systex | 59633100053b32028fe7475094ada348ca33aae18d42e1e155cf19c8606fd9fd

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 13:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260930-q3jmesgf86
SHA256 59633100053b32028fe7475094ada348ca33aae18d42e1e155cf19c8606fd9fd
MD5 14798e3dc56f17ff6b7ab30c952f4377
SHA1 dea63938a49f77696339fc512ea7f4a2bac9fc94
SHA512 d8540d5ada19816fa9552a6cd22f59f7da9cb0241ff731a48369089863ee7d30d06728231e404ad58d8ab72a17d378d2f7f1b752a7ce71b7c0d72f86e3425d52
SSDEEP 6144:9flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:9flfAsiVGjSGecvX
TLSH
T114747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3096	bztrmjebwuomgero.exe
4776	bztrmjebwuomgero.sys
1092	CreateProcess.exe
1452	trljebztrl.exe
5136	CreateProcess.exe
5648	CreateProcess.exe
4464	i_trljebztrl.exe
2056	toljdbwtom.sys
4636	CreateProcess.exe
2828	ojgbywqljd.exe
6128	CreateProcess.exe
3500	CreateProcess.exe
4880	i_ojgbywqljd.exe
4120	ytqljdbvtn.sys
2848	CreateProcess.exe
2360	qoigaysqli.exe
5776	CreateProcess.exe
5576	CreateProcess.exe
2716	i_qoigaysqli.exe
2160	idavtnlfdy.sys
3552	CreateProcess.exe
628	davsnlfdxv.exe
5988	CreateProcess.exe
5760	CreateProcess.exe
5884	i_davsnlfdxv.exe
4888	ifaxvqnica.sys
4156	CreateProcess.exe
4600	usmkfcxvpn.exe
3912	CreateProcess.exe
4196	CreateProcess.exe
1360	i_usmkfcxvpn.exe
5960	fzxvsmkfcx.sys
4620	CreateProcess.exe
1620	fzxspkicau.exe
1708	CreateProcess.exe
1108	CreateProcess.exe
3408	i_fzxspkicau.exe
4976	czusmkecwu.sys
4124	CreateProcess.exe
4300	zusmkecxup.exe
2428	CreateProcess.exe
3428	CreateProcess.exe
2896	i_zusmkecxup.exe
2420	rmjhecwuom.sys
2008	CreateProcess.exe
2468	urmjhecwrm.exe
2820	CreateProcess.exe
3444	CreateProcess.exe
4944	i_urmjhecwrm.exe
4480	gezwuomhez.sys
5688	CreateProcess.exe
4752	rljebwtomg.exe
6040	CreateProcess.exe
5480	CreateProcess.exe
5224	i_rljebwtomg.exe
5580	dbwtomjebz.sys
5748	CreateProcess.exe
2696	bzwqomywqo.exe
1088	CreateProcess.exe
4900	CreateProcess.exe
4844	i_bzwqomywqo.exe
4284	dywtolgdyw.sys
4580	CreateProcess.exe
1728	ytqoigbyto.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_712130835\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_705644601\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_693488908\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_693488908\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1155267221\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1155267221\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_705644601\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1155267221\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1155267221\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zusmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrojhbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqoigbyto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqlidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icavsnkidx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjheczurpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrmjebwuomgero.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljebztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zusmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmjhecwrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzwqomywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causnkfvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljebwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjheczurpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqoigbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljebztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgbywqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmjhecwrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzwqomywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causnkfvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqoigbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgbywqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljebwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icavsnkidx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqoigbyto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrojhbw.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1560	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4944	ipconfig.exe
4872	ipconfig.exe
5000	ipconfig.exe
984	ipconfig.exe
4688	ipconfig.exe
4596	ipconfig.exe
3648	ipconfig.exe
4964	ipconfig.exe
5828	ipconfig.exe
2812	ipconfig.exe
2120	ipconfig.exe
2736	ipconfig.exe
2900	ipconfig.exe
5280	ipconfig.exe
2548	ipconfig.exe
2508	ipconfig.exe
1576	ipconfig.exe
2580	ipconfig.exe
5584	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{57AD6465-91EC-46CF-A4D4-3AAB9EBE67C1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3096	bztrmjebwuomgero.exe
3096	bztrmjebwuomgero.exe
3096	bztrmjebwuomgero.exe
3096	bztrmjebwuomgero.exe
3096	bztrmjebwuomgero.exe
3096	bztrmjebwuomgero.exe
3096	bztrmjebwuomgero.exe
3096	bztrmjebwuomgero.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	4464	i_trljebztrl.exe
Token: SeDebugPrivilege	4880	i_ojgbywqljd.exe
Token: SeDebugPrivilege	2716	i_qoigaysqli.exe
Token: SeDebugPrivilege	5884	i_davsnlfdxv.exe
Token: SeDebugPrivilege	1360	i_usmkfcxvpn.exe
Token: SeDebugPrivilege	3408	i_fzxspkicau.exe
Token: SeDebugPrivilege	2896	i_zusmkecxup.exe
Token: SeDebugPrivilege	4944	i_urmjhecwrm.exe
Token: SeDebugPrivilege	5224	i_rljebwtomg.exe
Token: SeDebugPrivilege	4844	i_bzwqomywqo.exe
Token: SeDebugPrivilege	5212	i_ytqoigbyto.exe
Token: SeDebugPrivilege	1192	i_sqlidavtnl.exe
Token: SeDebugPrivilege	4284	i_icavsnkidx.exe
Token: SeDebugPrivilege	4076	i_causnkfvpn.exe
Token: SeDebugPrivilege	3800	i_pjheczurpm.exe
Token: SeDebugPrivilege	3868	i_hbztrojhbw.exe
Token: SeDebugPrivilege	3648	i_jhbztrljeb.exe
Token: SeDebugPrivilege	3052	i_tqoigbytrl.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2708	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 3096	1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 1732 wrote to memory of 3516	1732	2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 3516 wrote to memory of 2708	3516	iexplore.exe	91
PID 2708 wrote to memory of 3228	2708	msedge.exe	92
PID 2708 wrote to memory of 1560	2708	msedge.exe	93
PID 2708 wrote to memory of 760	2708	msedge.exe	95
PID 2708 wrote to memory of 760	2708	msedge.exe	95
PID 2708 wrote to memory of 5388	2708	msedge.exe	94
PID 2708 wrote to memory of 5388	2708	msedge.exe	94
PID 2708 wrote to memory of 5388	2708	msedge.exe	94
PID 2708 wrote to memory of 3456	2708	msedge.exe	97
PID 2708 wrote to memory of 3456	2708	msedge.exe	97
PID 2708 wrote to memory of 3684	2708	msedge.exe	98
PID 2708 wrote to memory of 3456	2708	msedge.exe	97
PID 2708 wrote to memory of 3684	2708	msedge.exe	98
PID 2708 wrote to memory of 3684	2708	msedge.exe	98
PID 2708 wrote to memory of 5376	2708	msedge.exe	99
PID 2708 wrote to memory of 5376	2708	msedge.exe	99
PID 2708 wrote to memory of 5376	2708	msedge.exe	99
PID 2708 wrote to memory of 3256	2708	msedge.exe	100
PID 2708 wrote to memory of 3256	2708	msedge.exe	100
PID 2708 wrote to memory of 3256	2708	msedge.exe	100
PID 2708 wrote to memory of 1048	2708	msedge.exe	101
PID 2708 wrote to memory of 1048	2708	msedge.exe	101
PID 2708 wrote to memory of 4416	2708	msedge.exe	105
PID 2708 wrote to memory of 2824	2708	msedge.exe	106
PID 2708 wrote to memory of 4416	2708	msedge.exe	105
PID 2708 wrote to memory of 2824	2708	msedge.exe	106
PID 3096 wrote to memory of 1092	3096	bztrmjebwuomgero.exe	107
PID 2708 wrote to memory of 6008	2708	msedge.exe	110
PID 1452 wrote to memory of 5136	1452	trljebztrl.exe	112
PID 2708 wrote to memory of 4444	2708	msedge.exe	115
PID 2708 wrote to memory of 4444	2708	msedge.exe	115
PID 2708 wrote to memory of 1248	2708	msedge.exe	116
PID 2708 wrote to memory of 1248	2708	msedge.exe	116
PID 3096 wrote to memory of 5648	3096	bztrmjebwuomgero.exe	119
PID 3096 wrote to memory of 4636	3096	bztrmjebwuomgero.exe	123
PID 2828 wrote to memory of 6128	2828	ojgbywqljd.exe	125
PID 3096 wrote to memory of 3500	3096	bztrmjebwuomgero.exe	128
