systex | fa1765dbf2fcb5f91428146f80c51b608b1b31938ff4856a8eb762090056265e

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260815-wt77ba11hs
SHA256 fa1765dbf2fcb5f91428146f80c51b608b1b31938ff4856a8eb762090056265e
MD5 50ba3bf85e963a2795d8ab4faa262312
SHA1 6b88b5a6abd5a2e286887cb6285641f5286bd4be
SHA512 9815caef099e9b2b591ef1bbdea6083a4ea1318f8717493411042bc4a59fbd609dcec9657be5c3399fc6e284e7158da11b62b1227ad003b4b8b56e97f3bd8f10
SSDEEP 6144:VflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:VflfAsiVGjSGecvX
TLSH
T100747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1504	vtnlgdyvtnligayv.exe
5516	vtnlgdyvtnligayv.sys
2628	CreateProcess.exe
4132	bvtnlgdbvq.exe
4752	CreateProcess.exe
5516	CreateProcess.exe
1260	i_bvtnlgdbvq.exe
3696	cavsnlfdxv.sys
4528	CreateProcess.exe
4860	vqnifdxvsn.exe
5512	CreateProcess.exe
5732	CreateProcess.exe
5156	i_vqnifdxvsn.exe
3624	hfaxspnhfd.sys
2012	CreateProcess.exe
4520	fzxspkhfcx.exe
3484	CreateProcess.exe
1532	CreateProcess.exe
3508	i_fzxspkhfcx.exe
4896	pjhfcxusmk.sys
3324	CreateProcess.exe
4112	spkhczusmh.exe
2288	CreateProcess.exe
4620	CreateProcess.exe
5960	i_spkhczusmh.exe
5292	kecwusmkfc.sys
5736	CreateProcess.exe
4260	zwromkeczu.exe
5796	CreateProcess.exe
3480	CreateProcess.exe
5332	i_zwromkeczu.exe
1308	bztrpmkecw.sys
1252	CreateProcess.exe
1588	cwuomjebzt.exe
1116	CreateProcess.exe
720	CreateProcess.exe
2096	i_cwuomjebzt.exe
4964	ljgbztromg.sys
2788	CreateProcess.exe
5948	omgebwtroj.exe
3792	CreateProcess.exe
5308	CreateProcess.exe
5316	i_omgebwtroj.exe
2676	gbywqolgdy.sys
1768	CreateProcess.exe
5444	lgdbvtqljd.exe
2708	CreateProcess.exe
1404	CreateProcess.exe
4960	i_lgdbvtqljd.exe
708	gdyvqolgdy.sys
4220	CreateProcess.exe
4568	sqligdxvtq.exe
5860	CreateProcess.exe
5896	CreateProcess.exe
2952	i_sqligdxvtq.exe
5364	ysnkigaysq.sys
3388	CreateProcess.exe
5812	vsqkigdyvp.exe
1272	CreateProcess.exe
6108	CreateProcess.exe
2472	i_vsqkigdyvp.exe
1624	sqnifaxvpn.sys
4856	CreateProcess.exe
5704	spnicaxsqk.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping260_1766474370\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping260_35649253\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping260_35649253\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdbvtqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlfdxvqnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlfdxvqnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlgdbvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnifdxvsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkhczusmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwromkeczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqkigdyvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khcxupmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmhecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlfdyvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxspkhfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwromkeczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdbvtqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqojgbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqojgbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfdaysqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfdaysqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgebwtroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqkigdyvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuomjebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnicaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnicaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmhecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlfdyvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnifdxvsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomjebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqligdxvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khcxupmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlgdyvtnligayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlgdbvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxspkhfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkhczusmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqligdxvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgebwtroj.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1440	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
364	ipconfig.exe
4288	ipconfig.exe
5300	ipconfig.exe
5956	ipconfig.exe
4768	ipconfig.exe
1248	ipconfig.exe
2860	ipconfig.exe
5400	ipconfig.exe
2824	ipconfig.exe
2888	ipconfig.exe
5968	ipconfig.exe
1812	ipconfig.exe
3096	ipconfig.exe
3540	ipconfig.exe
1684	ipconfig.exe
1132	ipconfig.exe
4824	ipconfig.exe
4900	ipconfig.exe
3096	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312912536773980"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{EA0AFE71-3338-45F1-89A5-7243C379A0A2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1504	vtnlgdyvtnligayv.exe
1504	vtnlgdyvtnligayv.exe
