systex | fff27aa8dc960664f7b22fb85a6ed1c6890b7ee212b42222c691ae1fcff9afa0

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 01:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260819-bykllathkf
SHA256 fff27aa8dc960664f7b22fb85a6ed1c6890b7ee212b42222c691ae1fcff9afa0
MD5 948ec7a09783dbb933dae0b7e6d17161
SHA1 f065276e1e41bde30dd42f705568faa635a50539
SHA512 b306127aeb249f626c055ef88488f74b01e315a492d5966e4bd560267830866852f27c4b552d7bb281d026b36f3a2849ca9f97595e39b6cf3ca42a1eaef1072f
SSDEEP 6144:ZflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:ZflfAsiVGjSGecvX
TLSH
T1D7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5828	bvtolgdywqoigayw.exe
3276	bvtolgdywqoigayw.sys
1248	CreateProcess.exe
4464	jdbvtnljdb.exe
4692	CreateProcess.exe
4148	CreateProcess.exe
1748	i_jdbvtnljdb.exe
2728	qnlgdysqli.sys
2512	CreateProcess.exe
5244	xvqnigaysq.exe
1980	CreateProcess.exe
4580	CreateProcess.exe
5232	i_xvqnigaysq.exe
5540	avtnlfdxvq.sys
5432	CreateProcess.exe
5008	avqnifdxvq.exe
2672	CreateProcess.exe
552	CreateProcess.exe
1644	i_avqnifdxvq.exe
1392	pnkfdxusqk.sys
3456	CreateProcess.exe
6072	vsnkfaxvpn.exe
816	CreateProcess.exe
1964	CreateProcess.exe
2728	i_vsnkfaxvpn.exe
5104	pnhfzxrpkh.sys
5228	CreateProcess.exe
5992	khczusmkec.exe
6036	CreateProcess.exe
5220	CreateProcess.exe
4640	i_khczusmkec.exe
4440	kecxupmkec.sys
1352	CreateProcess.exe
1512	wuomgezwrp.exe
5336	CreateProcess.exe
1172	CreateProcess.exe
4652	i_wuomgezwrp.exe
2768	hecwuomjhb.sys
2172	CreateProcess.exe
1840	ebwuomgezw.exe
5840	CreateProcess.exe
4212	CreateProcess.exe
5384	i_ebwuomgezw.exe
6124	ebwuomgebw.sys
3936	CreateProcess.exe
6008	bywromgebz.exe
5028	CreateProcess.exe
4784	CreateProcess.exe
3564	i_bywromgebz.exe
636	qolgdywqoi.sys
5736	CreateProcess.exe
4940	jdbvtrligb.exe
200	CreateProcess.exe
4124	CreateProcess.exe
4332	i_jdbvtrligb.exe
5484	yvqolgdyvt.sys
4140	CreateProcess.exe
4824	oigaytqlid.exe
1748	CreateProcess.exe
4760	CreateProcess.exe
3680	i_oigaytqlid.exe
5504	nlfdxvqnlf.sys
2956	CreateProcess.exe
2728	ifaysqlida.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzxrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaytqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaysqlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrmjebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvsnlfdavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khczusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywromgebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaysqlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaytqkigdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khczusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtnljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avqnifdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkfaxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzxrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigeywrlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkfaxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zusmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaytqkigdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtolgdywqoigayw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtrligb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaytqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrmjebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigeywrlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdavsnkidx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zusmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtrligb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpkhfzxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtnljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywromgebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avqnifdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdavsnkidx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpkhfzxu.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1036	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
432	ipconfig.exe
3736	ipconfig.exe
4264	ipconfig.exe
2872	ipconfig.exe
3632	ipconfig.exe
5980	ipconfig.exe
1744	ipconfig.exe
1948	ipconfig.exe
4644	ipconfig.exe
2836	ipconfig.exe
1720	ipconfig.exe
4112	ipconfig.exe
2496	ipconfig.exe
4888	ipconfig.exe
432	ipconfig.exe
5772	ipconfig.exe
4924	ipconfig.exe
3664	ipconfig.exe
2984	ipconfig.exe
3248	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315767987688028"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{F54D7A95-8A0F-4710-8B82-D940DA02F88A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5828	bvtolgdywqoigayw.exe
5828	bvtolgdywqoigayw.exe
5828	bvtolgdywqoigayw.exe
5828	bvtolgdywqoigayw.exe
5828	bvtolgdywqoigayw.exe
