
MD5 e4ff485d9edcd566eb690edc89b2f6ce
SHA1 5f51757f7033c7b8a0f78f676589beb2062a17ce
SHA512 8760423b680f3faad3e5604dd6104ac5733d649a99e467e13df758824b0b0de67f51ec0f54be3cc20167c0913c61e5bc27c5c2f04cb8bffd937dc0855249047e
TLSH
T19461A88665F0816EF7B952B1D3CF8FC73A34668191431F3244C8DE7A8986327E0798C4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b68ad85416a64aaa0668b2fbe0d1869b409c19af16e846663ffc6b79976d4acd
MD5 6929847e6601b42b369a3b2feaad5893
SHA1 cd9b99455019d9822d0480f15fba9cc0209c9bfc
SHA512 fe55f5383c19508da6eda266220921b72a7c99326ffa6bf1904ff85b60f4114db7d398f96dcb40492c5d11b14159fbe19684d7a5d9c49fc6436104e4fd8d51d2
TLSH
T191519EF3C3F8C66D891156F0AB146E1BCE1D0915432C3D5AC9E4AE2B93E2471E14155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 aca783fc534793db8d39caed9fea4785a0fe96c6d0070654dc153c12ba682670
MD5 43c94e4f445bc62e8354c9994700a5be
SHA1 8340b4f147373a6c030a6a29053741e6fdce0658
SHA512 0d835c28b94326ef1df315c885159f068e9632ead84f7d93c576fcb802bc42565cc5c5ce30b41e3919912d9913ed773ff77ae5d26aaab3f38ec3dd5d236c580b
SSDEEP 192:sxRBRFC5/feJs+uZczoA8p98/g6+WNCDD1/YxGQUDGMIgDvpJ:sxRBy5/fUs+INq/5M/OUB3
TLSH
T17142C719AD68697B4CCBD31DBA55BF13E2F91033A1D51E88A6FC8A1C14E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0520a7975b19a6be847465e775fa6341cc6d68d0836abb83e1098a80d59bc9d0
MD5 e4cfec5651066058c04548f789079018
SHA1 e96a3b2c43a6a13aa1c7820275dd1dac0c1f6741
SHA512 971d02dee05a197560109f85603f0228f0c6e4cdb8f4e153671396a9cf0c795f96ae8767b8aa836a00061c51385bab88942c31c1875107abd7fdce72b84887cf
SSDEEP 192:sxRBRFC5/feJs1uZczoA8p98/g6+WNCDD1/YxhQUDGMIgDVpJ:sxRBy5/fUs1INq/5M/9UBh
TLSH
T1C742B719AD64A97B4CCBD31DBA55BF53D2F91032A1D51E88AAFC8A1C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2a6df9be391d6340baf3b46e8596c3752bd182ea0c7595c60a4a0c75045f64fc
MD5 1d5c5e614332a0d0ba395f16eede9708
SHA1 e3026ec3212b41f0c111776966e390caf2ff7ff7
SHA512 2d435d9afe0194242efffa10d394d2552f2762650017a9f9ed964a8314a6c74e01eb02946e3365b5c0d7e061e424ecdaf01762da94ef99a2c881b25f27e807ce
SSDEEP 192:sxRORFC5/feJs0uZ0zoA8pi/g6+WNIYxqQUDGMIgVpJ:sxROy5/fUs0IVi/5I4UBV
TLSH
T10932A619AE68A93B8CC7D31DBA55BF53D2F91033A1D55E48AAFC8A1C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 f7d722a237d0b78f55116aa1ace5d663236d13677d8f609b94a933b2042525d4
MD5 b64c6b9b5325ab8d2923e82cb862d92f
SHA1 199eefc8fb9e1828a36a39180f89519a76a6e59a
SHA512 5de62df967125f0d044b2ea4256bb8b0a889673cc8653684dc78f3fa713798f6496fb88cac44c54e522e5af33531e73bbd8d7b908f332ca3a02ed341686c91ff
SSDEEP 768:zBDnKx7pLuLbYFWgbjfkW8F1+UoAYDCx9Tuqh0VfUC9xbog/OVGg+BK34roOTF:zBDnKnEbYFWgbjfkWu1ja9g+03DQF
TLSH
T1A4D2D97B784CCA7F4F800A9DAC197E9E6DA802CB9A98CD4047FE945C03C67EE51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 4be71fb917dc4886624fba778dfe96c6bf734d2c62a732479530dcc089c14d75
MD5 b45c73d31df8d94c53594d629f82def6
SHA1 f01ff3025e2e6164fafbea73091d273f4bee7b4b
SHA512 7096c5292defe2a18d7cfd7afde1eaa4a96b8f442c2ab00b00dcb3d5b0bd6ed39163a6aba59b1306ce3cfed693a0994644c3309172f3e97b8fca8b47b5ee44de
SSDEEP 48:Kw5IVKyggvy3zIhK0IM4iI/KTacTyxAInKTz:Kw5mKygy8zeK0I7iIKTa6SAwKTz
TLSH
T1D1B1F26032372201397E3A5995D4B79E534732B37024E62B3BE940569EABE084DFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a5df0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a5df0.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 d00fae3b0d07722070b2792709fe606cee448d1dbb278c4449813c9fb3cd1793
MD5 5889e0a51bc11fa29dee5877ab2ee84d
SHA1 32a42243b472bee2b903565f0d1662826f70b934
SHA512 c6ace7de76760bb2cbbb64570f1cddd46b3b80a4984edba2a7462ab7a669c2371710424ebd023d44c37ccd742e1ced6ecde66733aa75a672445884f2b5dd98f6
SSDEEP 768:h/UxvxjgC+i3H69TOf0fhKJYe1ELsAvC8/YMJdSHrkw:0Zj3+i31f0fGYe1EQujYqS4w
TLSH
T11103C036ECA48D775EF2A3C8774A4757EEF8811394C45AA886DD2B0D05C72AC630F85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 c2c95811e611713fd23ef6d77221271dd6ce4b410a13ec52ae63078a417b4d9f