PID 3096 wrote to memory of 2848	3096	bztrmjebwuomgero.exe	132
PID 2360 wrote to memory of 5776	2360	qoigaysqli.exe	134
PID 3096 wrote to memory of 5576	3096	bztrmjebwuomgero.exe	137
PID 3096 wrote to memory of 3552	3096	bztrmjebwuomgero.exe	142
PID 628 wrote to memory of 5988	628	davsnlfdxv.exe	144
PID 3096 wrote to memory of 5760	3096	bztrmjebwuomgero.exe	147
PID 2708 wrote to memory of 4392	2708	msedge.exe	149
PID 2708 wrote to memory of 4936	2708	msedge.exe	150
PID 2708 wrote to memory of 4912	2708	msedge.exe	151
PID 3096 wrote to memory of 4156	3096	bztrmjebwuomgero.exe	154
PID 4600 wrote to memory of 3912	4600	usmkfcxvpn.exe	156
PID 3096 wrote to memory of 4196	3096	bztrmjebwuomgero.exe	159
PID 3096 wrote to memory of 4620	3096	bztrmjebwuomgero.exe	163
PID 1620 wrote to memory of 1708	1620	fzxspkicau.exe	165
PID 3096 wrote to memory of 1108	3096	bztrmjebwuomgero.exe	168
PID 3096 wrote to memory of 4124	3096	bztrmjebwuomgero.exe	172
PID 4300 wrote to memory of 2428	4300	zusmkecxup.exe	174
PID 3096 wrote to memory of 3428	3096	bztrmjebwuomgero.exe	177
PID 3096 wrote to memory of 2008	3096	bztrmjebwuomgero.exe	181
PID 2468 wrote to memory of 2820	2468	urmjhecwrm.exe	183
PID 3096 wrote to memory of 3444	3096	bztrmjebwuomgero.exe	186
PID 2708 wrote to memory of 5384	2708	msedge.exe	188
PID 2708 wrote to memory of 5384	2708	msedge.exe	188
PID 3096 wrote to memory of 5688	3096	bztrmjebwuomgero.exe	194
PID 4752 wrote to memory of 6040	4752	rljebwtomg.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_14798e3dc56f17ff6b7ab30c952f4377_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Temp\bztrmjebwuomgero.exe
  C:\Temp\bztrmjebwuomgero.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljebztrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1092
  - - C:\Temp\trljebztrl.exe
      C:\Temp\trljebztrl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1452
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5136
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljebztrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5648
  - - C:\Temp\i_trljebztrl.exe
      C:\Temp\i_trljebztrl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ojgbywqljd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4636
  - - C:\Temp\ojgbywqljd.exe
      C:\Temp\ojgbywqljd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2828
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6128
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ojgbywqljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3500
  - - C:\Temp\i_ojgbywqljd.exe
      C:\Temp\i_ojgbywqljd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigaysqli.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2848
  - - C:\Temp\qoigaysqli.exe
      C:\Temp\qoigaysqli.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2360
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5776
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigaysqli.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5576
  - - C:\Temp\i_qoigaysqli.exe
      C:\Temp\i_qoigaysqli.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\davsnlfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3552
  - - C:\Temp\davsnlfdxv.exe
      C:\Temp\davsnlfdxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:628
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5988
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_davsnlfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5760
  - - C:\Temp\i_davsnlfdxv.exe
      C:\Temp\i_davsnlfdxv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkfcxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4156
  - - C:\Temp\usmkfcxvpn.exe
      C:\Temp\usmkfcxvpn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4600
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3912
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkfcxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4196
  - - C:\Temp\i_usmkfcxvpn.exe
      C:\Temp\i_usmkfcxvpn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxspkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4620
  - - C:\Temp\fzxspkicau.exe
      C:\Temp\fzxspkicau.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1620
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1708
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxspkicau.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1108
  - - C:\Temp\i_fzxspkicau.exe
      C:\Temp\i_fzxspkicau.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zusmkecxup.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4124
  - - C:\Temp\zusmkecxup.exe
      C:\Temp\zusmkecxup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4300
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2428
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zusmkecxup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3428
  - - C:\Temp\i_zusmkecxup.exe
      C:\Temp\i_zusmkecxup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmjhecwrm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2008
  - - C:\Temp\urmjhecwrm.exe
      C:\Temp\urmjhecwrm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2468
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2820
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmjhecwrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3444
  - - C:\Temp\i_urmjhecwrm.exe
      C:\Temp\i_urmjhecwrm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljebwtomg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5688
  - - C:\Temp\rljebwtomg.exe
      C:\Temp\rljebwtomg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4752
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6040
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljebwtomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5480
  - - C:\Temp\i_rljebwtomg.exe
      C:\Temp\i_rljebwtomg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5224
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzwqomywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5748
  - - C:\Temp\bzwqomywqo.exe
      C:\Temp\bzwqomywqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2696
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1088
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzwqomywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4900
  - - C:\Temp\i_bzwqomywqo.exe
      C:\Temp\i_bzwqomywqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ytqoigbyto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4580
  - - C:\Temp\ytqoigbyto.exe
      C:\Temp\ytqoigbyto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1728
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3220
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ytqoigbyto.exe ups_ins
    3⤵
    PID:5160
  - - C:\Temp\i_ytqoigbyto.exe
      C:\Temp\i_ytqoigbyto.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5212
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqlidavtnl.exe ups_run
    3⤵
    PID:1892
  - - C:\Temp\sqlidavtnl.exe
      C:\Temp\sqlidavtnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5056
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4604
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqlidavtnl.exe ups_ins
    3⤵
    PID:1668
  - - C:\Temp\i_sqlidavtnl.exe
      C:\Temp\i_sqlidavtnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icavsnkidx.exe ups_run
    3⤵
    PID:1588
  - - C:\Temp\icavsnkidx.exe
      C:\Temp\icavsnkidx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4148
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4596
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icavsnkidx.exe ups_ins
    3⤵
    PID:1064
  - - C:\Temp\i_icavsnkidx.exe
      C:\Temp\i_icavsnkidx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causnkfvpn.exe ups_run
    3⤵
    PID:5640
  - - C:\Temp\causnkfvpn.exe
      C:\Temp\causnkfvpn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1448
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5784
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causnkfvpn.exe ups_ins
    3⤵
    PID:1744