1504	vtnlgdyvtnligayv.exe
1504	vtnlgdyvtnligayv.exe
1504	vtnlgdyvtnligayv.exe
1504	vtnlgdyvtnligayv.exe
1504	vtnlgdyvtnligayv.exe
1504	vtnlgdyvtnligayv.exe
1504	vtnlgdyvtnligayv.exe
1504	vtnlgdyvtnligayv.exe
1504	vtnlgdyvtnligayv.exe
1504	vtnlgdyvtnligayv.exe
1504	vtnlgdyvtnligayv.exe
1504	vtnlgdyvtnligayv.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
260	msedge.exe
260	msedge.exe
260	msedge.exe
260	msedge.exe
260	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1260	i_bvtnlgdbvq.exe
Token: SeDebugPrivilege	5156	i_vqnifdxvsn.exe
Token: SeDebugPrivilege	3508	i_fzxspkhfcx.exe
Token: SeDebugPrivilege	5960	i_spkhczusmh.exe
Token: SeDebugPrivilege	5332	i_zwromkeczu.exe
Token: SeDebugPrivilege	2096	i_cwuomjebzt.exe
Token: SeDebugPrivilege	5316	i_omgebwtroj.exe
Token: SeDebugPrivilege	4960	i_lgdbvtqljd.exe
Token: SeDebugPrivilege	2952	i_sqligdxvtq.exe
Token: SeDebugPrivilege	2472	i_vsqkigdyvp.exe
Token: SeDebugPrivilege	2476	i_spnicaxsqk.exe
Token: SeDebugPrivilege	5268	i_khcxupmkec.exe
Token: SeDebugPrivilege	1524	i_zurmhecwup.exe
Token: SeDebugPrivilege	4976	i_ecwuomjecw.exe
Token: SeDebugPrivilege	708	i_eywuomgezw.exe
Token: SeDebugPrivilege	3880	i_ytqojgbywq.exe
Token: SeDebugPrivilege	4200	i_bvtnlfdyvt.exe
Token: SeDebugPrivilege	2876	i_qnlfdxvqnl.exe
Token: SeDebugPrivilege	4872	i_nkfdaysqni.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
260	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 1504	4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 4908 wrote to memory of 4272	4908	2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	91
PID 4272 wrote to memory of 260	4272	iexplore.exe	92
PID 260 wrote to memory of 4980	260	msedge.exe	93
PID 260 wrote to memory of 1440	260	msedge.exe	95
PID 260 wrote to memory of 2816	260	msedge.exe	96
PID 260 wrote to memory of 2816	260	msedge.exe	96
PID 260 wrote to memory of 2816	260	msedge.exe	96
PID 260 wrote to memory of 2452	260	msedge.exe	97
PID 260 wrote to memory of 2452	260	msedge.exe	97
PID 260 wrote to memory of 3532	260	msedge.exe	98
PID 260 wrote to memory of 3532	260	msedge.exe	98
PID 260 wrote to memory of 3532	260	msedge.exe	98
PID 260 wrote to memory of 1032	260	msedge.exe	99
PID 260 wrote to memory of 1032	260	msedge.exe	99
PID 260 wrote to memory of 1032	260	msedge.exe	99
PID 260 wrote to memory of 1648	260	msedge.exe	100
PID 260 wrote to memory of 3872	260	msedge.exe	101
PID 260 wrote to memory of 1648	260	msedge.exe	100
PID 260 wrote to memory of 1648	260	msedge.exe	100
PID 260 wrote to memory of 3872	260	msedge.exe	101
PID 260 wrote to memory of 3872	260	msedge.exe	101
PID 260 wrote to memory of 5868	260	msedge.exe	102
PID 260 wrote to memory of 5868	260	msedge.exe	102
PID 260 wrote to memory of 2620	260	msedge.exe	106
PID 260 wrote to memory of 2412	260	msedge.exe	107
PID 260 wrote to memory of 2620	260	msedge.exe	106
PID 260 wrote to memory of 2412	260	msedge.exe	107
PID 260 wrote to memory of 1668	260	msedge.exe	109
PID 1504 wrote to memory of 2628	1504	vtnlgdyvtnligayv.exe	110
PID 4132 wrote to memory of 4752	4132	bvtnlgdbvq.exe	114
PID 260 wrote to memory of 5012	260	msedge.exe	118
PID 260 wrote to memory of 5012	260	msedge.exe	118
PID 260 wrote to memory of 4896	260	msedge.exe	119
PID 260 wrote to memory of 4896	260	msedge.exe	119
PID 1504 wrote to memory of 5516	1504	vtnlgdyvtnligayv.exe	120
PID 1504 wrote to memory of 4528	1504	vtnlgdyvtnligayv.exe	124
PID 4860 wrote to memory of 5512	4860	vqnifdxvsn.exe	126
PID 1504 wrote to memory of 5732	1504	vtnlgdyvtnligayv.exe	129
PID 1504 wrote to memory of 2012	1504	vtnlgdyvtnligayv.exe	133
PID 4520 wrote to memory of 3484	4520	fzxspkhfcx.exe	135
PID 1504 wrote to memory of 1532	1504	vtnlgdyvtnligayv.exe	138
PID 1504 wrote to memory of 3324	1504	vtnlgdyvtnligayv.exe	143
PID 4112 wrote to memory of 2288	4112	spkhczusmh.exe	145
PID 1504 wrote to memory of 4620	1504	vtnlgdyvtnligayv.exe	148
PID 260 wrote to memory of 5444	260	msedge.exe	150
PID 260 wrote to memory of 2264	260	msedge.exe	151
PID 260 wrote to memory of 4792	260	msedge.exe	152
PID 1504 wrote to memory of 5736	1504	vtnlgdyvtnligayv.exe	155
PID 4260 wrote to memory of 5796	4260	zwromkeczu.exe	157
PID 1504 wrote to memory of 3480	1504	vtnlgdyvtnligayv.exe	160
PID 1504 wrote to memory of 1252	1504	vtnlgdyvtnligayv.exe	164
PID 1588 wrote to memory of 1116	1588	cwuomjebzt.exe	166
PID 1504 wrote to memory of 720	1504	vtnlgdyvtnligayv.exe	169
PID 1504 wrote to memory of 2788	1504	vtnlgdyvtnligayv.exe	173
PID 5948 wrote to memory of 3792	5948	omgebwtroj.exe	175
PID 1504 wrote to memory of 5308	1504	vtnlgdyvtnligayv.exe	178
PID 1504 wrote to memory of 1768	1504	vtnlgdyvtnligayv.exe	182
PID 5444 wrote to memory of 2708	5444	lgdbvtqljd.exe	184
PID 1504 wrote to memory of 1404	1504	vtnlgdyvtnligayv.exe	187
PID 260 wrote to memory of 2992	260	msedge.exe	189
PID 260 wrote to memory of 2992	260	msedge.exe	189
PID 1504 wrote to memory of 4220	1504	vtnlgdyvtnligayv.exe	195
PID 4568 wrote to memory of 5860	4568	sqligdxvtq.exe	197