5828	bvtolgdywqoigayw.exe
5828	bvtolgdywqoigayw.exe
5828	bvtolgdywqoigayw.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1748	i_jdbvtnljdb.exe
Token: SeDebugPrivilege	5232	i_xvqnigaysq.exe
Token: SeDebugPrivilege	1644	i_avqnifdxvq.exe
Token: SeDebugPrivilege	2728	i_vsnkfaxvpn.exe
Token: SeDebugPrivilege	4640	i_khczusmkec.exe
Token: SeDebugPrivilege	4652	i_wuomgezwrp.exe
Token: SeDebugPrivilege	5384	i_ebwuomgezw.exe
Token: SeDebugPrivilege	3564	i_bywromgebz.exe
Token: SeDebugPrivilege	4332	i_jdbvtrligb.exe
Token: SeDebugPrivilege	3680	i_oigaytqlid.exe
Token: SeDebugPrivilege	3372	i_ifaysqlida.exe
Token: SeDebugPrivilege	5460	i_fdavsnkidx.exe
Token: SeDebugPrivilege	4184	i_zxrpkhfzxu.exe
Token: SeDebugPrivilege	4288	i_zusmkecwup.exe
Token: SeDebugPrivilege	3328	i_bzxrpjhbzt.exe
Token: SeDebugPrivilege	5104	i_wtrmjebwuo.exe
Token: SeDebugPrivilege	3132	i_oigeywrlid.exe
Token: SeDebugPrivilege	944	i_gaysqlidbv.exe
Token: SeDebugPrivilege	5932	i_gaytqkigdy.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2056	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5368 wrote to memory of 5828	5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 5368 wrote to memory of 236	5368	2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 236 wrote to memory of 2056	236	iexplore.exe	91
PID 2056 wrote to memory of 1752	2056	msedge.exe	92
PID 2056 wrote to memory of 4300	2056	msedge.exe	93
PID 2056 wrote to memory of 1036	2056	msedge.exe	95
PID 2056 wrote to memory of 4300	2056	msedge.exe	93
PID 2056 wrote to memory of 4300	2056	msedge.exe	93
PID 2056 wrote to memory of 5872	2056	msedge.exe	96
PID 2056 wrote to memory of 5872	2056	msedge.exe	96
PID 2056 wrote to memory of 4356	2056	msedge.exe	97
PID 2056 wrote to memory of 4356	2056	msedge.exe	97
PID 2056 wrote to memory of 4356	2056	msedge.exe	97
PID 2056 wrote to memory of 1452	2056	msedge.exe	98
PID 2056 wrote to memory of 1452	2056	msedge.exe	98
PID 2056 wrote to memory of 1452	2056	msedge.exe	98
PID 2056 wrote to memory of 4468	2056	msedge.exe	99
PID 2056 wrote to memory of 4468	2056	msedge.exe	99
PID 2056 wrote to memory of 4468	2056	msedge.exe	99
PID 2056 wrote to memory of 4064	2056	msedge.exe	100
PID 2056 wrote to memory of 4064	2056	msedge.exe	100
PID 2056 wrote to memory of 4064	2056	msedge.exe	100
PID 2056 wrote to memory of 5424	2056	msedge.exe	102
PID 2056 wrote to memory of 5424	2056	msedge.exe	102
PID 2056 wrote to memory of 5980	2056	msedge.exe	105
PID 2056 wrote to memory of 5980	2056	msedge.exe	105
PID 2056 wrote to memory of 4752	2056	msedge.exe	106
PID 2056 wrote to memory of 4752	2056	msedge.exe	106
PID 2056 wrote to memory of 4544	2056	msedge.exe	108
PID 5828 wrote to memory of 1248	5828	bvtolgdywqoigayw.exe	109
PID 2056 wrote to memory of 5336	2056	msedge.exe	111
PID 2056 wrote to memory of 5336	2056	msedge.exe	111
PID 4464 wrote to memory of 4692	4464	jdbvtnljdb.exe	113
PID 2056 wrote to memory of 3532	2056	msedge.exe	118
PID 2056 wrote to memory of 3532	2056	msedge.exe	118
PID 5828 wrote to memory of 4148	5828	bvtolgdywqoigayw.exe	120
PID 5828 wrote to memory of 2512	5828	bvtolgdywqoigayw.exe	124
PID 5244 wrote to memory of 1980	5244	xvqnigaysq.exe	126
PID 5828 wrote to memory of 4580	5828	bvtolgdywqoigayw.exe	129
PID 5828 wrote to memory of 5432	5828	bvtolgdywqoigayw.exe	133
PID 5008 wrote to memory of 2672	5008	avqnifdxvq.exe	135
PID 5828 wrote to memory of 552	5828	bvtolgdywqoigayw.exe	138
PID 5828 wrote to memory of 3456	5828	bvtolgdywqoigayw.exe	142
PID 6072 wrote to memory of 816	6072	vsnkfaxvpn.exe	144
PID 5828 wrote to memory of 1964	5828	bvtolgdywqoigayw.exe	148
PID 2056 wrote to memory of 5772	2056	msedge.exe	150
PID 2056 wrote to memory of 3664	2056	msedge.exe	151
PID 2056 wrote to memory of 3276	2056	msedge.exe	152
PID 5828 wrote to memory of 5228	5828	bvtolgdywqoigayw.exe	155
PID 5992 wrote to memory of 6036	5992	khczusmkec.exe	157
PID 5828 wrote to memory of 5220	5828	bvtolgdywqoigayw.exe	160
PID 5828 wrote to memory of 1352	5828	bvtolgdywqoigayw.exe	164
PID 1512 wrote to memory of 5336	1512	wuomgezwrp.exe	166
PID 5828 wrote to memory of 1172	5828	bvtolgdywqoigayw.exe	169
PID 5828 wrote to memory of 2172	5828	bvtolgdywqoigayw.exe	173
PID 1840 wrote to memory of 5840	1840	ebwuomgezw.exe	175
PID 5828 wrote to memory of 4212	5828	bvtolgdywqoigayw.exe	178
PID 5828 wrote to memory of 3936	5828	bvtolgdywqoigayw.exe	182
PID 6008 wrote to memory of 5028	6008	bywromgebz.exe	184
PID 5828 wrote to memory of 4784	5828	bvtolgdywqoigayw.exe	187
PID 2056 wrote to memory of 5164	2056	msedge.exe	189
PID 2056 wrote to memory of 5164	2056	msedge.exe	189
PID 5828 wrote to memory of 5736	5828	bvtolgdywqoigayw.exe	195
PID 4940 wrote to memory of 200	4940	jdbvtrligb.exe	197