  - - C:\Temp\i_causnkfvpn.exe
      C:\Temp\i_causnkfvpn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ausmkecxup.exe ups_run
    3⤵
    PID:6076
  - - C:\Temp\ausmkecxup.exe
      C:\Temp\ausmkecxup.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1212
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:896
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ausmkecxup.exe ups_ins
    3⤵
    PID:4328
  - - C:\Temp\i_ausmkecxup.exe
      C:\Temp\i_ausmkecxup.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      PID:5584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjheczurpm.exe ups_run
    3⤵
    PID:3248
  - - C:\Temp\pjheczurpm.exe
      C:\Temp\pjheczurpm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5492
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3424
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjheczurpm.exe ups_ins
    3⤵
    PID:3680
  - - C:\Temp\i_pjheczurpm.exe
      C:\Temp\i_pjheczurpm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbztrojhbw.exe ups_run
    3⤵
    PID:4764
  - - C:\Temp\hbztrojhbw.exe
      C:\Temp\hbztrojhbw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4372
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4216
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbztrojhbw.exe ups_ins
    3⤵
    PID:6104
  - - C:\Temp\i_hbztrojhbw.exe
      C:\Temp\i_hbztrojhbw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbztrljeb.exe ups_run
    3⤵
    PID:5600
  - - C:\Temp\jhbztrljeb.exe
      C:\Temp\jhbztrljeb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6064
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4824
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbztrljeb.exe ups_ins
    3⤵
    PID:5888
  - - C:\Temp\i_jhbztrljeb.exe
      C:\Temp\i_jhbztrljeb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqoigbytrl.exe ups_run
    3⤵
    PID:6096
  - - C:\Temp\tqoigbytrl.exe
      C:\Temp\tqoigbytrl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4172
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2984
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqoigbytrl.exe ups_ins
    3⤵
    PID:3792
  - - C:\Temp\i_tqoigbytrl.exe
      C:\Temp\i_tqoigbytrl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3052
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffe7ba2c188,0x7ffe7ba2c194,0x7ffe7ba2c1a0
      4⤵
      PID:3228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,11639564509853900055,16130738660356383541,524288 --field-trial-handle=2336,i,17416584555502248394,10553348061226395182,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:11
      4⤵
      System Time Discovery
      PID:1560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,8064797030351036818,2204893502853031001,262144 --field-trial-handle=2336,i,17416584555502248394,10553348061226395182,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
      4⤵
      PID:5388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,16730411415499340210,7385150831335977146,524288 --field-trial-handle=2336,i,17416584555502248394,10553348061226395182,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:13
      4⤵
      PID:760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,6356736375921644354,11179245065474269881,2097152 --field-trial-handle=2336,i,17416584555502248394,10553348061226395182,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
      4⤵
      PID:3456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,5450050810012612368,8619242589965493334,2097152 --field-trial-handle=2336,i,17416584555502248394,10553348061226395182,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
      4⤵
      PID:3684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,16225466268075125587,15940237302520098093,2097152 --field-trial-handle=2336,i,17416584555502248394,10553348061226395182,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:1
      4⤵
      PID:5376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,16653947806087675549,4694565663525473488,2097152 --field-trial-handle=2336,i,17416584555502248394,10553348061226395182,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:9
      4⤵
      PID:3256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,11114018730560768061,13799429263607343155,524288 --field-trial-handle=2336,i,17416584555502248394,10553348061226395182,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
      4⤵
      PID:1048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,2722827768810518155,10312244207893302248,524288 --field-trial-handle=2336,i,17416584555502248394,10553348061226395182,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
      4⤵
      PID:4416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,11386080896356609470,8029918558844970639,524288 --field-trial-handle=2336,i,17416584555502248394,10553348061226395182,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
      4⤵
      PID:2824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,15472242083425397083,5107790688890860995,524288 --field-trial-handle=2336,i,17416584555502248394,10553348061226395182,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,15472242083425397083,5107790688890860995,524288 --field-trial-handle=2336,i,17416584555502248394,10553348061226395182,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,6264047843633350629,6185693807654312624,524288 --field-trial-handle=2336,i,17416584555502248394,10553348061226395182,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
      4⤵
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,11961811101974831626,4069077534356468426,524288 --field-trial-handle=2336,i,17416584555502248394,10553348061226395182,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
      4⤵
      PID:1248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,3886748642836698403,8109726467157619897,524288 --field-trial-handle=2336,i,17416584555502248394,10553348061226395182,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
      4⤵
      PID:4392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,14475993155389103528,8455906753160918725,524288 --field-trial-handle=2336,i,17416584555502248394,10553348061226395182,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
      4⤵
      PID:4936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,13945664830420781013,18115210554916382290,524288 --field-trial-handle=2336,i,17416584555502248394,10553348061226395182,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
      4⤵
      PID:4912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,444996853909753885,2677678457648375473,524288 --field-trial-handle=2336,i,17416584555502248394,10553348061226395182,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
      4⤵
      PID:5384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,4984462722691744579,4406131006879289697,524288 --field-trial-handle=2336,i,17416584555502248394,10553348061226395182,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
      4⤵
      PID:5928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,14911508097648468662,8122042775458427831,524288 --field-trial-handle=2336,i,17416584555502248394,10553348061226395182,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:14
      4⤵
      PID:4276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,4958833195091172342,16792435816611087015,524288 --field-trial-handle=2336,i,17416584555502248394,10553348061226395182,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
      4⤵
      PID:2984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6024,i,500239825874030383,10187627860596231234,262144 --field-trial-handle=2336,i,17416584555502248394,10553348061226395182,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:10
      4⤵
      PID:5816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,16573403177293888607,8058989045610421368,524288 --field-trial-handle=2336,i,17416584555502248394,10553348061226395182,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:14
      4⤵
      PID:4356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3248