C:\Users\Admin\AppData\Local\Temp\2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_50ba3bf85e963a2795d8ab4faa262312_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Temp\vtnlgdyvtnligayv.exe
  C:\Temp\vtnlgdyvtnligayv.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtnlgdbvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2628
  - - C:\Temp\bvtnlgdbvq.exe
      C:\Temp\bvtnlgdbvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4132
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4752
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtnlgdbvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5516
  - - C:\Temp\i_bvtnlgdbvq.exe
      C:\Temp\i_bvtnlgdbvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vqnifdxvsn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4528
  - - C:\Temp\vqnifdxvsn.exe
      C:\Temp\vqnifdxvsn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4860
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5512
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vqnifdxvsn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5732
  - - C:\Temp\i_vqnifdxvsn.exe
      C:\Temp\i_vqnifdxvsn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxspkhfcx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2012
  - - C:\Temp\fzxspkhfcx.exe
      C:\Temp\fzxspkhfcx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4520
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3484
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxspkhfcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1532
  - - C:\Temp\i_fzxspkhfcx.exe
      C:\Temp\i_fzxspkhfcx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkhczusmh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3324
  - - C:\Temp\spkhczusmh.exe
      C:\Temp\spkhczusmh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4112
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2288
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkhczusmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4620
  - - C:\Temp\i_spkhczusmh.exe
      C:\Temp\i_spkhczusmh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwromkeczu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5736
  - - C:\Temp\zwromkeczu.exe
      C:\Temp\zwromkeczu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4260
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5796
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwromkeczu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3480
  - - C:\Temp\i_zwromkeczu.exe
      C:\Temp\i_zwromkeczu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwuomjebzt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1252
  - - C:\Temp\cwuomjebzt.exe
      C:\Temp\cwuomjebzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1588
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1116
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwuomjebzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:720
  - - C:\Temp\i_cwuomjebzt.exe
      C:\Temp\i_cwuomjebzt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgebwtroj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2788
  - - C:\Temp\omgebwtroj.exe
      C:\Temp\omgebwtroj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5948
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3792
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgebwtroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5308
  - - C:\Temp\i_omgebwtroj.exe
      C:\Temp\i_omgebwtroj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdbvtqljd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1768
  - - C:\Temp\lgdbvtqljd.exe
      C:\Temp\lgdbvtqljd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5444
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2708
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgdbvtqljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1404
  - - C:\Temp\i_lgdbvtqljd.exe
      C:\Temp\i_lgdbvtqljd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqligdxvtq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4220
  - - C:\Temp\sqligdxvtq.exe
      C:\Temp\sqligdxvtq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqligdxvtq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5896
  - - C:\Temp\i_sqligdxvtq.exe
      C:\Temp\i_sqligdxvtq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsqkigdyvp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3388
  - - C:\Temp\vsqkigdyvp.exe
      C:\Temp\vsqkigdyvp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5812
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1272
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsqkigdyvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6108
  - - C:\Temp\i_vsqkigdyvp.exe
      C:\Temp\i_vsqkigdyvp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spnicaxsqk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4856
  - - C:\Temp\spnicaxsqk.exe
      C:\Temp\spnicaxsqk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5704
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4864
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spnicaxsqk.exe ups_ins
    3⤵
    PID:3048
  - - C:\Temp\i_spnicaxsqk.exe
      C:\Temp\i_spnicaxsqk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khcxupmkec.exe ups_run
    3⤵
    PID:2668
  - - C:\Temp\khcxupmkec.exe
      C:\Temp\khcxupmkec.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1216
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4144
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khcxupmkec.exe ups_ins
    3⤵
    PID:2368
  - - C:\Temp\i_khcxupmkec.exe
      C:\Temp\i_khcxupmkec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zurmhecwup.exe ups_run
    3⤵
    PID:3280
  - - C:\Temp\zurmhecwup.exe
      C:\Temp\zurmhecwup.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1476
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4984
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zurmhecwup.exe ups_ins
    3⤵
    PID:4464
  - - C:\Temp\i_zurmhecwup.exe
      C:\Temp\i_zurmhecwup.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwuomjecw.exe ups_run
    3⤵
    PID:6012
  - - C:\Temp\ecwuomjecw.exe
      C:\Temp\ecwuomjecw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2472
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1596
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwuomjecw.exe ups_ins
    3⤵
    PID:1796
  - - C:\Temp\i_ecwuomjecw.exe
      C:\Temp\i_ecwuomjecw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywuomgezw.exe ups_run
    3⤵
    PID:3540
  - - C:\Temp\eywuomgezw.exe
      C:\Temp\eywuomgezw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2364
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2928
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywuomgezw.exe ups_ins
    3⤵
    PID:5792
  - - C:\Temp\i_eywuomgezw.exe
      C:\Temp\i_eywuomgezw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ytqojgbywq.exe ups_run
    3⤵
    PID:1360
  - - C:\Temp\ytqojgbywq.exe
      C:\Temp\ytqojgbywq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:828
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1812
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ytqojgbywq.exe ups_ins
    3⤵
    PID:2892
  - - C:\Temp\i_ytqojgbywq.exe
      C:\Temp\i_ytqojgbywq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtnlfdyvt.exe ups_run
    3⤵
    PID:4588
  - - C:\Temp\bvtnlfdyvt.exe
      C:\Temp\bvtnlfdyvt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2844
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2132
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtnlfdyvt.exe ups_ins
    3⤵
    PID:2252
  - - C:\Temp\i_bvtnlfdyvt.exe
      C:\Temp\i_bvtnlfdyvt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnlfdxvqnl.exe ups_run
    3⤵
    PID:6024
  - - C:\Temp\qnlfdxvqnl.exe
      C:\Temp\qnlfdxvqnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5540
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3576
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnlfdxvqnl.exe ups_ins
    3⤵
    PID:5440
  - - C:\Temp\i_qnlfdxvqnl.exe
      C:\Temp\i_qnlfdxvqnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkfdaysqni.exe ups_run
    3⤵
    PID:2200
  - - C:\Temp\nkfdaysqni.exe
      C:\Temp\nkfdaysqni.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5880
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5040
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkfdaysqni.exe ups_ins
    3⤵
    PID:4324
  - - C:\Temp\i_nkfdaysqni.exe
      C:\Temp\i_nkfdaysqni.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4872
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffa03a0c188,0x7ffa03a0c194,0x7ffa03a0c1a0
      4⤵
      PID:4980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2100,i,17815971753870291047,842753734293804284,524288 --field-trial-handle=2500,i,15557910288524420656,2878820715479372833,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:11
      4⤵
      System Time Discovery
      PID:1440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2016,i,10044421362117107597,14342822435565538109,262144 --field-trial-handle=2500,i,15557910288524420656,2878820715479372833,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:2
      4⤵
      PID:2816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,1073538408740744418,629179194733498757,524288 --field-trial-handle=2500,i,15557910288524420656,2878820715479372833,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:13
      4⤵
      PID:2452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,3719408183583639485,18079578615443601947,2097152 --field-trial-handle=2500,i,15557910288524420656,2878820715479372833,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:3532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,16696391652869006016,2396371718427058962,2097152 --field-trial-handle=2500,i,15557910288524420656,2878820715479372833,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:1032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,5368635147962606517,7597941068985833356,2097152 --field-trial-handle=2500,i,15557910288524420656,2878820715479372833,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:1
      4⤵
      PID:1648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,8924812371915307908,12801060153722599079,2097152 --field-trial-handle=2500,i,15557910288524420656,2878820715479372833,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:9
      4⤵
      PID:3872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,16889771494713143808,6518123452808652847,524288 --field-trial-handle=2500,i,15557910288524420656,2878820715479372833,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:14
      4⤵
      PID:5868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,10805595062027990299,16520609850285964365,524288 --field-trial-handle=2500,i,15557910288524420656,2878820715479372833,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
      4⤵
      PID:2620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,2454556156133201175,10572971158377925276,524288 --field-trial-handle=2500,i,15557910288524420656,2878820715479372833,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
      4⤵
      PID:2412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,1761167136329422800,11703496203065173215,524288 --field-trial-handle=2500,i,15557910288524420656,2878820715479372833,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
      4⤵
      PID:3224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,1761167136329422800,11703496203065173215,524288 --field-trial-handle=2500,i,15557910288524420656,2878820715479372833,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
      4⤵
      PID:1668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,12236234993597643103,914942477500535066,524288 --field-trial-handle=2500,i,15557910288524420656,2878820715479372833,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,4315128930806927607,5660896616301835186,524288 --field-trial-handle=2500,i,15557910288524420656,2878820715479372833,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1324,i,15388138602501379532,9411687209955133480,524288 --field-trial-handle=2500,i,15557910288524420656,2878820715479372833,262144 --variations-seed-version --mojo-platform-channel-handle=1444 /prefetch:14
      4⤵
      PID:5444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1332,i,14103481975394693137,5845095627538273415,524288 --field-trial-handle=2500,i,15557910288524420656,2878820715479372833,262144 --variations-seed-version --mojo-platform-channel-handle=1328 /prefetch:14
      4⤵
      PID:2264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1320,i,10958417121942383516,3312621604860621983,524288 --field-trial-handle=2500,i,15557910288524420656,2878820715479372833,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
      4⤵
      PID:4792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,14926530134711534707,761195164862883570,524288 --field-trial-handle=2500,i,15557910288524420656,2878820715479372833,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
      4⤵
      PID:2992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,9498098700819490945,18024598458192735430,524288 --field-trial-handle=2500,i,15557910288524420656,2878820715479372833,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
      4⤵
      PID:3064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6540,i,8731123853996227687,14306807014661127700,262144 --field-trial-handle=2500,i,15557910288524420656,2878820715479372833,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:10
      4⤵
      PID:1364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,11621551986234831300,14170261112868410513,524288 --field-trial-handle=2500,i,15557910288524420656,2878820715479372833,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
      4⤵
      PID:3076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1508