C:\Users\Admin\AppData\Local\Temp\2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_948ec7a09783dbb933dae0b7e6d17161_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5368
- C:\Temp\bvtolgdywqoigayw.exe
  C:\Temp\bvtolgdywqoigayw.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbvtnljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1248
  - - C:\Temp\jdbvtnljdb.exe
      C:\Temp\jdbvtnljdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4692
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbvtnljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4148
  - - C:\Temp\i_jdbvtnljdb.exe
      C:\Temp\i_jdbvtnljdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvqnigaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2512
  - - C:\Temp\xvqnigaysq.exe
      C:\Temp\xvqnigaysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5244
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1980
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvqnigaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4580
  - - C:\Temp\i_xvqnigaysq.exe
      C:\Temp\i_xvqnigaysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\avqnifdxvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5432
  - - C:\Temp\avqnifdxvq.exe
      C:\Temp\avqnifdxvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5008
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2672
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_avqnifdxvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:552
  - - C:\Temp\i_avqnifdxvq.exe
      C:\Temp\i_avqnifdxvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsnkfaxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3456
  - - C:\Temp\vsnkfaxvpn.exe
      C:\Temp\vsnkfaxvpn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6072
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:816
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsnkfaxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1964
  - - C:\Temp\i_vsnkfaxvpn.exe
      C:\Temp\i_vsnkfaxvpn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khczusmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5228
  - - C:\Temp\khczusmkec.exe
      C:\Temp\khczusmkec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5992
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6036
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khczusmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5220
  - - C:\Temp\i_khczusmkec.exe
      C:\Temp\i_khczusmkec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomgezwrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1352
  - - C:\Temp\wuomgezwrp.exe
      C:\Temp\wuomgezwrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1512
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5336
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomgezwrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1172
  - - C:\Temp\i_wuomgezwrp.exe
      C:\Temp\i_wuomgezwrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwuomgezw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2172
  - - C:\Temp\ebwuomgezw.exe
      C:\Temp\ebwuomgezw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1840
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebwuomgezw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4212
  - - C:\Temp\i_ebwuomgezw.exe
      C:\Temp\i_ebwuomgezw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywromgebz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3936
  - - C:\Temp\bywromgebz.exe
      C:\Temp\bywromgebz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6008
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5028
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bywromgebz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4784
  - - C:\Temp\i_bywromgebz.exe
      C:\Temp\i_bywromgebz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbvtrligb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5736
  - - C:\Temp\jdbvtrligb.exe
      C:\Temp\jdbvtrligb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4940
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbvtrligb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4124
  - - C:\Temp\i_jdbvtrligb.exe
      C:\Temp\i_jdbvtrligb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigaytqlid.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4140
  - - C:\Temp\oigaytqlid.exe
      C:\Temp\oigaytqlid.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4824
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1748
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigaytqlid.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4760
  - - C:\Temp\i_oigaytqlid.exe
      C:\Temp\i_oigaytqlid.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifaysqlida.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2956
  - - C:\Temp\ifaysqlida.exe
      C:\Temp\ifaysqlida.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2728
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6132
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifaysqlida.exe ups_ins
    3⤵
    PID:5684
  - - C:\Temp\i_ifaysqlida.exe
      C:\Temp\i_ifaysqlida.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdavsnkidx.exe ups_run
    3⤵
    PID:2876
  - - C:\Temp\fdavsnkidx.exe
      C:\Temp\fdavsnkidx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3468
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4640
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdavsnkidx.exe ups_ins
    3⤵
    PID:5528
  - - C:\Temp\i_fdavsnkidx.exe
      C:\Temp\i_fdavsnkidx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrpkhfzxu.exe ups_run
    3⤵
    PID:4328
  - - C:\Temp\zxrpkhfzxu.exe
      C:\Temp\zxrpkhfzxu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3544
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4056
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrpkhfzxu.exe ups_ins
    3⤵
    PID:3924
  - - C:\Temp\i_zxrpkhfzxu.exe
      C:\Temp\i_zxrpkhfzxu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zusmkecwup.exe ups_run
    3⤵
    PID:5868
  - - C:\Temp\zusmkecwup.exe
      C:\Temp\zusmkecwup.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:524
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:780
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zusmkecwup.exe ups_ins
    3⤵
    PID:5492
  - - C:\Temp\i_zusmkecwup.exe
      C:\Temp\i_zusmkecwup.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzxrpjhbzt.exe ups_run
    3⤵
    PID:1524
  - - C:\Temp\bzxrpjhbzt.exe
      C:\Temp\bzxrpjhbzt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3104
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5504
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzxrpjhbzt.exe ups_ins
    3⤵
    PID:3776
  - - C:\Temp\i_bzxrpjhbzt.exe
      C:\Temp\i_bzxrpjhbzt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtrmjebwuo.exe ups_run
    3⤵
    PID:1176
  - - C:\Temp\wtrmjebwuo.exe
      C:\Temp\wtrmjebwuo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2788
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2452
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtrmjebwuo.exe ups_ins
    3⤵
    PID:636
  - - C:\Temp\i_wtrmjebwuo.exe
      C:\Temp\i_wtrmjebwuo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigeywrlid.exe ups_run
    3⤵
    PID:4668
  - - C:\Temp\oigeywrlid.exe
      C:\Temp\oigeywrlid.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5540
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:120
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigeywrlid.exe ups_ins
    3⤵
    PID:4172
  - - C:\Temp\i_oigeywrlid.exe
      C:\Temp\i_oigeywrlid.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaysqlidbv.exe ups_run
    3⤵
    PID:932
  - - C:\Temp\gaysqlidbv.exe
      C:\Temp\gaysqlidbv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5836
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5768
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaysqlidbv.exe ups_ins
    3⤵
    PID:5668
  - - C:\Temp\i_gaysqlidbv.exe
      C:\Temp\i_gaysqlidbv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaytqkigdy.exe ups_run
    3⤵
    PID:848
  - - C:\Temp\gaytqkigdy.exe
      C:\Temp\gaytqkigdy.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2240
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaytqkigdy.exe ups_ins
    3⤵
    PID:3328
  - - C:\Temp\i_gaytqkigdy.exe
      C:\Temp\i_gaytqkigdy.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvsnlfdavs.exe ups_run
    3⤵
    PID:900
  - - C:\Temp\xvsnlfdavs.exe
      C:\Temp\xvsnlfdavs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5184
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3144
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5980
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffcedffc188,0x7ffcedffc194,0x7ffcedffc1a0
      4⤵
      PID:1752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,2138326430708388607,9517490431713915572,262144 --field-trial-handle=2552,i,5929058461088546802,11640041395969300815,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:2
      4⤵
      PID:4300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,12113149247770373049,12970387003306763586,524288 --field-trial-handle=2552,i,5929058461088546802,11640041395969300815,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:11
      4⤵
      System Time Discovery
      PID:1036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,1190856183946734332,6571022043103669174,524288 --field-trial-handle=2552,i,5929058461088546802,11640041395969300815,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:13
      4⤵
      PID:5872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,18317702447491130735,5505463776464498674,2097152 --field-trial-handle=2552,i,5929058461088546802,11640041395969300815,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:4356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,16124892057743871823,4654704062160055036,2097152 --field-trial-handle=2552,i,5929058461088546802,11640041395969300815,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:1452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,16499392194667072111,17440917149795896921,2097152 --field-trial-handle=2552,i,5929058461088546802,11640041395969300815,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
      4⤵
      PID:4468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,6618365487850471919,6413962511784686163,2097152 --field-trial-handle=2552,i,5929058461088546802,11640041395969300815,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:9
      4⤵
      PID:4064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,5219534856714318790,13323454374924933202,524288 --field-trial-handle=2552,i,5929058461088546802,11640041395969300815,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
      4⤵
      PID:5424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,15195026131806373164,3245672087306621112,524288 --field-trial-handle=2552,i,5929058461088546802,11640041395969300815,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:5980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,3443165225902330923,1698371932297881811,524288 --field-trial-handle=2552,i,5929058461088546802,11640041395969300815,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:14
      4⤵
      PID:4752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,17903581669423350023,13485768853599626230,524288 --field-trial-handle=2552,i,5929058461088546802,11640041395969300815,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
      4⤵
      PID:2316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,17903581669423350023,13485768853599626230,524288 --field-trial-handle=2552,i,5929058461088546802,11640041395969300815,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
      4⤵
      PID:4544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,12435514186966664354,18410021588733488769,524288 --field-trial-handle=2552,i,5929058461088546802,11640041395969300815,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:5336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,10749297812991844290,17098727215048717504,524288 --field-trial-handle=2552,i,5929058461088546802,11640041395969300815,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
      4⤵
      PID:3532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,775301136130338136,14128556822859731585,524288 --field-trial-handle=2552,i,5929058461088546802,11640041395969300815,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:14
      4⤵
      PID:5772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,5668596815676110747,4240080354241299736,524288 --field-trial-handle=2552,i,5929058461088546802,11640041395969300815,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
      4⤵
      PID:3664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,7140607605482723430,18077334522490613119,524288 --field-trial-handle=2552,i,5929058461088546802,11640041395969300815,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
      4⤵
      PID:3276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,15038412816632423015,1579448818296455412,524288 --field-trial-handle=2552,i,5929058461088546802,11640041395969300815,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
      4⤵
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6620,i,6257886396321284714,11221447421669805129,262144 --field-trial-handle=2552,i,5929058461088546802,11640041395969300815,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:10
      4⤵
      PID:5904