C:\Temp\bztrmjebwuomgero.sys
C:\Temp\bztrmjebwuomgero.sys
1⤵
- Executes dropped EXE
PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6104

C:\Temp\toljdbwtom.sys
C:\Temp\toljdbwtom.sys
1⤵
- Executes dropped EXE
PID:2056

C:\Temp\ytqljdbvtn.sys
C:\Temp\ytqljdbvtn.sys
1⤵
- Executes dropped EXE
PID:4120

C:\Temp\idavtnlfdy.sys
C:\Temp\idavtnlfdy.sys
1⤵
- Executes dropped EXE
PID:2160

C:\Temp\ifaxvqnica.sys
C:\Temp\ifaxvqnica.sys
1⤵
- Executes dropped EXE
PID:4888

C:\Temp\fzxvsmkfcx.sys
C:\Temp\fzxvsmkfcx.sys
1⤵
- Executes dropped EXE
PID:5960

C:\Temp\czusmkecwu.sys
C:\Temp\czusmkecwu.sys
1⤵
- Executes dropped EXE
PID:4976

C:\Temp\rmjhecwuom.sys
C:\Temp\rmjhecwuom.sys
1⤵
- Executes dropped EXE
PID:2420

C:\Temp\gezwuomhez.sys
C:\Temp\gezwuomhez.sys
1⤵
- Executes dropped EXE
PID:4480

C:\Temp\dbwtomjebz.sys
C:\Temp\dbwtomjebz.sys
1⤵
- Executes dropped EXE
PID:5580

C:\Temp\dywtolgdyw.sys
C:\Temp\dywtolgdyw.sys
1⤵
- Executes dropped EXE
PID:4284

C:\Temp\tnlfdaysqn.sys
C:\Temp\tnlfdaysqn.sys
1⤵
PID:4800

C:\Temp\avpnifdxvq.sys
C:\Temp\avpnifdxvq.sys
1⤵
PID:4664

C:\Temp\dxvpnkicax.sys
C:\Temp\dxvpnkicax.sys
1⤵
PID:3488

C:\Temp\causmkfcxu.sys
C:\Temp\causmkfcxu.sys
1⤵
PID:2556

C:\Temp\urpjhbzwrp.sys
C:\Temp\urpjhbzwrp.sys
1⤵
PID:2896

C:\Temp\jgebwuojge.sys
C:\Temp\jgebwuojge.sys
1⤵
PID:4056

C:\Temp\ytqolgdbwt.sys
C:\Temp\ytqolgdbwt.sys
1⤵
PID:4800

C:\Temp\tqljdbvtnl.sys
C:\Temp\tqljdbvtnl.sys
1⤵
PID:4104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bztrmjebwuomgero.exe