C:\Temp\vtnlgdyvtnligayv.sys
C:\Temp\vtnlgdyvtnligayv.sys
1⤵
- Executes dropped EXE
PID:5516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4628

C:\Temp\cavsnlfdxv.sys
C:\Temp\cavsnlfdxv.sys
1⤵
- Executes dropped EXE
PID:3696

C:\Temp\hfaxspnhfd.sys
C:\Temp\hfaxspnhfd.sys
1⤵
- Executes dropped EXE
PID:3624

C:\Temp\pjhfcxusmk.sys
C:\Temp\pjhfcxusmk.sys
1⤵
- Executes dropped EXE
PID:4896

C:\Temp\kecwusmkfc.sys
C:\Temp\kecwusmkfc.sys
1⤵
- Executes dropped EXE
PID:5292

C:\Temp\bztrpmkecw.sys
C:\Temp\bztrpmkecw.sys
1⤵
- Executes dropped EXE
PID:1308

C:\Temp\ljgbztromg.sys
C:\Temp\ljgbztromg.sys
1⤵
- Executes dropped EXE
PID:4964

C:\Temp\gbywqolgdy.sys
C:\Temp\gbywqolgdy.sys
1⤵
- Executes dropped EXE
PID:2676

C:\Temp\gdyvqolgdy.sys
C:\Temp\gdyvqolgdy.sys
1⤵
- Executes dropped EXE
PID:708

C:\Temp\ysnkigaysq.sys
C:\Temp\ysnkigaysq.sys
1⤵
- Executes dropped EXE
PID:5364

C:\Temp\sqnifaxvpn.sys
C:\Temp\sqnifaxvpn.sys
1⤵
- Executes dropped EXE
PID:1624

C:\Temp\ecauspnicz.sys
C:\Temp\ecauspnicz.sys
1⤵
PID:4800

C:\Temp\mkfcxupmhf.sys
C:\Temp\mkfcxupmhf.sys
1⤵
PID:3220

C:\Temp\cwurmkebzw.sys
C:\Temp\cwurmkebzw.sys
1⤵
PID:3240

C:\Temp\ebwuomgeyw.sys
C:\Temp\ebwuomgeyw.sys
1⤵
PID:2496

C:\Temp\ywqojgbywq.sys
C:\Temp\ywqojgbywq.sys
1⤵
PID:620

C:\Temp\lgdbwtolge.sys
C:\Temp\lgdbwtolge.sys
1⤵
PID:3596

C:\Temp\ysqlidbvtq.sys
C:\Temp\ysqlidbvtq.sys
1⤵
PID:4820

C:\Temp\qkifaysqki.sys
C:\Temp\qkifaysqki.sys
1⤵
PID:4372

C:\Temp\ifaxspkhfz.sys
C:\Temp\ifaxspkhfz.sys
1⤵
PID:4488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtnlgdbvq.exe