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1260

C:\Temp\bvtolgdywqoigayw.sys
C:\Temp\bvtolgdywqoigayw.sys
1⤵
- Executes dropped EXE
PID:3276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3232

C:\Temp\qnlgdysqli.sys
C:\Temp\qnlgdysqli.sys
1⤵
- Executes dropped EXE
PID:2728

C:\Temp\avtnlfdxvq.sys
C:\Temp\avtnlfdxvq.sys
1⤵
- Executes dropped EXE
PID:5540

C:\Temp\pnkfdxusqk.sys
C:\Temp\pnkfdxusqk.sys
1⤵
- Executes dropped EXE
PID:1392

C:\Temp\pnhfzxrpkh.sys
C:\Temp\pnhfzxrpkh.sys
1⤵
- Executes dropped EXE
PID:5104

C:\Temp\kecxupmkec.sys
C:\Temp\kecxupmkec.sys
1⤵
- Executes dropped EXE
PID:4440

C:\Temp\hecwuomjhb.sys
C:\Temp\hecwuomjhb.sys
1⤵
- Executes dropped EXE
PID:2768

C:\Temp\ebwuomgebw.sys
C:\Temp\ebwuomgebw.sys
1⤵
- Executes dropped EXE
PID:6124

C:\Temp\qolgdywqoi.sys
C:\Temp\qolgdywqoi.sys
1⤵
- Executes dropped EXE
PID:636

C:\Temp\yvqolgdyvt.sys
C:\Temp\yvqolgdyvt.sys
1⤵
- Executes dropped EXE
PID:5484

C:\Temp\nlfdxvqnlf.sys
C:\Temp\nlfdxvqnlf.sys
1⤵
- Executes dropped EXE
PID:5504

C:\Temp\fdxvpnhfdx.sys
C:\Temp\fdxvpnhfdx.sys
1⤵
PID:3184

C:\Temp\fcxupnkica.sys
C:\Temp\fcxupnkica.sys
1⤵
PID:2604

C:\Temp\hfzxrpjhcz.sys
C:\Temp\hfzxrpjhcz.sys
1⤵
PID:2720

C:\Temp\ecwuomhezw.sys
C:\Temp\ecwuomhezw.sys
1⤵
PID:2492

C:\Temp\bwurpjhbzt.sys
C:\Temp\bwurpjhbzt.sys
1⤵
PID:6004

C:\Temp\olgeywqolj.sys
C:\Temp\olgeywqolj.sys
1⤵
PID:5912

C:\Temp\olgdbytqlj.sys
C:\Temp\olgdbytqlj.sys
1⤵
PID:5596

C:\Temp\igaytqlida.sys
C:\Temp\igaytqlida.sys
1⤵
PID:5848

C:\Temp\xvsqkifdxv.sys
C:\Temp\xvsqkifdxv.sys
1⤵
PID:3908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avqnifdxvq.exe