Path C:\Temp\bztrmjebwuomgero.exe
Size 361KB
SHA256 3bdc6cff732012d0fac015329b842f5841eaffd020d3caf5105818c6b6b39f04
MD5 5f41a66f5a3f1a8092932f6c0f9a0d37
SHA1 31b003644d4f84b2a78167c139bf573f3e3fafff
SHA512 6c2134a837bdc530b1294cf102a379d358a0ba9aed0cd74a45b4a253d8a4bb2b3380df212f7b5475c073a83ae638f3be8673876d325e743b915c99c303dcd265
SSDEEP 6144:jflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:jflfAsiVGjSGecvX
TLSH
T12D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrmjebwuomgero.sys

Path C:\Temp\bztrmjebwuomgero.sys
Size 293KB
SHA256 b09c7fbcd10eb95936c989b3e4d67786a3202312a8fb8f4ef669d17c72cc8ef4
MD5 6156678711028f4eb02aac0e8cfbff2c
SHA1 d15c6358044e84e79e823a9b66e4ca0c68faab2b
SHA512 d65982b5c29056a7eb5d26c2a942b6e612c8bbce9e3409eaa67742ada85bfc698e4e93fb075832d9b4b4f2e33ba9447e4a327d5fe91a6943d15cda208e44a473
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

davsnlfdxv.exe

Path C:\Temp\davsnlfdxv.exe
Size 361KB
SHA256 10123c425dda7cc5df79fab26021278aba9195afdf265b361fd719ba47011d78
MD5 20cbf7ff552342c8418552671f00106e
SHA1 f118010d7df29e63af3a5fe628141b4aeb77cd64
SHA512 bca225a5b659baf05507175d82fff72e9e5f8c133a096be73136d53bb51c8f422dda4b51941fe3cba9c7718f175eff2eed154f7b6a994d4963fb1828fe127b25
SSDEEP 6144:xflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:xflfAsiVGjSGecvX
TLSH
T16B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxspkicau.exe

Path C:\Temp\fzxspkicau.exe
Size 361KB
SHA256 0a0e63856e332b91a9656838a7b67a4ea3369d178ff3065b2dd373aa43f952a1
MD5 fb10f6d923229c8972de24eb177f36c4
SHA1 4389590b21237a5b452eeec4c8efac94a7733a8e
SHA512 c91ff6f7f7753c9c17bf9b9c1769d6d72dcd56de6b972d934ce993d8f22dd1b6eb6ab2f8dd75f6c515c7c400667667cc9a30f24f1287dd3f399ba451c0647cf8
SSDEEP 6144:tflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:tflfAsiVGjSGecvX
TLSH
T1EB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxvsmkfcx.sys

Path C:\Temp\fzxvsmkfcx.sys
Size 293KB
SHA256 8f5eec8940db0afd4d64ecc5eff6572848e521b9b4a730ca16b6e860a689e7f6
MD5 9587dea135484db48bf8ff210c7a24fa
SHA1 e1a661c3868fe4c3ba3cb7d95875ea8c937860cf
SHA512 047c0b454b2e113f2ffeb7b2ab95973d2a8c82c85abf6ea40de558df3e74ce92941cafda51f7471bbdb6eb33daf356535da18cef821e140142139408512bd582
SSDEEP 3072:otKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:oIJjiJcbI03GBc3ucY5DCSj
TLSH
T13C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_davsnlfdxv.exe

Path C:\Temp\i_davsnlfdxv.exe
Size 361KB
SHA256 0d02515d1b645a3ea7324ba2af56290884ecf8e593e43c1c3ff6bb46a0202ff9
MD5 0dbe0110ca0c6a8ad0ad2b9f8cf0e869
SHA1 454afca12723058a6f656d96a74d5f8c6a46c8a0
SHA512 fd31aa4995381f40ca7c00f24417eeb1b0b7df438e7d188cc55f252a7c7fec26f282d48f3043c27f44709dd933b701870c71ad83832deeb1924ebe3568735d83
SSDEEP 6144:DflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:DflfAsiVGjSGecvX
TLSH
T131747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxspkicau.exe

Path C:\Temp\i_fzxspkicau.exe
Size 361KB
SHA256 a27fc432620b01a383718c6e8abbbb23f19cc44c996db6c64abe591e13f86e9c
MD5 e8f03fa73ba11c2f7ba0b33f0a3ac12a
SHA1 e1effa5b46023905a440bab872ab80dbcd7b7e0c
SHA512 8bed7fd418f590bb40305c78e1ffe7a86358efc696e4b1db67c6579177d077b7e43afd970f31edde7f19b55be0e791e4fd24c5d7d07f616fb344bbb5c23fb1b4
SSDEEP 6144:TflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:TflfAsiVGjSGecvX
TLSH
T166747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ojgbywqljd.exe

Path C:\Temp\i_ojgbywqljd.exe
Size 361KB
SHA256 7c289c4e6a925806c7d127cf8e119b7ad2355d9996a5726cf45e732d592df729
MD5 42c8636623f9a62dd78251708194854d
SHA1 cedd21d056402088bc6524d767ef6dfb7e08a482
SHA512 4b1ff25b8c8952df03cf2ea06c2f06f07547d4287548e545a60d0daff5476b45833c2aa63401d3d9a94d34ff03db99db4462b0ed45ec5e9c011a4b7f583e1d06
SSDEEP 6144:cflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:cflfAsiVGjSGecvX
TLSH
T133747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoigaysqli.exe