Path C:\Temp\bvtnlgdbvq.exe
Size 361KB
SHA256 b8ae3c9daea7cd0bca0d59ee8b39d00140b331e7534e515586b8b413a5f85ba2
MD5 2206c3f0e3fac54c141fb15b8d00fb56
SHA1 3d747ba2647d47e46b866e52355f69620231a64e
SHA512 283c058add3d56b248ef0bb5bb32ddef6322a1ea9f62e1dd8a26e228c7829cb1cb067e3a59d431bb9dcc784030423a9b25524154b35a58f96db0ac15fc25063c
SSDEEP 6144:/flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:/flfAsiVGjSGecvX
TLSH
T1BF747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrpmkecw.sys

Path C:\Temp\bztrpmkecw.sys
Size 293KB
SHA256 33eae3c0a364f16bf5be7674c4cad183a96a7713d661f91bbf6e2d7b1fc4588e
MD5 e7533e0a48a892bfd0d5d7e72751311b
SHA1 dd00a5f2b3603defd21e64551fce89afb27e6e3f
SHA512 bdc8a83b25bad54c7d6bceda860359c3e1757c3becd504227ceec12ba18859faa00b16c4eb959d42f857b3c0e107d691b8d0a7b0294087ae31bf7cd55a6e8411
SSDEEP 3072:DtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:DIJjiJcbI03GBc3ucY5DCSj
TLSH
T177545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cavsnlfdxv.sys

Path C:\Temp\cavsnlfdxv.sys
Size 293KB
SHA256 8bfabed351ff06d81b8bf5674f26064c0a555f7bb71f7b8f6ea4c73b1eb23d63
MD5 4a3e2fd41e89b1d82dc76834ff20c2ff
SHA1 eca285ff4a9864c2bb1cffbcd9cad993752d82d9
SHA512 d322af6d706dd93184b06857b2f5783c709057e4e247f074359f95e5a9b14ee52ca185117b8af6e2545ff3947d7100a658cbe3a5660f95c38806ecfb0bd26241
SSDEEP 3072:RtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:RIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C1545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwuomjebzt.exe

Path C:\Temp\cwuomjebzt.exe
Size 361KB
SHA256 2bdae7bfdc61a0dbf7575d422aac10465fd1266c2abf78438f8d9deabb721aa8
MD5 d366f7d28f3c92674625b0cda91d27be
SHA1 952e7ba2837c939fa961f18427e0fc729d15afd1
SHA512 01bfc045f62e91d301b639f7346ffaa15037416b0b066cd4762bff82594cb7c8a5173c1296186ca590a176b28295bcc66181ae9ef390d77d71d1623b09dcb73b
SSDEEP 6144:JflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:JflfAsiVGjSGecvX
TLSH
T15B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxspkhfcx.exe

Path C:\Temp\fzxspkhfcx.exe
Size 361KB
SHA256 bd7cbb45dbb2bc182fb62a88817bc9dc8e74fd9f93ac83fa5e86c2889d111edb
MD5 b51130165a09e61bc6b2d9d0869ca76f
SHA1 69426d2b9491c1d97b5e99f5a636d8f9df8054d3
SHA512 c19de6025f52a3bc71ab6616b731dfc6aed6d83e15af1fdf018a18fbcf4e7fff4922047c9302e8fd03dc3bee92dff1e6b62c7eaa2636702f6423bbfdf0661fd6
SSDEEP 6144:7flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:7flfAsiVGjSGecvX
TLSH
T170747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfaxspnhfd.sys

Path C:\Temp\hfaxspnhfd.sys
Size 293KB
SHA256 e358d2c66f82c8341d16800835b3daca5d347e4b0aa74b9473eb422d90627b79
MD5 421336e16a752d552849dde0c0897af9
SHA1 73bac8162fc4e9b5830423bd4013c899d6c89d2e
SHA512 f82737c6fe170b9a8973c34115b6e97776a0bb576f84278bc680a556398639c0b91a2a282a761861b13e6f97b87bf6e3791a243e2e50653fe407759191672b57
SSDEEP 3072:7tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:7IJjiJcbI03GBc3ucY5DCSj
TLSH
T1A2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtnlgdbvq.exe

Path C:\Temp\i_bvtnlgdbvq.exe
Size 361KB
SHA256 7f93c9f9eb6c29b31f737d865784531a52078834f003577a46d1675acb133035
MD5 8c3b602910eca75eaec4efcae63711e3
SHA1 9bc6cf874d788c252818e6f1f1f69d3f9e597eed
SHA512 0307be9bb134cfe0a5d8291bea861c5a79f260ba30e41baeb8dba6452c52964fea9286ddf08b97fcbca8690c6dbb163cd005c68ec3e6528476133aa7d33bf3bb
SSDEEP 6144:5flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:5flfAsiVGjSGecvX
TLSH
T1D5747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxspkhfcx.exe