Path C:\Temp\avqnifdxvq.exe
Size 361KB
SHA256 1beb3f1721c7a4bd0edaba70fc61b550abb33c7297fa5c5cd7bb996fa43272e9
MD5 3b7b4bc126e96caa91a25fbd920fd01d
SHA1 b891dc54599f6bce78cae18431386f714fa94dc8
SHA512 e2050daf987a613d8505c8157d1b1ba1267cadcdf0582b76353c4b87ed2bbf41b4385386d343e5937fc50b0c66b39a6b3765bfcc1d6638e3276f44711e127375
SSDEEP 6144:dflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:dflfAsiVGjSGecvX
TLSH
T11F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avtnlfdxvq.sys

Path C:\Temp\avtnlfdxvq.sys
Size 293KB
SHA256 6239700da93383cc2f8a86691df5148abb5bafcc225e93af112ec21fa2a83426
MD5 92edebfaae0a5fa79fdfefd0b46fdd29
SHA1 3577797775027d91eada2761eb8a53e47cfb7b5c
SHA512 e01d050f0f1e68af302fbe0918ee99e442a7e5e54755f538ef20f16e93074d1fabdf1d4edea1777549d2b4cd8aa698709a28494dd0f083d139cc2d094bdc14d0
SSDEEP 3072:RtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:RIJjiJcbI03GBc3ucY5DCSj
TLSH
T112545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtolgdywqoigayw.exe

Path C:\Temp\bvtolgdywqoigayw.exe
Size 361KB
SHA256 f7cad020635b04d4b6dbf3abb8712b83e5c31d8c9ee120818f2562c89d14ffea
MD5 b7f6e9946623f2dbca9219fd4e2a82a1
SHA1 0c385d755500dc944a86285d79fb21ad300fce1d
SHA512 ddf9f4accaf51a554b1beb0321c41be6653dba7fb497f3e9a1abb12f40e7e889c3d8f617b0b460d16848fd00221197419cf162c40b4981671550d7cbbb27125d
SSDEEP 6144:kflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:kflfAsiVGjSGecvX
TLSH
T1DB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtolgdywqoigayw.sys

Path C:\Temp\bvtolgdywqoigayw.sys
Size 293KB
SHA256 313aa78490aff94e3a8f5330e71f2f9d7c371009ec645a0076ba357372fe367a
MD5 ed49d29d98dab12b68f5652c1ea86c91
SHA1 edc55d825b773df65a7f5ae1c4e6f43300b4b0f0
SHA512 6efc1b6ddd695e6baaaf3ba5ba54e87caec2d8ee65e4524751945f558741071f76249e6f422dbdc3f3fa59346278c261d087b9fdd55214cca077aee73939307a
SSDEEP 3072:LtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:LIJjiJcbI03GBc3ucY5DCSj
TLSH
T139545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_avqnifdxvq.exe

Path C:\Temp\i_avqnifdxvq.exe
Size 361KB
SHA256 4458c303e4bbce517ba1ae4baa06a4d633963b18336458e468044b44d1c9b8be
MD5 77749213cd376791ea3f611e43cba956
SHA1 b6ef6426ecbb63dc3f17c6190937f21013885771
SHA512 0643bdfc45ab33892ddf84b29587a3c0af548c2806b63317d856c32b9a31605952b0737e1f5121fd4eaf65bbbbd41e38c8b0a2a638671ab169b9d913313772ae
SSDEEP 6144:FflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:FflfAsiVGjSGecvX
TLSH
T1C5747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jdbvtnljdb.exe

Path C:\Temp\i_jdbvtnljdb.exe
Size 361KB
SHA256 9bf7db0fb0f1aa02132f4449ef9d5d0c5946c05742dd95d37a5ea48de71b9dd9
MD5 bf7bbc08c5b27f5d58454d2b0316d0c6
SHA1 263d34a79e8b1a70031fc74b762f65ef42d1e3f2
SHA512 93dc615550699e9e3c3294de4d939f006ece9babb558ac0ded4493c2afaaba4d420bb24df233c40fd1dd01f8d462fcbbe2c5d37c9e2c060cd5ccd322804b08bd
SSDEEP 6144:iflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:iflfAsiVGjSGecvX
TLSH
T11B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_khczusmkec.exe

Path C:\Temp\i_khczusmkec.exe
Size 361KB
SHA256 99fbd5180673aacdeb6e2585647c4ddd244e23595ae83a1a381a641190457759
MD5 bebbfe975aa1bd395db4d98f65873462
SHA1 62c3864e625e1086b59a8bec7378de132b1a63aa
SHA512 59d70739480e31560e58b781285ebd694c6a7b7662253894d96f2d043c1a95c46122b3e64a674c70bdbd4e7fa7f63af8a1ce42239143603b67208b7d6f747035
SSDEEP 6144:vflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:vflfAsiVGjSGecvX
TLSH
T15F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsnkfaxvpn.exe

Path C:\Temp\i_vsnkfaxvpn.exe
Size 361KB
SHA256 3e05242698f4670769c129df2d283a4595621f9831d20e96dfea38dc766f9c65
MD5 ba2211b828ec52feddb81afaa5d4ba8f
SHA1 8f40b686a151e852d0987406a0ea9f9a5c831129
SHA512 a69147fbef247343133a2e6db52712d5ab468cd67ad6aa0cace8722f9580da7051f54b0d656adb0176ff2652600724975bfda361e088018e3ef6d580d4f1d203
SSDEEP 6144:6flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:6flfAsiVGjSGecvX
TLSH
T111747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvqnigaysq.exe