Path C:\Temp\i_qoigaysqli.exe
Size 361KB
SHA256 4efe1218169980d5e19fe661a9f674f79f53dd0f21e4402707ca31de7411f420
MD5 2fcd3df1479dc9925a9bd3a88b370bdd
SHA1 2554b7831649c6f7a3e2a5d26f49c9efda209506
SHA512 549fcda2d69c0c1f522cbb0fdf517f1d07d0e1ae16008f4a080c674515fa5062db407b889528d099c085c9d34e1d0b453601225736da1019f804df6a067046df
SSDEEP 6144:lflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:lflfAsiVGjSGecvX
TLSH
T1C0747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trljebztrl.exe

Path C:\Temp\i_trljebztrl.exe
Size 361KB
SHA256 3e61e9f6f4dff5b12f7722a619ba66ea2980edc7ffcfd7fd8a1417ed4289946d
MD5 76202dde278e759f481129e82f2c93a2
SHA1 da0b51d3d42cbb16d8ee451445792526dc7ae633
SHA512 5c024181ff1e29ae97badea1b778fc289273045a2ae4f93b3d7df88351682b1ad349e4ace0a6bfd27ac705519fda60263da2db1f2f8ebb68e77c362f677a17c3
SSDEEP 6144:EflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:EflfAsiVGjSGecvX
TLSH
T1A7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usmkfcxvpn.exe

Path C:\Temp\i_usmkfcxvpn.exe
Size 361KB
SHA256 793cd8fb73179086ac2dcfc38c9653f0eb2717d82dbf8aca4f2ce3420134bcb7
MD5 b59ae6c1729043f3e2fb06b675a860be
SHA1 ccea14c39de2b6ae043c3c049f67cd6b5446ff24
SHA512 77d360104533afee5f7491d8b70a6fcfa0a02a62ae635ccedce5061eec06988d47232be589dd394d2ad4f5da76d7f302540089061365e1970ad990a9cedc6bec
SSDEEP 6144:HflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:HflfAsiVGjSGecvX
TLSH
T1EA747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idavtnlfdy.sys

Path C:\Temp\idavtnlfdy.sys
Size 293KB
SHA256 423cec0d928960f398a89467a79f9afbb91632b3712a7b513035d0d610627a62
MD5 29e9f20cffd4fd46cb75e7a1dd3ee7df
SHA1 30d92c6743a8978ef498f00468b398a1faf63042
SHA512 75632da60e520da5bf2b9c195640ddadf2f8cc39fee06b269e2d443d779a6e9e2b290367321524df16b9ccf85456cc9367e6a0404eb1b57fe2ee2153d9a52e57
SSDEEP 3072:FtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:FIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaxvqnica.sys

Path C:\Temp\ifaxvqnica.sys
Size 293KB
SHA256 8813de95772fe5eac8b7943d5be59d5cb24cf019421d4f834c8c05e0633e81dc
MD5 0204a9219844e77e2f6394547bfed179
SHA1 8133af9688f36e33a9eea874df0b5c562767430a
SHA512 78c19a22cc9b326324004c8fbf6a989b5fa3ffca28716121680f5cffa439353a2bf22fb9e1e4a615ddaa870859baf534e971ad8cc50c95385f990d2eb7f5619c
SSDEEP 3072:ItKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:IIJjiJcbI03GBc3ucY5DCSj
TLSH
T164545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgbywqljd.exe

Path C:\Temp\ojgbywqljd.exe
Size 361KB
SHA256 43ecc0538c92863cf26169e03a92250684318ba042feb5d941b9d80ad3384a10
MD5 6b72c06c63a44311f804bf1e30160579
SHA1 0bb20885291535826e4a1da05c5f75f902c278c5
SHA512 924887c66246f355b3b697c2dcfd6568703dd456c0daab4c4c829201594d524bb04cdaeddff5cdd329058843c865bf82b41ced5662932c5ca0584789ca2c0940
SSDEEP 6144:KflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:KflfAsiVGjSGecvX
TLSH
T1BC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigaysqli.exe

Path C:\Temp\qoigaysqli.exe
Size 361KB
SHA256 0927b90b3892091bab248af1c27af76a20d3839fe361bb0173c0e244f9968381
MD5 4e9e28a6e30de154e2058616c5df314e
SHA1 f689122efa3aee8ecf66fe4b4b49a0212deec202
SHA512 b2fa6f7ae80f760b06edcc786a6d27f76ca1378d96ca020f61ce367dad028946722fcba66610eedd45e148ced6ddb74fbd30ac433488eabaf37b2168a4d450ef
SSDEEP 6144:uflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:uflfAsiVGjSGecvX
TLSH
T1B7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

toljdbwtom.sys

Path C:\Temp\toljdbwtom.sys
Size 293KB
SHA256 f5941ca39903d696c1b97a8c10e0923a471329ce3b7b6b35d20d8f4c3e7195f2
MD5 068d2796b87460c2fe330adaa15d9f51
SHA1 b9a5a92acf822be4f4da7ddf193f2aa743f4268c
SHA512 4df0ef9a408f749d5bd59433e56dc5062ae09b84baea656e3e5283d7dacad2b2d78925b222d20c8790a309c6c514dd854a3f2e8b17e2fc76e3a9937cbc7303a4
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljebztrl.exe