Path C:\Temp\i_fzxspkhfcx.exe
Size 361KB
SHA256 6cb734a91f909ad2a623accfa668e827f3a59edd62baa4290df0e5f56dcd2276
MD5 b68183bdf9505661edf8706367ad2378
SHA1 a7a44ec754d7b69b35371679481c19f6abe33693
SHA512 c38f9620ee2bbb3036cf1173297569ca35bd355d32bb70c18628101d3882475b08dcf7f0c437596127a416cdfe607000c060c6efe7689b0cdcb3ec0ac65197c5
SSDEEP 6144:TflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:TflfAsiVGjSGecvX
TLSH
T1AB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_spkhczusmh.exe

Path C:\Temp\i_spkhczusmh.exe
Size 361KB
SHA256 57ce8282e1452ce4b072ed96648741f16c73526b81e8c459b1fd3db203b8d21d
MD5 5a32913fae220b19637110b327188e36
SHA1 27c0ff8e0bacee0ce5a618eadb18badfca1b3083
SHA512 68c4b20ae79f6dad49fb7486a80623582053b4f1f7dab30add651b3a7cd77d1ac10428154a843dfc1e32bddb436eb6c6a9cffca619bbf2c4969defcedb63af3b
SSDEEP 6144:VflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:VflfAsiVGjSGecvX
TLSH
T146747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vqnifdxvsn.exe

Path C:\Temp\i_vqnifdxvsn.exe
Size 361KB
SHA256 683b266946b17f870434f2a44dbee8e84574bb3a7ec29b08d96a1159767aa1b3
MD5 3c4c868254127417905196a27e862a9b
SHA1 d4719288d82151e8d052ce088ad402b303e25101
SHA512 1527b0a7013f162575a1af9c4c35385a49f1cc59767b45a290578fbe1cf432b01ab4dcf89eae39f08a2c105d80e2b186872772c56755cbe794d37a3fb8cd4da2
SSDEEP 6144:EflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:EflfAsiVGjSGecvX
TLSH
T1C6747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zwromkeczu.exe

Path C:\Temp\i_zwromkeczu.exe
Size 361KB
SHA256 667d5835ea1fb1ec7175ba8fe9d33cbb4733734f457eef8b5206a49de1623222
MD5 5e784108ad5b5b0f06941902aad08a2d
SHA1 b895202de5be6794d29287b57a8aebc3d8ddcf94
SHA512 d52fb1427a4b9ec936e95f8fb74c866fb3c9418f69ec9cd1fbebf309e592f5b871526e61b6a5a1e69e4f911de639e9e0f9fc1f1f659b0b2b6f1cc74fd466fca3
SSDEEP 6144:rflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:rflfAsiVGjSGecvX
TLSH
T12A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwusmkfc.sys

Path C:\Temp\kecwusmkfc.sys
Size 293KB
SHA256 82baed31e9b43dc86beee4c544b40a3e3d18d9491272ec8d189b6513218c6b13
MD5 1d494e5ce3b224c610d2156ce0defb8a
SHA1 2ca02047ecb89dfcdd471de872eb2fd73a794129
SHA512 54fb25b114d4db19a99804da1aaf957b1634af02146643acbf4faf51b1405a8bea231610350f49809e7a1b09406eb71032710abc766b1f631614f33d0d14d2f0
SSDEEP 3072:HtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:HIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhfcxusmk.sys

Path C:\Temp\pjhfcxusmk.sys
Size 293KB
SHA256 035ac1d1fbb9c51d83afa09da13f48d21412265c9bed37896b715e4c57b3d204
MD5 ddabfc334d1de18fe81f1814a27da85c
SHA1 934ae743a02dc3e66a7a2970e222b33045f96984
SHA512 9d5f6aa545619edb02656d76a6346445e3d0a67b2931502368f529cdffa491f4907ded7c7162af99721251d35f2c2285843cf064c95576a84e637fd0d626db48
SSDEEP 3072:XtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:XIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkhczusmh.exe

Path C:\Temp\spkhczusmh.exe
Size 361KB
SHA256 d8eab3ffc5ad227643f1fb158f3116962341259ad7e8c56d21e74f566a42b7ad
MD5 45cdd20a69c05986c7b192501f68d26d
SHA1 ae5fe7820317c0dbe30e254bc871c069f62af575
SHA512 24abb2211597b88c7d96f79c540e5baaea3b766df7a79376953c4bd76462d15154afeaae7dba771cc25304c39a13220ab3d88c63efcb5d78c1189c7c76eb0121
SSDEEP 6144:WflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:WflfAsiVGjSGecvX
TLSH
T1A5747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqnifdxvsn.exe

Path C:\Temp\vqnifdxvsn.exe
Size 361KB
SHA256 2213695c2381073c91245d11c09636feeb9361445a7cbcb7c1c0c70a7bd0378d
MD5 edb0947d9f702a8632cfe1617809f66a
SHA1 d5d6d0f50eb0d511e0eac15b61726a088b634d34
SHA512 b4a9c5ed69dceb7b5a4017ac6e7bd7a12529809ae7dd43acccb73add6ac5f1ad22b041a3418b41e3d0a01bbc93798a84bedf52d7eaebc57d60b4b509ac070676
SSDEEP 6144:/flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:/flfAsiVGjSGecvX
TLSH
T13B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlgdyvtnligayv.exe

Path C:\Temp\vtnlgdyvtnligayv.exe
Size 361KB
SHA256 8ee99956e83248400c8014404ddd118ab2be7b220c1619c6ac31c61b0aca99a9
MD5 2dc81265d4df2b4789e741339d6e4456
SHA1 9dfafde775b05eea51557cf0ba6b7a0aa096b68f
SHA512 7c59e83ad0570c74ba7c6c67de098237586a9f326a71c3587ff68c670a72ea6c70d80175bc9ecc41d4f32b1703a3b18ed0594afeb29196c0fbc0db1c01db7e28
SSDEEP 6144:DflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:DflfAsiVGjSGecvX
TLSH
T10D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlgdyvtnligayv.sys