Path C:\Temp\i_xvqnigaysq.exe
Size 361KB
SHA256 34dcf17b48482a678e5feb9680a46d81d79d1be03807bc2a8de0105fc87e4091
MD5 45e6a53bbdaa0a85f526dad7caf7b5b6
SHA1 f5acca83d8131aa50ea514bfe2d18b20d9bf299c
SHA512 53ac20a6330a94e2c3d5f650800cf2cc2540dfea31be7d1ba7c8d6138e8734ee7475aaf694fd752dd4d1dc5f679dde3e72e5bd350075d0351279e95d4b0e78a6
SSDEEP 6144:ZflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:ZflfAsiVGjSGecvX
TLSH
T1A7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbvtnljdb.exe

Path C:\Temp\jdbvtnljdb.exe
Size 361KB
SHA256 d984335cf1eb3d253299d767d8c7facf6053aafc4514edc935c6594bd5c49af4
MD5 ae6cb510aeb1f6da47af93e27c30e46b
SHA1 38699881977f65dd8dfcb1c62fce8f872b679a04
SHA512 d01f24757cd48f99a3f4c56559d9b328e5177bc4ca69591700dcc3fc5bf85e39d1d7ae02a4059f054a1577974dfd59fea9ddd136881dfaf1139f13bb60614f88
SSDEEP 6144:aflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:aflfAsiVGjSGecvX
TLSH
T189747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecxupmkec.sys

Path C:\Temp\kecxupmkec.sys
Size 293KB
SHA256 7edbd329e82f950f77aadea4f46faa59391449519ad05ba6b9aced91789d12ee
MD5 f2fa2c1978b96f4bf750efce5d89f055
SHA1 f8a51e813dd533622f54ff1543f6e64b1c8fe6d1
SHA512 b1a06f01b6f53503d25fe8b3b989b240ebc2457507b8e2d4b7419a24a23a2d2d74cb2179f0b7d3da55afb8619eeb4076b048e5f3d6aa52c39ff2319e91e64584
SSDEEP 3072:EtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:EIJjiJcbI03GBc3ucY5DCSj
TLSH
T18C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khczusmkec.exe

Path C:\Temp\khczusmkec.exe
Size 361KB
SHA256 138ac36d1a711b215f034d0aeb7a940cd2ad526e212f67a89d5e0329e2123e1a
MD5 593bd67b7a7a117e9aa9813b4bcaced7
SHA1 34055bc7f980adfb0710c679fa667a8468306df2
SHA512 3841620921ecf312646900245d35a10d1f8f4e18a0c996269714e7310c4f9c4027a97088977d7a15cd8a95f7f863cfa323782fe410b817dbb4b210f0ea63f3be
SSDEEP 6144:MflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:MflfAsiVGjSGecvX
TLSH
T1FD747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfzxrpkh.sys

Path C:\Temp\pnhfzxrpkh.sys
Size 293KB
SHA256 fd57243ee2f7cc6655db1f4a1af6d49b55b4be80ce715e242132592eebf41e8d
MD5 97c6e64c36fae8456c55e2f55efb280a
SHA1 93ba2e0b3b598ac211f85d7b90e35ce3fa3a31be
SHA512 84bbbb665de404cc02a4a54ae4f0f20aae19e2645faf3a1e1ece3deab316dadbd37490ab9073fb7341cbc2edadd44a0518239b4c30850e98099721bd2cfac1d0
SSDEEP 3072:QtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:QIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnkfdxusqk.sys

Path C:\Temp\pnkfdxusqk.sys
Size 293KB
SHA256 ef0c89bd2b1ffcfd76d57b55414f39b02949c9653def59f723aa7d154d593f51
MD5 6016c66ff6cac3d7a902ce33a6623d50
SHA1 231db323b8620b3ef298d96c7b85db02b58a527c
SHA512 dc53c9ee2e34dc9fa2bdfe10c03c22a8d159de5d4be895c0c3a82faf04ce2ad2a96055da4214b3763f7ed671f8d3fd3450d744d6e2695649ac24ee074427fdd7
SSDEEP 3072:htKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:hIJjiJcbI03GBc3ucY5DCSj
TLSH
T16F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnlgdysqli.sys

Path C:\Temp\qnlgdysqli.sys
Size 293KB
SHA256 564c18aa55018375e8c799a5407567b2abeca4e103df487247ff7532c635f325
MD5 8600224055dd9b8abc80de5a742f5b0a
SHA1 7d1201e254f2d537a19d44111c2e492f9315faca
SHA512 b3a96a2693646d58fda8197d54ea877670a3e4819c664d528114bac5325f478d84d0b970de50e769676514c35e83297d3341734b56e4aba5d4daa5d386e5bc09
SSDEEP 3072:btKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:bIJjiJcbI03GBc3ucY5DCSj
TLSH
T154545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnkfaxvpn.exe

Path C:\Temp\vsnkfaxvpn.exe
Size 361KB
SHA256 39d63ba6f171897821c2b9a4a315bd63df68584e93322beb306b46d6abfd5ca0
MD5 51863f9f2fa14b52ff7f5ad4f12e3681
SHA1 86357c63c99fbfe226b67879a4feea3f5143989d
SHA512 c1e1eb0e09cc5100aafbdf986a82bf25d44b5788f9370cd98caf25071da4681f7d5d281d1eb04d201f49cc33cebc1b94b8e7f37ab9cebc3aa548e10e9aedc152
SSDEEP 6144:iflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:iflfAsiVGjSGecvX
TLSH
T1D7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgezwrp.exe