MD5 c983c6eba9be4a1a5cdebbe92098bb0a
SHA1 81388640a570ea020c2cdc6a4f68de2dbaad8efc
SHA512 18d64fc1036471b94442df9679528973768cc892e7da423bbd2321878b9ca6b9c76d4cb5a050788ab26c5003cd4947480d1aecf3d7671649e0ea374e101a9a11
SSDEEP 768:v/UxvxjgC+03kpo9TOf0fmfWlyJYe1ELsAvC8/YEE2sucr:CZj3+03k1f0fmfRYe1EQujYZ2sTr
TLSH
T1DE03BF35DCB89D371DF2A688B38A1753FFF4452394C59AA895DA1B0C05C73AC170F85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 c5f09351a75f4f229602cd57f5d82676c5b7806c0186db7fb42cea93c914c91e
MD5 b592f5b8857a4d37ce189eb462a9ce41
SHA1 b61d3c970909b5738e9a5db978f4d839eceb5af8
SHA512 8344a9ace7dd940cb5b651efede88134fbcb384c0105bf3bb64ad71c665ece7eb33e9f6cc667c3644f5f454ee25a3853a47cabeb8c1e81bb747ba89d5e01944f
SSDEEP 768:DZ3czo9TOf0fmfWlyJYe1ELsAvC8/YEE2susg:DZ3c7f0fmfRYe1EQujYZ2s7g
TLSH
T107F2AE71DCB4CD771DF69789B7862B13BFF8412394C48A94D5DA2B4C44836AD270F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 e78edf36d283bf05b565c262c7b15f1e1271671fb091a62a822c1c09cc9967d8
MD5 2d4ac532d54b7238f759ed013de03369
SHA1 e3db5b5e92bd8f25457d50bf5e4775983c9da156
SHA512 ea5d43296dc2a312a663c7c8735639d17e15f4305c4ead2da7afbb4384d5e9d1f7f7ba42512e71c9aa2b96f04903fbf8476bf75edc85c995ca15939945ff25b7
SSDEEP 768:iZ3nzo9TOf0fmfWlyJYe1ELsAvC8/YEE2susg:iZ3n7f0fmfRYe1EQujYZ2s7g
TLSH
T128F2AE71DCB4CD771DF69789B7862B13BFF8412394C48A98D5DA2B4C44836AD270F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 4e813fc99074d5243b7f0a98a1739f4207234b32b24cad0a953bcffdc0974e17
MD5 83e76e99183c5d0eab3ea3c9775f3e7b
SHA1 cedfa4d6cd30ee47c986c8d4f1d4c837f2191d9f
SHA512 7b2fcc50f07a65b0fda2d566ee07d87725c361a2de8eaa87fca6122d9b48f61a25327eb593862799ed21110a9e88f6be37a3b6c013f33ac3938b30f95e3c8d82
SSDEEP 768:RFQ+38wgmbYJOf0fmfWYGJYe1ELsAvC8/YEE2susg:g+3dhf0fmfwYe1EQujYZ2s7g
TLSH
T1671318F188E7897AD9AE4787A77D2E029EBCC113B4889594B7C51E4CCC831BFC30A855
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

754191ea-e98f-438a-a77f-746a35046b38.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\754191ea-e98f-438a-a77f-746a35046b38.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4956_124183010\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 ecf5abfd2698e10fd4458d97f3475adec3b5d6fa807352b774fa7d27b1a3d542
MD5 cc0fe74450963d264dab3173ab3d6af1
SHA1 de4a50b662f733bdc833fe139605f671e25e2501
SHA512 557502cdc81840378d53566fd1224e0021dbb36352f9d0551eaf42b8b03b9c21803067b08fc3f0b29d3098bd9d1d35d75cf97523b06f6f82cebadda0f85dbfa6
TLSH
T15B71278357A8D5B3C1DE5BF502835644F5FB1238073331200B51599BE730A7664B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/980-410-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1280-481-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2328-265-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2328-190-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2864-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3120-386-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3200-460-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3488-305-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4292-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4652-337-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4684-398-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4752-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5180-237-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5848-277-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5916-313-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5980-433-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5992-455-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6076-464-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6088-434-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6088-422-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6128-366-0x0000000000010000-0x00000000000AB000-memory.dmp

Download