Path C:\Temp\vtnlgdyvtnligayv.sys
Size 293KB
SHA256 130008df1bdbade43fd45012cc43c927c36d1e87391060fe1e7293133f7d00b0
MD5 7f28fd446ea880e34a3cdb2604c888ba
SHA1 317563e278bee53b1f35bb3605b464c5c46fcd48
SHA512 80e50e07d27f405f3008f42165bf6f94a533c31804093e9cc0d0b13f32a0f99df5407cd5c2312917d29437c9f50656fcb757fa9dae596e81dcd5915159e4d0fd
SSDEEP 3072:NtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:NIJjiJcbI03GBc3ucY5DCSj
TLSH
T17E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwromkeczu.exe

Path C:\Temp\zwromkeczu.exe
Size 361KB
SHA256 b9f231e7a6b9a1e4ef16dfe28545888743d0dce3c2efd3eac99d2bcaca942b31
MD5 b06a0fad00325db56f554c25386d28e3
SHA1 1f01729ce37cde515a7c19f8bc5b531f0770a7ff
SHA512 f440be3bf2d5ef0a32a3cd0943acc7448c7246b69d97afcafe0953fc85fd238a95ee5bb85409ed0498d946470ae668876824f6168cb35ef255aebed5f1355604
SSDEEP 6144:zflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:zflfAsiVGjSGecvX
TLSH
T1D1747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 df42d6914da621517b53f373cd649700bd8f5138d2c0483d4453e9d050811b1c
MD5 8d664dc1d2a011a4c5fc9c98696f4915
SHA1 637977162df00ac3c9df3d6dcee554269d8e9689
SHA512 1f8b69bacb0591dc68d4ae0fa219f6adf6520d616363d0d291951563790874a1eaf05a4302487f55ae8a2b6ff9f34f00ed2edee1e6aa4164a09f6befd95d7fe5
TLSH
T1895162501326D9DEDB547BFC20E26F67767ABABA4A876ED34050EDBB5D0230CD20142C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59efd5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59efd5.TMP
Size 2KB
SHA256 5b61d2e8fe5e3c2f328bd90688ebaa168b4bf5e0dce25cb5338ea570e293be66
MD5 5ef9f23d3af2b72152abb5c5964a1313
SHA1 c6150a4824078836a4d540b151a8453cfb01e45a
SHA512 3cc675e3d1a3de21277332a4413d2163a13f0031f080a59f6e9bf29d91e4a3bbd5b8d57e7b3a50822c16ada3ad8f2518fb3a78aebc2587c3309e3e5fe4305a4c
TLSH
T1155162500726D9DEDB547BFC24E26F67767ABABA4A879ED34060EDBB5D0230CD20142C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3515c929800d0a560e591f7297edac0b6d71c118b7543a69827a2ee552722b93
MD5 18dd2411a2dda7ef94bcffd377370e70
SHA1 4508f1ec19aecd5f0dccdcc23ea3eba5882eef93
SHA512 78077cfd4eb96cc21edac155d026ce18fd7c7f634c51185db1ab83e2b2e676c971b905ac0bac45dd0e82ead932b712613ce61c1e73c0a3b6f6007bded815909d
TLSH
T19C41BEF3C3F4857E990156F0AB146E1BCE2C0515832C7C5AC9E4AE2B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7601b1cf557803e22dc8fc681e4b7b832dbcccdb8cc766abf8bbfed19e310146
MD5 1e1d3fbbf204f6a5dafa926556209d13
SHA1 d06050c9c901ca80cfdf86b8ea64cfd364b0f2cf
SHA512 8f07b629b21b019aaebd64d77c50938334439e5df4f2a0ef628214a98e271c024da94d975ab916dea32ab26d8b6a081fdee117f7932636502fa00ed78d5b50b9
SSDEEP 192:sxRpR/Ce/fsso5pZVSrzoA8p9S/g6+WNCGS/YZ7tqAsRGCBIgVUJ:sxRpoe/fsso5nVSKA/5K/7Tta
TLSH
T1A242A815AD68A93B8CC7E21DBB657F53E7F91032A1D51E48AAFC8A1C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 af6db551af088c469d2a7fb78c6b591ec29203b5dd23cc414d5b5b0a1159725c
MD5 5ee51879e0bf43be9a3da6bafc17041f
SHA1 3f1edd9a03c4d34607ee25aab85b598bc90ac9c6
SHA512 3a696ecdd6063039d32d779739864374901dc6baa91cf7d9d5b7a33706bf1ecdbc1ac14b8bb62253523a64686dcacc3e9f53a311a4094af9efc5d67c5e47f3b5
SSDEEP 192:sxRaR/Ce/fssx5pZVSrzoA8p9S/g6+WNCGS/YZ7tSYsRGCBIgDSUJ:sxRaoe/fssx5nVSKA/5K/rTtf
TLSH
T14242A855A968A93B9CC7F21DBB657F53E7F91032A1D11E48AAFC8B1C04E76CD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f0a2c9729acdab1629f483664ac84c3293a3284d4d84ec08cb7e4603fb0b6358
MD5 14c53c80c807ffa4d18bdc7df5e83689
SHA1 e2f7378c5396f329ebac52aeb3d3fdc8b943b423
SHA512 4500b44001b7e32378987d8899d02e65628f4d65c31bbe053fafa18298acbeb58b61a5a7df6adb582067d07a0cbf21b6e0d8374dacff635603c37fd424da2332
SSDEEP 192:sxRaR/Ce/fssx5pZVSrzoA8p9S/g6+WNCGS/YZ7tqAsRGCBIgDAUJ:sxRaoe/fssx5nVSKA/5K/7TtZ
TLSH
T15042A915AD68A93B8CC7E21DBB657F53E7F91032A1D11E48AAFC8A1C04E76DD120380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 a04609c55d248814cf689f12794f94de3c088878762136f6b384a6c67614ed0c
MD5 e80bad81565707acc0fd9e9ed3c97229
SHA1 9f6f83b4417a49356f4533eff6072c54cfde92fb
SHA512 2ea3610808460ce8049ac0c61fa14f6ab88bfb33ce01d8fbd1f7870e79f2b9cd88363753685549bd1a3f35aefa4dda2caa5fbc77a96d6a608a6890780b6a19d3
SSDEEP 768:ky2StS7pLuL7evWgd5f/b8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6muSV4hCrow+V:ky2StqE7evWgd5f/bu1jatmuU4hZ3V
TLSH
T101D2D97B640CCB7F4F804ADDAC197E9E6DA802CB9698C98047FA951C03C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a88f8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a88f8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 eb3496cfcaa2619db559cf83b4112fbd44c42f5003fef59dd42ef65e818e2a4a