Path C:\Temp\trljebztrl.exe
Size 361KB
SHA256 891754c9647eb1c5cc98277fcd17f256f59195e89b270cf75a7535b1ecabfb9e
MD5 d26e7936088ce115a800bf8df6f77ac3
SHA1 654c40f119a095898d316a689d5d2a60c19c0e48
SHA512 a9afbc20b47dbd78f8fd2801b6899cc096a62665616ebdd7587850d1865059be03593e481d68ea225a6feea94abd9b5c8b9e779a8d1f18f13472da101346c78d
SSDEEP 6144:iflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:iflfAsiVGjSGecvX
TLSH
T1FD747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkfcxvpn.exe

Path C:\Temp\usmkfcxvpn.exe
Size 361KB
SHA256 678d6c9c16f73add3a2ae8ef702cebcda8c70597c7673920926d5527608d8d37
MD5 ed36c08a71b1f3a1a2a755ecb2686af4
SHA1 981647bfdfe6920690ca53ccc1e7d020336dae09
SHA512 e8e3f32954f9d210dbadd84a239b80f0b5b60031ad7e4ff8fbfbdbc58c0a0c46eee879c4c6483bc690e63a669826aae93d171e5e9cef8b476895e089ebd3e62e
SSDEEP 6144:wflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:wflfAsiVGjSGecvX
TLSH
T1DC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqljdbvtn.sys

Path C:\Temp\ytqljdbvtn.sys
Size 293KB
SHA256 b66bb23d52923cc6f353320f5dbd80f55226fd379b998cd7beeeb6258aae7bab
MD5 95d61b3410e4249835b3bc03a499b5de
SHA1 954878800feaca4ec64f629247724e2a334b343c
SHA512 ab848989f415f856dc9a0082e17190d08fbcb4580ac682a3214110879b8dd2206db1179e9febebecc657f15c331d89c5d1de769e46e1749e8e1391d078c9846e
SSDEEP 3072:UtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:UIJjiJcbI03GBc3ucY5DCSj
TLSH
T126545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