Path C:\Temp\wuomgezwrp.exe
Size 361KB
SHA256 6f7a8128744fe2e0ef498546bd59ad96eabaed2bb4f46593e6e57e1ef772061c
MD5 0241711d37ca5321212e5339cfc80177
SHA1 8a79cae5d5308d3526e55456be908606998470b0
SHA512 bf3145b40540387ed51fa8ba5ce6a9584290b3dd980ecb06da9dce8afcc1641a901a1b8402e8f9ae6859fe131ac22196c4967b2bb714b9527515aa909c2832a1
SSDEEP 6144:UflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:UflfAsiVGjSGecvX
TLSH
T1A1747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvqnigaysq.exe

Path C:\Temp\xvqnigaysq.exe
Size 361KB
SHA256 ab3c7c696f1604e63765c6c6e678286dc8510a5e1c6c866e2982ff9c15208802
MD5 812d234068be10d837ff365355ab70db
SHA1 e096572f596145b63e0098835d8d37ac20392e6d
SHA512 27d16960a5e2d4cda2c9df4b447cc3730bdf0f9eff76e2c8651e751fc135e4806a0bfcee789d186bfe670bee96426c51d64a2a3bbc79b1d1a81bb7d634a47b2a
SSDEEP 6144:8flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:8flfAsiVGjSGecvX
TLSH
T17D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 41fc9beecf3cac756e11b52d36aa8bc8f49c0603f6ce6d7c7462e3dac4f98667
MD5 fb793dc594e3de698025670113f199b6
SHA1 748c5f431f1ddc3e2254846afcaadbcc51ca0524
SHA512 5341f2b9dce2c67374c0c5a099e64b6692ce451c8840ca4dba011eacd8503ea09b0f05885bf54776509230a320be74068019c389dca7481312499b615f1012ff
TLSH
T14221DC54673F5AC1F7AD69B155EBD59A7239AB5DCB036FF100D0357CCC077052015550
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18f88d57-a0d0-4847-a3ec-f25e09abf61e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\18f88d57-a0d0-4847-a3ec-f25e09abf61e.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4e96e762a660956a5c5c4aa3aeb353613cca31975eb7c1f4cfeeaab9163a85c5
MD5 6b6b34067dcc16f4ceafcc032fd92c41
SHA1 efe109446243828c678b80131d8d6d8e6f4a0fd8
SHA512 f612d35c000515dd4be206d2876e34bab0651305d4c72992ada30620646665aebf3cd9822e79546dab1f0dd4c303aa0f1781804cbd7dce3fa5450edba31a8efa
TLSH
T11941C1F383F4857E8E0156F0AA146E1FCE1C0911432C7C56C4E4AE2B93E3471D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5349b4e0810088483c80ca331bf318d13d4a234ef7f2e2d56c44cc7ea91b2948
MD5 d9a26ae7c21cbcc8f6c6b5b811c4c947
SHA1 3b00f196641f7f81d79d5d902794dd33f5056c0c
SHA512 ae0d68850d79ef2d2b2412c3cd5b1d9adfa00d46768824695673f96b8e58796fd83823fadfa4bc5887adb4a83e7121cd960b63569505aae9178de293418fcba6
SSDEEP 192:sxR2RaCp/f9sIhUZlzoD8p9Q/g6+WNCDh/YCQMuOgGMIgVWJ:sxR2Hp/f9sIhqRS/5c/5MQ
TLSH
T1B342D9156E38A93B5CC7E20DBA25BF53E7F95032A1D41E58AAFC861C04F66DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7846d12a11d0d83944a02738cc6a24a7d35ebab7890c9e51c09ff1aa82e93866
MD5 180cbe253da93041754e774c41dfe2e9
SHA1 5d8c60da6acb87d18602502e0c8d570245209819
SHA512 ab8c7245aaf691af229c822c5c76eb95ba11b016ae66ccef6103d346ab2d009c3f212d0297737e629a7e52ef292c8806b58c02b5da9d9b5caa11f3a2f625ab3f
SSDEEP 192:sxRFRaCp/f9sghUZlzoD8p9Q/g6+WNCDh/YCQMuOgGMIgDwWJ:sxRFHp/f9sghqRS/5c/5M/
TLSH
T1F742D8166E38A93B5CC7E21DBA55BF53E7F85032A1D42E58AAFC861C04F66DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7283cfde62e5bf242170c878d9bf1dc38fef6d1c6583b4b287efa24be4c67bf1
MD5 911884773b07b18155e17e6fb7ddb61f
SHA1 63c42bb651e88e59fb49c153ee5541840d9a28b8
SHA512 7ccd074f302eb6bfd079aad84dffb22b8d46c56c496a577a9817b3516195ae935b029e12b92b299aec6415bbaa7d60fdf1bd0fce819226be2e80c7681373cb53
SSDEEP 192:sxRFRaCp/f9sgtUZlzoD8p9Q/g6+WNCDh/YCrcuOgGMIgDCWJ:sxRFHp/f9sgtqRS/5c/iMB
TLSH
T17D42D8166E38693BACC7E20DBA15BF53E7F8503290942E48AAFC861C14F76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 dda068e50546df6ceebc0dbb176ccbb842d475d8a8b1adfbdfd2304b22022df9
MD5 02db8f2924c3847999d68a9794dcc21c
SHA1 6680475e36a426b4ddef87dc0eb8d02b1aa9154d
SHA512 bbf0634fa4a1fa227fc3e54ff0b9f7149fba8db52015393cb7d9258c7e397ae604cf6292cb0dfa2f7ee89096cb399c1f16af4c9c303ad08ec4979460adbf0a8e
SSDEEP 768:jC+vNN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVe60QqcbroZmh:jC+vN7E7JQWgQ+f4+u1jah60Vco6
TLSH
T158D2EB7B640DCB7F4F804A9DEC197E9F6DA802CB9698CD5047FA841C02C6BEB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e503617ea4351f8e88913c4632620db41dcce4f5319d159390ce0fb19757d5c7
MD5 41b7117ddb391f0655b0aaf15e7245b7
SHA1 b08308d651a6659c4fd6d0b842b1edd1d50036b1
SHA512 7e1b54eb1afccc678746202030b484527c2ba42192bd43890eaf3527f078533148f1e7be37208f1cb83c8b7ef6c1913df7172d92e614b6a5b4173e85d16f72ca
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHmGmbmqmGmAmomomuWmYmNm1gmmmuK4mbI:CbEBVj5JAdSp9/EgTK7j6dJOHZ2HDxTf
TLSH