MD5 24ef6b815b0b78a814c9e40a107ef49c
SHA1 b009481088b2ca47629544729a64f6c7510c6616
SHA512 6b003f75c41b33fbd2a9789e6bb04d882a8dcd3dea7297c0ba41797473d635281a0c56ccd0cc5d431545af544612605972589ff148eddae6fb4a0934374f05e7
SSDEEP 768:R73LnqzcL8cL86Aam6aQMGdjWca4Ghf9skzi:R73wUmaME6pske
TLSH
T10DE290715CA8DC739CA7A295F66B2783FEF0117388D84E84D9E99B0D429315E270BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 915848b7096c7a317bce5d5db7bba2f789036cc80e223e5b36046168142f71be
MD5 38bd3be52b9205d38f94cb06ab7a58d8
SHA1 8dfc4ecba5a2f51fcaad1d25770069ae5ab43beb
SHA512 2eb8c47b2396c9c8df1f10bf97d9c05bbf2f05c0de0fe090db7c870f72e8667e36e1d504799d488dc782299e7c4701641e050c304a544876a28d56c5813b56a8
SSDEEP 768:/rv+4UNbdq3DdqzcL6AAam6aQMGdjWca4GhfBtPeU/:/bsbc3aKmaME6p1H
TLSH
T13FF2AE31A86C9573DDB79A99F21B6787BFF021A384D40E84D9D95B0D839708E230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 80c139872968971131c7d8b99b51c22c623a585186f6304c243021e481d9b2d8
MD5 83f24639c9822c3425ffdd0b64edb6e6
SHA1 cfc92e6000163c622ceeefbc00955ef0195479e2
SHA512 40483f8145bd02f52362a245ee8e91df609e124fc7b6c6830b79609cb80973203adb5152d84129a5dfa1ab689eaf16373863afbf5f2e9c29cbace88a92a4f82c
SSDEEP 768:p73WnqzcL8cL86Aam6aQMGdjWca4Ghf9skzi:p73XUmaME6pske
TLSH
T1D0E290715CA4DC738CABA295F66B2783FEF0117388D84E44D9E99B0D029315E270BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 e2334836ae906006308be892b9ee3969f97fdda7f71c0d5d5bf7bc17dff5735f
MD5 eb5cec6191757e5e85121cc1e3e70e04
SHA1 6006b9328bf7264d962cbc642994c314f33d3a05
SHA512 55c4af3868558c8bcadb0f6d7c5abf5e7fc9265c4ad74c94b6bc1d540a54008bce245c098494dc98835fd58a218a21ccc5501ec689c0b35edf822feeeff19883
SSDEEP 768:7rv+4UNbdY3PnqzcL8cL8sAam6aQMGdjWca4Ghf9skO+:7bsbq3EemaME6pskl
TLSH
T1A0F2B031A86CD9339CB7A295F22B6783BFB011B388C44E84D9D55B0D429718E370BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 bd246b0c3f703977c33080b3019fc77e0480bbc89ff304c8488d948f0f3a12a0
MD5 dca38f60722ec7e81fa5e1b0ff132336
SHA1 32e2800aa53b5eb8dc957aa3d2a7e9c49fe7544f
SHA512 7b0392ba976e5a9f26f481b32a45a7e092641965f5bf45fd53d18719b9951dbd1f623357f8d445baeaa358bf00f025e98120df1623050d22c7b413e4e8aa6512
SSDEEP 768:aFQA3uwgv7VcL8cLaAam6aQMGdjWca4Ghf9skzi:BA36maME6pske
TLSH
T1540306F198D78937D8AE5787A73D6E429DBCC163B4884984BBD45E0CCD821BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e363950f4528bad8c96927e722b96e3b41e99049a089dfa49dc5ba1203d03fd3
MD5 1e38269333dfa88acfae73efc9416b08
SHA1 4b98144714cca94bbf83823c8bb6a8d38529e718
SHA512 b02c48df139fb484d82cf583e0cafc8882a0f0932d4294813969c90fbe3f0499b681255d824b5bd08e2f1acccb4a6faa8420a4f802b83c3bb94f44a0fc8f5777
SSDEEP 768:Prv+4UNbdq3sdqzcL8cL80Aam6aQMGdjWca4GhfwskPeU/:Pbsbc3HWmaME6pBkH
TLSH
T13FF2BF31A86CD9339DB7A295F25B6787BEB021A388C40E84D9D96B0D429718E370BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir260_959367295\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 14df0ae5f15718fcc93ad72ecdecd5769a5800db2f1265457911713b75dfc96b
MD5 ad13de0ef9c52152859e4fd863285918
SHA1 079c9757630b176a91fe47f990548fb78017c002
SHA512 1897ed4252940d77331b0d5151dfe156fbebfe9d9932d563201c4ecc7d9dcb5a195cfe064b58188e78fc527f1eb6107178f21cbb492a281cd908cd4ea177afe1
TLSH
T1D671239357A9C9F3C1DE5BF102835644F5FB26380723302007A15586EB70B7A68B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/620-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/708-338-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1308-310-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1624-367-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2496-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2676-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3220-392-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3240-400-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3596-429-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3624-241-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3696-205-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4372-444-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4488-465-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4800-379-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4820-433-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4896-269-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4964-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5292-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5364-358-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5516-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download