7e8e003d-c614-4ed3-8484-685a2050545c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7e8e003d-c614-4ed3-8484-685a2050545c.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 bb086aeb965b793609ffa2555939d2fe170639c5c239d4b1b2ad03e19a6b5650
MD5 28994a5198c7fcb352303a6401befa25
SHA1 719ae858e4e4df8a09ed0e55c2b1e462b4bce595
SHA512 18d65b6f9b479f120cd52aa5b11ec2f8a023ba28c61e64eec6492116fc9956087b8211900619702731decc5d0d6e7c94dd4d9f29a36a08a893d31e89f989e1ad
TLSH
T1E851A68D51C18AE5DBC884B085D010A33A3EB572C7C39E1B0DA4F57A4F7673722660DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a61a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a61a.TMP
Size 2KB
SHA256 47fe3861c230e4df67ff41073160a1941eb07748a531a5176bbc289607578394
MD5 3aac847001b7495173e37bdf994b2cd0
SHA1 7b8b4b5c6bc033727236e1c3dea1f6482d9cf23d
SHA512 365027d68f4e7a1cc1f775eda0df46a7b90ca23411b8644db1b120ef0ee95e88f54baf18372d66384754254f71e90357ac112725994b77d6339e7c06b95e119d
TLSH
T1CA51958D51C18AE5DBC884B085E011A3393AF572C7C39E1B0DA4F57A4F7673322A60DC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 afa31e434263649727707ce0c9dde92da4b47e5a4c77997c905ce6332515c52d
MD5 4d03ae6cdf6f9ff3340b86e8fc7f3172
SHA1 b494502392969f0bf13c55e2d1b1c6008b9a8857
SHA512 9d3eaad3dc80f16d1535354498f592a9a490e9c50c4079ee1b792a30283ef6eaae00a992868e4c47a27452f627a7fe09fc6889db41fafa4fd18ed2e612f7a477
TLSH
T1F251C0F3C7E8866DC90156F4AB186E1BCE2D0964432C7D5AC8E4AF2B93E2471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 efe11150d084cd02b01c54d4b7bc6f27553771f3fabf1747e6b50a65eb603406
MD5 dac2ebfc777af0a5b053b4e197b778c5
SHA1 b973fc6bfe0b71f9a238bfb20235fdfd9167a877
SHA512 ad6603ee897c405d820efcef83f82bf04fed98c8793e8e8c8e5e9c39bd4065371fee4da02909cf10bcc7e667b0ec1d4333035c1f39a79adbeec7137b2d52a068
SSDEEP 192:sxRmR8CE/fOsmcZjx4zoA8p9F/g6+WNCMYZ/YEu8GUIgDLMJ:sxRm1E/fOsmijLb/5SZ/vI
TLSH
T10042C855AD64A97B4CDBD209BB55BF13D3F91033A1811E48EAFD8A2C04E66CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1180006b680f3925a2dec9c2c67a77a7d011cfef869fb7849130f5dfbbd236dd
MD5 c3239e71b6f9ddd7c0aa53eb63ce9dbe
SHA1 f64e9036a0346426dde39c570a3abedc92b795de
SHA512 365a3fd162376137a500f6ac66297e46590a7b9bcd0a95d7f87d8781e2fc938efde775ad99db655e54888ec7041ab2e0d5fa62dfefd90df8c3287e64322507fe
SSDEEP 192:sxRmR8CE/fOsuwcZjx4zoA8p9F/g6+WNCMYZ/YE48GUIgDZMJ:sxRm1E/fOsJijLb/5SZ/Vu
TLSH
T1C042D955AD68A97B4CDBD609BB55BF13E3F91033A0811E08E6FD8A2C14E76CD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1f21d257ae830da55d93a86e99896dc6966cfd3901e4056ff592d0b6501be232
MD5 e48fd5d0d5a3d9048bace7c8266cc493
SHA1 c224f135fee21b4f4d3cf09cbfb55a53d4f125c9
SHA512 5bd0ffbbcdfcb807b6be98f8f0a360bda11cbf5e9e87fe1f1da5f07d548638d3ff3fe4acd9bc3c48ed010d56ae49078f72610f143f37fd086ed72913bca55359
SSDEEP 192:sxRJR8CE/fOsQcZjx4zoA8p9F/g6+WNCMYZ/YEu8GUIgVMJ:sxRJ1E/fOsQijLb/5SZ/v2
TLSH
T19732C855AD68A93B4CCBD209BB55BF13D3F91033A1911E48EAFD862C14E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 5215aa6ff80d6d61ed9ed9c71e80093bad08a383d1d7322c4579bd65e64eb7e7
MD5 95914f0ed002b04eaf755139d7e2d916
SHA1 9e5520d3a2bfebf5325b9f98643b65be8d9cfb53
SHA512 2871f35cd80fe7746614312d2e229ee694054a4af5f308f9fb22414156aa7afd1adb1f959286b982418dc8ce189064497d07b628d3c3fa16ab1db98d61bff8fc
SSDEEP 768:U/pCGx7pLuLbLmWg8KfrL8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhCuyhp1roJVIX:U/pCGnEbLmWg8KfrLu1ja6Cu8pOcX
TLSH
T172D2D97B740CCB7F4F804ADDA8197A9A6DA802CB9A98CD4047FE941D02C67EB91164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3c935a2-140c-44a4-b625-79631ea53c28.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a3c935a2-140c-44a4-b625-79631ea53c28.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 be4ec558c3be6f35840e05086162a2aaa0d0b7251465e4fc6db1e38dec676eb2
MD5 70fdb85dd28cffeac7a6de1f11803b82
SHA1 1eec45f97212af65582d124d716774eab88367dd
SHA512 753746018d5d61d5ad107066197c893d94a0c00a87785a08bcc30ea1966f2290b2c5eea97ff2e80c765f740e5adb25f1ac2a9ef7031da226f959a58424299fee
SSDEEP 768:5v3PCpc7fZrKN1twIp5XSwQs88uBkiT2+s32s40:5v3PvtrC7ILNBr42s40
TLSH
T19CF2AF75E8E48CB36CFA9386778637422FF06057C8C40A58D5EE961E0183B5E274BC6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 c2e5266e9520533079654a7aeb298b5288c0eac0859d1b24d1fb586452aae5e7
MD5 f4d2b79bad7c48781ca011c31cb13ccf
SHA1 5eeadaa88892d921b4b3a48d2d658512bd08888a
SHA512 03722a9613823756e422c81e044af2f4b8cb3606f16fe1108366e808b88cfb303ceea27da201fef417321279c5c6636e60fc9914e7052fd1932db2fcf29228c0
SSDEEP 768:R/UxvxjgC+W3UFUc7fZrKfp5XSwQs88uBkiTCi/P84g:kZj3+W3UJtrMILNBjHg
TLSH
T1B203C039ECD46863ACF3A385375A275BAFF06053C4C41B9849EE7A1E028775D6307897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 797ae632bdb6783cb62e170662548343f7ae8b4d0007d5ad9f5b22863f67b1ad
MD5 22bbca6d2c11a678bfae83479d9965c4
SHA1 c8a7ac07b585aeac23386877c35c27785fed561e
SHA512 15d5b6da645dfcd7e436cefa70c55edb3414f5928fcb1731b2411299559892b1b09002aa372bd6dd79db83edcd1379d0cd8493428001f0ec017240e541196939
SSDEEP 768:Vv3m8pc7fZrKN1twIp5XSwQs88uBkiT2+s32s40:Vv3mBtrC7ILNBr42s40
TLSH
T17AF2AF75E8E48CB36CF69386778637426FF06057C8C40A58D5EE961E0183B5E274BC6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 986721a6b8b30a5a7b9e1db4fc3b6b64196a4f27968e403b342035a90e2a556a
MD5 2ce8a5dee814fc5c7b0b65be022085aa
SHA1 30feb76d6d1977e8e14b221020b595b0298362fe
SHA512 c947f6bcc6a1c81c3b3e6150bef2fb786c657aca42f4827cc593288bf26d2ecdd9d9d97d298c50adc6b0b197ced08081ce06d01db3774734470482c1eaf1deeb
SSDEEP 768:ZFQM3gwgBpRAerKN1twVJp5XSwQs88uBkiT2+s32s40:YM3IzrCm3ILNBr42s40
TLSH
T11E1337F598D38976E8AE8383677D2E025EFCD053B4884984B7D9590DCC826BFC70B856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

ec1e8e5b-ee6e-42c1-9ed4-831b4099ec8d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ec1e8e5b-ee6e-42c1-9ed4-831b4099ec8d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2708_887778263\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 d35461c6e71b44b2cf9b83944b690ec392b712719046cb12d9845d49e4df4f39
MD5 bf06fa4de8db20c3d86281fbf487cc6a
SHA1 db831064c989b01bd4be2b7a76a15a6cdeb2dfbc
SHA512 fbf83e925e0b8a86ac92bf58c37aac5216e0e44eb431848632764a995f89827ca1bbb1625408f64d60ad8b2d4b0f9edf149525efcbbdcd1ff85446f79b86f299
TLSH
T1BA71238357B8C6B3C5DE5FF102835608F5FB22380B2330340B515546AB30A3A24B8F48
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2056-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2160-263-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2420-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2556-432-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2896-462-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3488-411-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4056-467-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4104-488-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4120-235-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4284-366-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4480-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4664-406-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4664-429-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4776-220-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4776-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4800-407-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4800-386-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4800-471-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4888-275-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4976-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5580-337-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5960-288-0x0000000000010000-0x00000000000AB000-memory.dmp

Download