T16D912001717B02C17C3DA54C84B9C86F82C2B066341AB76B3FA946664B66E479DFF8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a6f07.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a6f07.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7df5cad017cc04ec1e9d564982980f67468a157af0752c0eed98d947b26ebc39
MD5 8882b88751c64875ee1739382865ad87
SHA1 a9ab506b14ca5b244936983de25d4bdce41ea668
SHA512 cde09307badaaa2dcdb48198c4b280dd619c3a1a3322114a668c5785d8e2352dc24f5f64aa8ed5bff6052b82ee55e6c43fe743b3ca00da70e38ccdc21b1bfb06
SSDEEP 768:Orv+4UNbdk3lTxDt/f+p8+p3bd66j+4BRv86aLIWoo:ObsbS3lb48+p3Z6n4ySo
TLSH
T1DD03AE72E869DD339CF6D644B14777837FB810A395C00ED8E8D96B4E419619E2B0F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 f9bc6f64d9318fa8100cea335b0eeebe374b237f71ba48455bc25b64900346af
MD5 ea69083aeaee07cc9a27dc2fa2883020
SHA1 b48a3d6b0133769f4e345ccf2e443a9473484857
SHA512 f97e49c0aef705688e93e84bdc871058a4c0e1c8b82cd6e849ad2bbde1abcfef9f551303928f3686336d12009f7b75da0bf54adc70577b747d0ab1faa33672d5
SSDEEP 768:2NFQ+38wgXD+At/tp8+p3bd66j+4BRv86aLIWof3u1:2c+3qN8+p3Z6n4ySf3C
TLSH
T18D1329F198E79937E8AD8783A37D6E429EBCD063B5844994B7C85E0DCC421BFC70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 cf3036df564f9d750c1622150eee91310812176046d422f86e8b5d4c4957fde1
MD5 8e782d39ed231a1aa746e1521c84ca0c
SHA1 c67f0ee11719fa22f1db2b434634a201c96c68b5
SHA512 1fe5b411800959e20387bcb55199f9ad6a8fc081e311f5bba9b7cbb524ca10dfe22a837c86ba2652822df03c044f9b924e5b9c7e3bd92c7091a439975f2b8d5e
SSDEEP 768:+33YrxDt/fGp8+p3bd66j+4BRv86aLIWof3u1:+33YTw8+p3Z6n4ySf3C
TLSH
T1BFF2BFB1ECA59D339CF9D344B2467783AFF450B395C40ED8E8DCAB1E005225E1B0B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 cdf02bfd2a66ea2e1b7d655949f650769a28d8875b1bd582e7f77539e35be543
MD5 7f8f1307d4156bc5cb4309a5e50b7c00
SHA1 6e67e36b63eff541e6993ac080ee9759b18d9c41
SHA512 29a66a77eb9770463631011c0414ac33f4c351bc1d0b560f837ce1049a7ac39556abcd5024a9cddf5af2593f1100126f89540d778a35c1ce5c46ffbc3cbe1738
SSDEEP 768:Irv+4UNbdD3HcDtFNp8+p3bd66j+4BRv86aLIi/2bwCl1:Ibsbp3eL8+p3Z6n4yV0ww
TLSH
T1F103BE73F96899339CF6CA44B2867A437FF851A396C10AC4E5DD2B4E415A19E230BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 0eb2322013eb98e2638b61dd990b0f456d25f04ea3847e021c13b6f4a987f74c
MD5 6000b53d3d2873919423b0786a521685
SHA1 73a562befeb16747736cef58141edb4bdbf573fd
SHA512 b0fad7b9bb9074bcddce1a9eb1f58fd277d6e8277c9379bbf77c4df61d922e0e5391a016e318e23bb599cb2ebf26159557c5c8e54df41ec9cd84e93948847594
SSDEEP 768:2rv+4UNbdD3OuLDt/fNp8+p3bd66j+4BRv86aLITo2bwCl1:2bsbp3OWL8+p3Z6n4y10ww
TLSH
T17703BF72E869ED339CFAC644B14777837FB821A399C10ED4E4D96B4E005A19E270F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2056_419395676\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 b60ae33e803287d93d110a34443a59a1161aff7d53bcedfcfa1a5d42b1195b29
MD5 f4a2a8daed4b57e3b4f0c82a304dbd84
SHA1 17f2f9fe5f4df5db19017223067c37f41d074a41
SHA512 5ed7a1c3733a2bf64e35cbe04e254e65cdc2684a4cd73ab553c319b08bcdcfd23f47cf1f1d386ce1be1190e03dbacf3ad37858aa7f44a4f52ecfa8f295a1c4f5
TLSH
T1A871238357B9D5B3C1DE5BF102835244F6FB223C072330240B62558AAB70A7A68B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/636-330-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/636-358-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1392-259-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2492-394-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2604-386-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2720-390-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2728-186-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2768-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3184-373-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3276-219-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3908-416-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4440-294-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5104-273-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5484-335-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5504-361-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5540-234-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5596-408-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5848-412-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5912-403-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6004-398-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6124-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download